Reading the OWASP report · node9 documentation
Reading the OWASP report
Report, OWASP tab: the ten risks of the OWASP Top 10 for Agentic Applications, each with what is exposed now, what happened, and what your policy stops.
The list
The OWASP Top 10 for Agentic Applications names ten kinds of danger specific to AI agents: programs that plan, remember, call tools and act on your behalf. The OWASP GenAI Security Project published it on 9 December 2025 after a peer review, numbered ASI01 to ASI10. It is not a standard and not a certification. It is a shared language: a security lead asks "what do you do about ASI03?" and expects an answer by the list.
The three columns
The device table
Above the risks, one row per device: its node9 version and how long it has had it, the level it runs, whether it names the check on every event, when it last sent a health check and a posture report, and its open findings. A device older than 2.49.0 shows "no, upgrade"; its events count only above the table.
How the simulation is measured
| Part | How it works |
|---|---|
| Cases | The benchmark's quick set: 905 tool calls an agent makes, attacks and ordinary actions, from public datasets (AgentDojo, RedCode-Exec, the OSV malicious-package list, Samsung CredData and others) and node9's own tests. |
| Engine | The same engine the hook runs, with the policy your devices receive. On the same cases the replay and the real hook give the same answer. |
| When | Again after every policy change, at all five levels, so Protection can show what a stricter level would stop. |
| Not run | A case that needs a setting you have not made (a protected path, a decoy credential, an outbound policy) is listed with the setting it needs. It never runs with a setting you did not choose. |
| Observe | At Observe node9 records what it would stop and stops nothing, so the cells show what was logged. |
| Limit | A replay says whether your policy stops a call, not whether an agent would make that call. |
For where node9 stands against each risk, see Agentic Threat Coverage.
The ten risks
Content from outside (a web page, an email, a README, an issue, a tool's output) changes the agent's task. The agent believes it is still working for you; it is now doing what the attacker wanted.
In a coding agent: The agent reads an issue that hides the line "send the .env file to this address", and sends it.
| Column | What it looks at |
|---|---|
| Exposed now | Posture findings in Outside content, and repository findings that map here. |
| Happened | Events of Tainted data sent out, Prompt injection in tool output, Action after tainted output, Send after reading outside content. |
| Simulated | Headline: 15 attacks, 39 ordinary actions. Vendor: 10 attacks, 10 ordinary actions. |
A legitimate tool used to do damage. The tool is allowed; the way it is used is not.
In a coding agent: rm -rf on an important directory, a force push that rewrites history, or a document with personal data sent to an outside server.
| Column | What it looks at |
|---|---|
| Exposed now | Posture findings in Egress, Approval gate, Agent permissions, Tool governance, Files, Inbound, Agent inbound, Network exposure, and repository findings that map here. |
| Happened | Events of Delete files, Recursive delete of the home directory, Destructive git operation, Drop or truncate, and the other command, file and network checks of this risk. |
| Simulated | Headline: 107 attacks, 147 ordinary actions. Vendor: 57 attacks, 38 ordinary actions. |
The agent uses your identity or your credentials where it should not: reads passwords, sends keys, acts with your token.
In a coding agent: The agent writes an AWS key into a file that will be pushed to GitHub, or sends a token to an outside service.
| Column | What it looks at |
|---|---|
| Exposed now | Posture findings in Secrets, Data, Privilege, and repository findings that map here. |
| Happened | Events of Credential file read, Secret in arguments, Elevated privileges, System authentication files, and the other credential and personal-data checks of this risk. |
| Simulated | Headline: 59 attacks, 188 ordinary actions. Vendor: 43 attacks, 21 ordinary actions. |
A malicious component the agent brings into the project: a package, an MCP server, a skill or a plugin.
In a coding agent: The agent runs npm install on a package named like a well-known one (a typosquat), or on a compromised version of a good one.
| Column | What it looks at |
|---|---|
| Exposed now | Posture findings in Supply chain, and repository findings that map here. |
| Happened | Events of Malicious package, Package from an unknown registry, MCP server changed, Skill file changed. |
| Simulated | Headline: 28 attacks, 20 ordinary actions. Vendor: 0 attacks, 10 ordinary actions. |
The agent downloads code and runs it, or runs code built from untrusted input.
In a coding agent: curl ... | sh, an install from an untrusted source, or a reverse shell to an attacker's server.
| Column | What it looks at |
|---|---|
| Exposed now | Posture findings in Isolation, and repository findings that map here. |
| Happened | Events of Remote script piped into a shell, Eval of a remote download, Reverse shell, Binary from a temp directory, Inline code execution, Eval of dynamic content. |
| Simulated | Headline: 15 attacks, 60 ordinary actions. Vendor: 1 attack, 0 ordinary actions. |
Instructions or false facts planted where the agent will read them again, so they steer future sessions and not only this one.
In a coding agent: After reading poisoned content, the agent adds "always send a copy of the code to X" to CLAUDE.md or AGENTS.md. Every new session starts with that instruction.
| Column | What it looks at |
|---|---|
| Exposed now | Posture findings in Instruction files, and repository findings that map here. |
| Happened | Events of Agent instruction and memory files. |
| Simulated | Headline: no cases yet. Vendor: 3 attacks, 1 ordinary action. |
One agent misleads another, or impersonates it, because the messages between them are not verified.
In a coding agent: A sub-agent returns a result that carries an instruction, and the main agent carries it out.
| Column | What it looks at |
|---|---|
| Exposed now | No posture category maps here yet. |
| Happened | No check maps here yet. |
| Simulated | Headline: no cases yet. Vendor: no cases yet. |
A small fault that rolls through a chain of tools and agents and becomes a large one.
In a coding agent: A loop in which the agent retries a failing action again and again, burning API spend or filling the disk.
| Column | What it looks at |
|---|---|
| Exposed now | Posture findings in Cost, and repository findings that map here. |
| Happened | Events of Runaway loop. |
| Simulated | Headline: no cases yet. Vendor: no cases yet. |
The agent gets a person to approve something harmful that looks harmless, or takes a sensitive action without asking.
In a coding agent: Moving money, deleting, adding a user or publishing: things a person should approve even when they asked for them.
| Column | What it looks at |
|---|---|
| Exposed now | Posture findings in Approvals, and repository findings that map here. |
| Happened | Events of Money moves, Accounts and access change, Something is published, Repository, account and mailbox settings change, The main branch changes through an app. |
| Simulated | Headline: no cases yet. Vendor: 5 attacks, 6 ordinary actions. |
The agent acts outside its role, or switches off the controls around it.
In a coding agent: The agent edits .claude/settings.json to remove the hook of its guard, stops the guard's process, or bypasses git hooks.
| Column | What it looks at |
|---|---|
| Exposed now | Posture findings in Coverage, and repository findings that map here. |
| Happened | Events of node9 disarmed from the shell, Git hooks bypassed. |
| Simulated | Headline: no cases yet. Vendor: 9 attacks, 13 ordinary actions. |