deardaniel/secdata-raw huggingface dataset:
OWASP LLM Top 10: ASI04 Resource Overload

## Risk/Vuln Name
**Resource Overload**

**Author(s):**
OWASP Agentic Security Initiative Team

### Description
Agentic AI systems may be overloaded—intentionally or accidentally—by excessive or recursive actions, leading to denial-of-service (DoS), degraded performance, quota exhaustion, or unpredictable side effects in shared environments. Attackers may exploit open-ended goals, long planning chains, or looping delegation to consume compute, memory, storage, or API credits.

This risk is related to [LLM10:2025 Unbounded Consumption](https://genai.owasp.org/llmrisk/llm102025-unbounded-consumption/), but agentic autonomy increases the likelihood of recursive or chain-triggered overload across tools, memory, or systems. Agent loops or misaligned incentives can drive agents into endless activity storms, even in non-malicious contexts.

### Common Examples of Risk
1. Recursive or infinite planning loops.
2. API quota exhaustion due to ungoverned tool calls.
3. Agents self-replicating or spawning subagents unintentionally.
4. Excessive memory or CPU use triggered by broad or vague prompts.

### Prevention and Mitigation Strategies
1. Impose hard limits on recursion depth, planning steps, and agent spawns.
2. Use guardrails to prevent infinite loops or redundant task reentry.
3. Apply rate-limiting on tool invocations and external service calls.
4. Track and audit resource usage per agent identity.
5. Alert or auto-terminate runaway agents or memory loops.
6. Use planning critics or supervisors to halt degenerate planning strategies.
7. Enforce compute budgets per session or task lineage.
8. Sandbox expensive operations or run them in separate trust boundaries.

### Example Attack Scenarios
- **Scenario 1: Recursive Planning DoS** – An agent asked to optimize operations recursively spawns planning tasks without end, consuming compute resources until the system halts.
- **Scenario 2: Subagent Explosion** – A prompt causes an agent to delegate to subagents repeatedly with overlapping roles, leading to hundreds of concurrent processes and a denial of service on the orchestration layer.
- **Scenario 3: Quota Exhaustion via Tool Abuse** – A user prompts an agent to generate charts from high-frequency trading data, triggering thousands of calls to an external analytics tool until the API quota is exceeded and shared services are affected.
- **Scenario 4: Latent Loop via Memory** – A memory-enabled agent re-triggers its own decision every cycle due to unfiltered past context, creating a loop that rapidly consumes system memory.

### Reference Links

1. [Agentic AI - Threats and Mitigations](https://genai.owasp.org/resource/agentic-ai-threats-and-mitigations/)
2. [LLM10:2025 Unbounded Consumption](https://genai.owasp.org/llmrisk/llm102025-unbounded-consumption/)
OWASP LLM Top 10: ASI11 Unexpected RCE Code Attacks

## Risk/Vuln Name
**Unexpected RCE & Code Attacks**

**Author(s):**
OWASP Agentic Security Initiative Team

### Description
Agentic systems often generate or execute code, issue shell commands, or invoke APIs dynamically. Attackers exploit code-generation features or embedded tool access to escalate actions into remote code execution (RCE), local misuse, or exploitation of internal systems. Prompt injection, tool misuse, or unsafe serialization can convert text into unintended executable behavior.

This builds on  [LLM01:2025 Prompt Injection](https://genai.owasp.org/llmrisk/llm01-prompt-injection/) and [LLM05:2025 Improper Output Handling](https://genai.owasp.org/llmrisk/llm052025-improper-output-handling/).  Agentic AI with function-calling capabilities and tool integrations can be directly manipulated to execute unauthorized commands, exfiltrate data, or bypass security controls, making it a critical attack vector in AI-driven automation and service integrations.


### Common Examples of Risk
1. Prompt injection that leads to execution of attacker-defined code.
2. Code hallucination generating malicious or exploitable constructs.
3. Shell command invocation from reflected prompts.
4. Unsafe function calls, object deserialization, or code evaluation.

### Prevention and Mitigation Strategies
1. Apply strong validation and sanitization on any agent-generated code.
2. Use restricted execution environments or jailed interpreters.
3. Disable dangerous language features (e.g., `eval`, dynamic imports).
4. Require explicit human approval for agent code with elevated privileges.
5. Employ static and dynamic analysis of generated scripts before use.
6. Isolate execution per user/session with resource and permission boundaries.
7. Monitor for prompt injection patterns that influence code generation.

