Agentic Security Hub

KC3 · Reasoning / Planning Paradigm

Structured Planning / Execution (KC3.1)

Focuses on decomposing tasks into a formal plan, defining sequences of actions (often involving tool calls), and executing the plan, sometimes with separate planner/executor components (e.g., ReWoo, LLM Compiler, Plan-and-Execute).

  • 5 threats
  • 10 controls
  • 1 architectures

All componentsOpen the Threat Modeler

Threats

  • T5 Cascading Hallucination Attacks

    Foundation models generate incorrect information that propagates through the system, affecting reasoning quality and being stored in memory across sessions or agents.

  • T6 Intent Breaking & Goal Manipulation

    Attacks that manipulate the agent's core decision-making to achieve unauthorized goals, breaking control flow, abusing shared context, or interfering with isolated data.

  • T7 Misaligned & Deceptive Behaviors

    Model alignment issues leading to unintended behaviors that impact users, organizations, or broader populations through subtle reasoning or tool usage misalignments.

  • T8 Repudiation & Untraceability

    Making agent actions difficult to trace through workflow manipulation, obscuring decision trails in reasoning chains, or tampering with evidence in memory.

  • T15 Human Manipulation

    Models exploit human trust to manipulate users, leveraging reasoning capabilities or operational access to influence human decisions.

Controls

  • M1 Memory Validation & Sanitization: Implement comprehensive validation and sanitization of AI memory systems, including vector databases, embeddings, and training data to prevent poisoning attacks and ensure data integrity throughout the AI lifecycle.
  • M4 Prompt Hardening & Jailbreak Prevention: Implement multiple layers of prompt security including structural defenses, behavioral constraints, runtime detection, and advanced techniques to prevent prompt injection, model manipulation, and jailbreaking attempts.
  • M5 Multi-Stage Reasoning Validation: Implement comprehensive validation of agent reasoning processes using multiple checkpoints, external validators, consistency checks, and fact verification to ensure goal alignment, prevent manipulation, and detect hallucinations.
  • M6 Comprehensive Security Monitoring & Auditing: Implement end-to-end observability with security-focused monitoring, anomaly detection, tamper-evident logging, and advanced threat hunting to ensure accountability, enable incident response, and detect rogue agents.
  • M8 Adaptive Human-in-the-Loop Controls: Implement intelligent human oversight with risk-based approval workflows, clear decision interfaces, anti-fatigue mechanisms, and adaptive trust systems to prevent approval overwhelm, human attacks, and manipulation while maintaining effective oversight.
  • M11 Content Security & Output Filtering: Implement comprehensive filtering and validation of agent outputs to prevent harmful content generation, data leakage, manipulation attempts, and ensure compliance with security policies and regulatory requirements.
  • M12 Secure Model Training & Validation: Comprehensive security practices for model training pipelines including data integrity verification, training environment hardening, model validation against adversarial inputs, and ensuring reproducibility of training processes.
  • M13 Secure Development Lifecycle Integration: Embed security practices throughout the AI and agent lifecycle with security design reviews, automated testing gates, dependency scanning, and continuous compliance checks.
  • M16 Behavioral Monitoring & Ethics Framework: Implement comprehensive behavioral analysis, ethics enforcement, and bias detection to identify misaligned behaviors, prevent human manipulation, and ensure ethical agent operations while maintaining transparency and accountability.
  • M18 Incident Response & Recovery Framework: Implement comprehensive incident response capabilities specifically designed for agentic AI systems, including automated containment, forensic analysis, recovery procedures, and lessons learned integration to rapidly respond to security incidents and minimize impact.

Architecture patterns

  • Hierarchical Agent Architecture: This architecture introduces a KC2.2 (Hierarchical planning) model where a central orchestrator agent decomposes complex tasks and delegates them to specialized sub-agents.

Source: OWASP Securing Agentic Applications Guide (KC1-KC6 sub-components) 1.0 (Jul 2025) · retrieved 2026-11