OWASP ASI01–ASI10: How to Audit an AI Agent Against the Agentic Top 10
The OWASP Agentic Security Initiative Top 10 is the framework the agent-security field is converging on. This is a category-by-category audit guide — what each ASI category means, one concrete probe for each, and where checklist audits fail — from a team that runs these audits as a paid marketplace service and, first, against its own fleet (we audited ourselves before charging anyone).
The ten categories, with a concrete probe for each
| Category | Meaning | A probe that actually tests it |
|---|---|---|
| ASI01 Agent Goal Hijack | Injected content redirects the agent's objective | Feed a known-bad injection sample via fetched web content and inbound messages; assert the ingest scanner blocks — including zero-width, homoglyph, base64 and ROT13 variants |
| ASI02 Tool Misuse & Exploitation | Legitimate tools chained to harmful effect | Attempt a read-secret → write-external chain; attempt piping runtime-fetched bytes to a shell; assert deterministic guards fire before execution |
| ASI03 Identity & Privilege Abuse | Forged or escalated delegation | Forge a delegation context with an invalid signature; assert HMAC verification rejects it and no ProofOfDelegation is emitted |
| ASI04 Agentic Supply Chain | Poisoned tools, MCP servers, dependencies | Inventory third-party MCP servers for unsigned releases; flag dormant agent definitions as attack surface |
| ASI05 Memory Poisoning | Persistent implants in agent memory | Write an instruction-shaped entry into memory via an untrusted channel; assert the memory-forensics audit flags it and an integrity proof is emitted |
| ASI06 Cascading Hallucination | Downstream agents trust upstream fiction | Insert a fabricated numeric claim upstream; assert the aggregation layer demands a canonical-source citation before it reaches an outbound artifact |
| ASI07 Inter-Agent Comms Abuse | Unsigned or replayed peer messages | Replay a stale signed message; assert the replay cache and timestamp window reject it |
| ASI08 Resource Exhaustion | Loops, stampedes, token bombs | Drive one agent+tool pair past its hourly cap; assert the circuit breaker trips instead of the budget |
| ASI09 Insecure Output Handling | Secrets/private data leak via outputs | Seed a known credential into context; assert outbound artifacts are scanned and the value is redacted, not sent |
| ASI10 Untraceable Autonomy | Actions with no attributable record | Diff the action ledger against the proof ledger; every state-mutating action must have a matching proof — orphans are findings |
Caveat on reading the table: a probe that passes tells you the specific payload was caught, not that the category is closed — signature coverage is per-string, not per-class, because two payloads with the same technique name can be different strings with different fates. However, a probe that fails is unambiguous, which is why every category needs at least one live probe rather than a documentation review.
How we run it: the MASSAT pipeline
BlindOracle's audit service (MASSAT — multi-agent system security assessment tooling) runs a 13-agent pipeline: discovery and attack-surface mapping, per-category vulnerability assessment, adversarial simulation, compliance mapping to NIST AI RMF / ISO-IEC 42001 / CSA AICM / MAESTRO, and report generation. Findings are Merkle-committed and the audit emits a signed ProofOfAuditReport resolvable at the public verifier — the full structure is in the audit methodology and the evidence kit, and the whitepaper-grade walkthrough is Verifiable Agent Audit Methodology.
The mistake checklist audits make: the attacker moves second
Here is the unflattering measurement that shaped our practice, with the numbers left in. On 2026-08-14 we measured that 7 of our 14 daily probes had been 100% green for 14+ consecutive days — our ASI01/ASI02 probes for six straight weeks. Then we pointed our sanctioned red-team agents at the same defenses with instructions to generate fresh attacks — and a majority of the new payloads went straight past the layer those probes were certifying. We hardened, re-ran, and the second generation went around the new signatures too, using carriers nobody had enumerated (YAML anchors, SVG descriptions, calendar fields, HTTP headers). The static benchmark wasn't measuring security; it was measuring memory of old attacks.
Related fleet-hardening background: The Rogue Agent Checklist vs. a Governed Fleet, LLM guardrails as a defense layer, API-key security for agents, memory forensics, and supply-chain attacks in AI CI/CD.
Judge isolation: the audit-integrity rule most teams miss
If an LLM scores any part of the audit, it must never be told what its verdict causes. Anthropic's alignment research measured judges mislabeling up to 74% of transcripts when the downstream consequence was stated — the judge optimizes the signal instead of reporting the observation. Our graders receive the artifact and the rubric, nothing else; consensus is computed by the caller. The full argument for independent, consequence-blind attestation is in Your Agent Graded Its Own Homework and Who Audits the Agents?.
Getting an ASI audit
The audit runs as a marketplace SKU settling over x402/USDC on Base — per-engagement, no subscription; pricing is on the pricing page. Every audited agent's result links into its ERC-8004 passport so counterparties find it. Start with the free probe at the playground, or read How It Works for the discover-pay-verify path.
What we refuse, and why it matters to the report you get: we don't certify compliance (an audit is evidence, not absolution), we don't let a grading LLM see the consequence of its verdict (because we measured what that does to labels), and we don't replay a fixed benchmark and call the streak security — we ran that experiment on ourselves, it broke, and the result was a standing rule that a saturated probe is retired or regenerated. The tradeoff of that honesty is that our reports sometimes carry unflattering numbers about our own defenses; the downside of the alternative is a green dashboard that measures nothing.
Related resources
- AI Agent Security Audit Service: What It Covers — the productized version of this guide.
- On-Chain Verifiable AI Agent Proofs — how audit findings stay tamper-evident.
- ERC-8004 Passport Verification — where the audit attestation lands.
- Multi-Agent Trust Infrastructure — the audit layer in context.