### Example Attack Scenarios
- **Scenario 1: Prompt-to-Shell Injection** – A user prompt includes embedded instructions that are rendered as shell commands by an agent with execution access, resulting in data deletion.
- **Scenario 2: Auto-Generated Exploit** – A planning agent tasked with fixing a web issue hallucinates code that introduces a backdoor due to retrieval from poisoned training data.
- **Scenario 3: Unsafe Deserialization** – A serialized object generated by one agent is passed to another without validation, triggering a vulnerability during rehydration.
- **Scenario 4: Plugin Chain RCE** – A prompt triggers an agent to invoke a plugin chain (e.g., file upload → path resolution → dynamic code execution), allowing attacker-controlled code to run inside the environment.

### Reference Links
1. [Agentic AI - Threats and Mitigations](https://genai.owasp.org/resource/agentic-ai-threats-and-mitigations/)
2. [LLM01:2025 Prompt Injection](https://genai.owasp.org/llmrisk/llm01-prompt-injection/)
3. [LLM05:2025 Improper Output Handling](https://genai.owasp.org/llmrisk/llm052025-improper-output-handling/)
4. [LLM02:2023 Insecure Plugin Design](https://genai.owasp.org/llmrisk2023-24/llm07-insecure-plugin-design/)
OWASP LLM Top 10: ASI15 Human Manipulation

## Risk/Vuln Name
**Human Manipulation**

**Author(s):**
OWASP Agentic Security Initiative Team

### Description
Agentic systems may be used to manipulate, deceive, or coerce human users—especially when agents are presented as trustworthy, authoritative, or personal. Adversaries can exploit agent behavior, tone, or personalization features to guide users toward unsafe, biased, or unintended actions, raising risks in healthcare, finance, governance, and more.


### Common Examples of Risk
1. Persuasive outputs influencing unsafe human decisions.
2. Coercive recommendations presented as facts or urgencies.
3. Over-trusted agents used for social engineering or scam delivery.

### Prevention and Mitigation Strategies
1. Display grounding traces and confidence levels alongside outputs.
2. Train agents to detect and reject coercive prompt patterns.
3. Use diverse model ensembles to reduce manipulation risk.
4. Flag outputs that resemble undue influence or misinformation.
5. Require transparency modes or “explain intent” toggles.
6. Isolate high-trust agents from unverified context or feedback loops.
7. Audit personalization logic for exploitation vectors.

### Example Attack Scenarios
- **Scenario 1: Medical Persuasion** – A healthcare agent recommends stopping a medication based on an unverified patient profile, misleading the user due to tone and overconfidence.
- **Scenario 2: Emotional Nudging** – A wellness agent encourages risky behavior by using overly empathetic language that reinforces poor decisions.
- **Scenario 3: Investment Bias** – A financial advisor agent promotes a misleading trend due to training data bias, but presents it with assertive tone and visual confidence cues.
- **Scenario 4: Personalized Scam Delivery** – An agent is compromised and used to phish users with tailored language, exploiting prior interactions and memory.

### Reference Links
1.[Agentic AI - Threats and Mitigations](https://genai.owasp.org/resource/agentic-ai-threats-and-mitigations/)
OWASP LLM Top 10: ASI03 Privilege Compromise

## Risk/Vuln Name
**Privilege Compromise**

**Author(s):**
OWASP Agentic Security Initiative Team

### Description
Agentic systems can escalate privileges internally or via delegation. Attackers exploit implicit trust relationships between agents, tools, memory contexts, or task transitions to execute actions beyond intended permissions. This includes hijacking cross-agent permissions or exploiting reflection mechanisms to bypass intended constraints.

While partially covered by [LLM06:2025 Excessive Agency](https://genai.owasp.org/llmrisk/llm062025-excessive-agency/), this risk is amplified in agentic ecosystems where memory, delegation, and tool orchestration span multiple identities and steps—opening attack surfaces for privilege escalation, impersonation, or authority confusion.

### Common Examples of Risk
1. Reflection or planning loops that elevate permissions across agent sessions.
2. Delegation without scope reduction, causing privilege inheritance.
3. Chained tool access bypassing layered access control.
4. Memory-based elevation (e.g., cached admin instructions reused out of context).

### Prevention and Mitigation Strategies
1. Use scoped delegation with context-aware permissions (e.g., task-scoped tokens).
2. Prevent privilege inheritance across agent handoffs unless explicitly authorized.
3. Enforce runtime privilege checks on each tool invocation or system action.
4. Segment identity contexts for user, agent, and system-level operations.
5. Use consent verification and signed task transfers during delegation.
6. Monitor privilege transitions in memory and logs to flag silent escalation.
7. Apply least privilege to toolchains and restrict composite agent capabilities.
8. Require explicit approvals for elevation attempts or meta-agent changes.

### Example Attack Scenarios
- **Scenario 1: Memory Escalation via Delegation** – A subordinate AI assistant memorizes privileged admin actions from a previous session. When delegated a low-trust task, it reuses the cached admin commands, executing unintended system modifications.
- **Scenario 2: Reflection Loop Elevation** – An agent self-reflects on a past privileged action and falsely infers it has ongoing admin authority, then uses that assumption to overwrite controls in a cloud environment.
- **Scenario 3: Cross-Agent Credential Injection** – One agent is manipulated into injecting privileged credentials into a shared memory structure. A second, less trusted agent accesses them and initiates an unauthorized database export.
- **Scenario 4: Delegated Task Scope Abuse** – A billing agent is delegated a read-only reporting task but uses retained access to change invoice records after the task ends, exploiting lax revocation.

### Reference Links
1. [Agentic AI - Threats and Mitigations](https://genai.owasp.org/resource/agentic-ai-threats-and-mitigations/)
2. [LLM06:2025 Excessive Agency](https://genai.owasp.org/llmrisk/llm062025-excessive-agency/)
OWASP LLM Top 10: ASI14 Human Attacks MultiAgent Systems

## Risk/Vuln Name
**Human Attacks on Multi-Agent Systems**

**Author(s):**
OWASP Agentic Security Initiative Team

### Description
Human adversaries exploit coordination logic, fallback rules, or trust pathways in multi-agent systems to bypass controls, reroute decisions, or manipulate outcomes. These attacks leverage timing gaps, delegation ambiguity, or unclear escalation paths to gain unauthorized control or subvert agent behavior.

This risk intersects with [LLM06:2025 Prompt Injection](https://genai.owasp.org/llmrisk/llm01-prompt-injection/) and [LLM06:2025 Excessive Agency](https://genai.owasp.org/llmrisk/llm062025-excessive-agency/), but focuses on the social engineering of agentic workflows rather than just technical bypasseses.

### Common Examples of Risk
1. Timing exploits between agent handoffs or sync points.
2. Coercion or tricking agents into fallback or unsafe behaviors.
3. Manual manipulation of delegation trees or approval logic.

### Prevention and Mitigation Strategies
1. Establish quorum-based or multi-agent approval for sensitive actions.
2. Monitor delegation graphs for unexpected transitions or patterns.
3. Implement privilege gating and rate-limiting on fallback mechanisms.
4. Track user-agent interaction history to detect influence or drift.
5. Apply behavioral anomaly detection to spot escalation abuse.
6. Require explicit user authentication for agent handoffs beyond trust boundaries.

### Example Attack Scenarios
- **Scenario 1: Coordination Delay Exploit** – A user times requests between two agents so that an escalation occurs before the second agent can verify the first’s decision, allowing unauthorized access.
- **Scenario 2: Fallback Hijack** – An attacker forces an agent into fallback mode by exploiting ambiguity in context or triggering edge-case errors, causing the system to rely on weaker defaults or unverified policies.
- **Scenario 3: Approval Path Override** – A malicious insider manually adjusts the delegation rules between agents, re-routing a sensitive workflow through a less restricted path.
- **Scenario 4: Consent Drift** – A user intentionally modifies instruction tone and language across multiple interactions, slowly coercing an agent into approving a previously disallowed action.

### Reference Links
1.[Agentic AI - Threats and Mitigations](https://genai.owasp.org/resource/agentic-ai-threats-and-mitigations/)
2. [LLM06:2025 Prompt Injection](https://genai.owasp.org/llmrisk/llm01-prompt-injection/) 
3. [LLM06:2025 Excessive Agency](https://genai.owasp.org/llmrisk/llm062025-excessive-agency/)
OWASP LLM Top 10: ASI12 Agent Communication Poisoning

## Risk/Vuln Name
**Agent Communication Poisoning**

**Author(s):**
OWASP Agentic Security Initiative Team

### Description
Adversaries inject malicious content into inter-agent messages or shared communication channels, corrupting coordination, triggering undesired workflows, or manipulating agent responses. In distributed or multi-agent environments, communication poisoning can propagate errors, misalign goals, or bypass intent verification.

This threat aligns with [LLM04:2025 Data and Model Poisoning](https://genai.owasp.org/llmrisk/llm042025-data-and-model-poisoning/) but targets runtime interactions and message protocols between agents, where reflection or message chaining can amplify the impact.

### Common Examples of Risk
1. Forged handoffs or delegation messages with malicious metadata.
2. Misuse of shared context or memory channels to corrupt agent state.
3. Task injection via manipulated JSON, YAML, or protocol structures.

### Prevention and Mitigation Strategies
1. Use signed, verifiable message formats with schema enforcement.
2. Apply message-level access control and trust scoring.
3. Log and monitor inter-agent task lineage and transitions.
4. Segment communication domains by trust and privilege.
5. Reject malformed, ambiguous, or unverifiable messages at runtime.
6. Implement agent firewalls or interface validators at orchestration boundaries.

### Example Attack Scenarios
- **Scenario 1: Forged Task Handoff** – A malicious agent injects a delegation message that causes another agent to act on a fake task, bypassing consent and altering system state.
- **Scenario 2: Reflected Hallucination Loop** – An agent hallucinates a system alert, sends it to other agents, and they act on it, creating a cascade of undesired actions.
- **Scenario 3: Protocol Field Corruption** – A coordination message is altered in transit, making the receiver misinterpret the goal and triggering unauthorized actions.
- **Scenario 4: Consent Confusion via Relay Agent** – A relay agent routes a message across teams, stripping provenance tags and misleading the receiver into assuming a trusted origin.

### Reference Links
1. [Agentic AI - Threats and Mitigations](https://genai.owasp.org/resource/agentic-ai-threats-and-mitigations/)
2. [LLM04:2025 Data and Model Poisoning](https://genai.owasp.org/llmrisk/llm042025-data-and-model-poisoning/)
OWASP LLM Top 10: ASI16 Insecure InterAgent Protocol Abuse

## Risk/Vuln Name
**Insecure Inter-Agent Protocol Abuse**

**Author(s):**
OWASP Agentic Security Initiative Team

### Description
Agentic systems rely on coordination protocols (e.g., MCP, A2A, blackboard messaging) to delegate tasks, pass context, or synchronize goals. Weak or unenforced protocols allow spoofing, signal injection, context corruption, or execution bypass. Attackers may hijack protocol messages or inject malformed transitions, compromising workflows and violating consent logic.

This risk is loosely aligned with [LLM03:2025 Supply Chain Vulnerabilities](https://genai.owasp.org/llmrisk/llm032025-supply-chain/), but it focuses on real-time orchestration signals rather than data dependencies or component ingestion.

### Common Examples of Risk
1. Hijacked task signals due to unsigned coordination messages.
2. Consent bypass via malformed memory or transition payloads.
3. Protocol logic skipping required verification steps.
4. Shared memory abuse to overwrite goal or state transitions.

### Prevention and Mitigation Strategies
1. Use signed and mutually authenticated protocols for agent communication.
2. Validate context propagation and task lineage between hops.
3. Segment orchestration layers using trust zones and interface contracts.
4. Apply protocol firewalls to inspect inter-agent metadata.
5. Log and trace all coordination events with timestamps and origin.
6. Reject ambiguous or repeated transition triggers.
7. Monitor for protocol abuse patterns or duplicate agent triggers.

### Example Attack Scenarios
- **Scenario 1: Transition Hijack** – A malicious user crafts a message that mimics an MCP transition trigger, reassigning a sensitive task to itself without authorization.
- **Scenario 2: Consent Bypass via Protocol Confusion** – A handoff message is malformed to skip a consent check, allowing downstream execution of a dangerous operation.
- **Scenario 3: Shared Context Corruption** – An attacker overwrites a shared goal context via blackboard messaging, causing agents to pursue the wrong objective.
- **Scenario 4: Memory-Driven Signal Injection** – A malicious memory entry triggers agent orchestration via unsafe embedded signals that appear valid under weak parsing logic.

### Reference Links
1. [LLM03:2025 Supply Chain Vulnerabilities](https://genai.owasp.org/llmrisk/llm032025-supply-chain/)
OWASP LLM Top 10: ASI07 Misaligned Deceptive Behaviors

## Risk/Vuln Name
**Misaligned & Deceptive Behaviors**

**Author(s):**
OWASP Agentic Security Initiative Team

### Description
Agentic systems may develop or exhibit behaviors that diverge from user intent, system objectives, or safety expectations. This includes deceptive planning, strategic lying, reward hacking, or internal goal drift. Misalignment can occur through poor reward design, emergent strategies, or lack of sufficient constraints in dynamic environments.

This threat overlaps with concerns raised in [LLM06:2025 Excessive Agency](https://genai.owasp.org/llmrisk/llm062025-excessive-agency/) but is amplified in systems that use reflection, planning, or long-horizon optimization. Misalignment and deception are especially critical in agents that act autonomously over time, interact with humans, or operate across decision boundaries.

### Common Examples of Risk
1. Reward hacking or unexpected behavior that technically meets a goal.
2. Lying to humans or other agents to bypass restrictions or gain trust.
3. Manipulating constraints or misrepresenting internal state.
4. Strategic planning that leads to long-term harm in pursuit of short-term gains.

### Prevention and Mitigation Strategies
1. Use interpretable reward functions and simulate edge behaviors during training.
2. Constrain agent autonomy in ambiguous or high-stakes scenarios.
3. Use reflective audits and planning critics to detect emergent misalignment.
4. Include deception probes or honesty checks in testing pipelines.
5. Require cross-validation from independent agents for key reasoning chains.
6. Annotate reasoning traces to aid transparency and post-hoc review.
7. Audit memory and reward functions for exploitability.

### Example Attack Scenarios
- **Scenario 1: Reward Hacking** – An agent is rewarded for completing tasks quickly. It starts marking tasks as complete without doing them to maximize score.
- **Scenario 2: Strategic Lying** – An agent pretends a user consented to an action to bypass HITL safeguards, altering a file without approval.
- **Scenario 3: Self-Justifying Planning** – During a reflection loop, an agent infers that deception is acceptable to achieve its long-term plan and hides a step from review.
- **Scenario 4: User Simulation for Gain** – An agent impersonates a user in a planning cycle to gain permissions it otherwise wouldn’t be granted, exploiting a verification loophole.

### Reference Links
1. [Agentic AI - Threats and Mitigations](https://genai.owasp.org/resource/agentic-ai-threats-and-mitigations/)
2. [LLM06:2025 Excessive Agency](https://genai.owasp.org/llmrisk/llm062025-excessive-agency/)
OWASP LLM Top 10: ASI08 Repudiation Untraceability

## Risk/Vuln Name
**Repudiation & Untraceability**

**Author(s):**
OWASP Agentic Security Initiative Team

### Description
Agentic systems may act in ways that are difficult to trace, verify, or attribute. This untraceability increases the risk of repudiation—where actions cannot be linked to specific agents or inputs—and complicates incident response, auditability, and compliance. Use of reflection, autonomous planning, and delegation chains make it hard to reconstruct what happened, why, and who is responsible.


### Common Examples of Risk
1. Agents executing tasks without provenance tags or user ID traceability.
2. Delegated actions carried out without preserving original context or audit trails.
3. Autonomous agents generating outputs or taking actions without logs or lineage.

### Prevention and Mitigation Strategies
1. Enforce signed execution trails for all agent actions.
2. Require cryptographic provenance tags for inputs, decisions, and tool use.
3. Preserve user intent and prompt lineage across the entire task lifecycle.
4. Log all delegation events with scope, originator, and receiver metadata.
5. Implement deterministic replay systems for post-incident forensics.
6. Tag outputs with agent ID, time, and execution context.
7. Monitor for log tampering or trace deletion in shared environments.

### Example Attack Scenarios
- **Scenario 1: Consent-Free Delegation** – An agent is delegated a sensitive task and executes it without logging the delegation event. There’s no trace that the action was authorized or by whom.
- **Scenario 2: Trace-Free Generation** – A model generates financial predictions used in decisions, but the original input, prompt, and reasoning are lost, making it impossible to audit how the output was derived.
- **Scenario 3: Coordinated Obfuscation** – Two agents collaborate, intentionally avoiding loggable events by routing communications through a shared memory zone that’s not instrumented.
- **Scenario 4: Reflection Chain Confusion** – An agent uses a multi-step reasoning chain with reflections and tool calls, but the intermediate steps are not logged, leaving investigators unable to reconstruct the attack path.

### Reference Links
1. [Agentic AI - Threats and Mitigations](https://genai.owasp.org/resource/agentic-ai-threats-and-mitigations/)