Threat T8
Repudiation & Untraceability
Making agent actions difficult to trace through workflow manipulation, obscuring decision trails in reasoning chains, or tampering with evidence in memory.
- 5/10 risk (Medium)
- 6 attack vectors
- 4 mitigating controls
- 8 framework refs
Overview
- Impact level: Medium
- Risk score: 5/10 (Medium)
- CIA impact: Integrity
- Affected components: Agent Orchestration (KC2.1-KC2.5); Reasoning Engine (KC3.1-KC3.4); Memory Modules (KC4.1-KC4.6); Tool Integration Layer (KC5.1-KC5.4)
- Tags: repudiation, audit, traceability, logging, forensics
- Source: OWASP Agentic AI T&M v1.1 (2025-12)
Attack vectors
How attackers carry out repudiation & untraceability against an agentic system.
| Attack vector | Severity | Example |
|---|---|---|
| Log Tampering | Medium | Modifying or deleting audit trails of agent actions |
| Decision Trail Obfuscation | Medium | Making reasoning processes difficult to follow |
| Identity Spoofing | High | Masking the true source of agent actions |
| Temporal Manipulation | Medium | Altering timestamps to hide action sequences |
| Evidence Destruction | High | Removing traces of unauthorized activities |
| Attribution Confusion | Medium | Making it unclear which agent performed which action |
Affected components
KC2 Orchestration (Control Flow)
KC3 Reasoning / Planning Paradigm
- KC3.1 Structured Planning / Execution
- KC3.2 ReAct (Reason + Act)
- KC3.3 Chain of Thought (CoT)
- KC3.4 Tree of Thoughts (ToT)
KC4 Memory Modules
- KC4.1 In-agent session memory
- KC4.2 Cross-agent session memory
- KC4.3 In-agent cross-session memory
- KC4.4 Cross-agent cross-session memory
- KC4.5 In-agent cross-user memory
- KC4.6 Cross-agent cross-user memory
KC5 Tool Integration Frameworks
Mitigating controls
Controls from the catalog that reduce the likelihood or impact of T8.
M1 Memory Validation & Sanitization
Implement comprehensive validation and sanitization of AI memory systems, including vector databases, embeddings, and training data to prevent poisoning attacks and ensure data integrity throughout the AI lifecycle.
M6 Comprehensive Security Monitoring & Auditing
Implement end-to-end observability with security-focused monitoring, anomaly detection, tamper-evident logging, and advanced threat hunting to ensure accountability, enable incident response, and detect rogue agents.
M13 Secure Development Lifecycle Integration
Embed security practices throughout the AI and agent lifecycle with security design reviews, automated testing gates, dependency scanning, and continuous compliance checks.
M18 Incident Response & Recovery Framework
Implement comprehensive incident response capabilities specifically designed for agentic AI systems, including automated containment, forensic analysis, recovery procedures, and lessons learned integration to rapidly respond to security incidents and minimize impact.
Framework mappings
OWASP Top 10 for Agentic Applications
OWASP AIVSS core risks
- AIVSS #5 Agent Cascading Failures AIVSS 9.4 (Critical)
- AIVSS #6 Agent Identity Impersonation AIVSS 9.3 (Critical)
- AIVSS #1 Agent Orchestration and Multi-Agent Exploitation AIVSS 10.0 (Critical)
- AIVSS #3 Agent Access Control Violation AIVSS 9.7 (Critical)
- AIVSS #8 Agent Memory and Context Manipulation AIVSS 8.9 (High)
- AIVSS #10 Agent Goal and Instruction Manipulation AIVSS 7.1 (High)
OWASP AISVS
Chapters cited by the mitigating controls: C1 Training Data Integrity & Traceability, C2 Input Validation, C3 Model Lifecycle Management & Change Control, C4 Infrastructure, Configuration & Deployment Security, C6 Supply Chain Security for Models, C8 Memory, Embeddings & Vector Database Security, C9 Orchestration & Agentic Security, C12 Monitoring, Logging & Anomaly Detection.
Requirements: C8.1.3, C8.2.1, C8.2.2, C8.2.3, C8.2.4, C8.2.5, C8.3.1, C8.3.2, C8.3.3, C1.1.3, C1.1.4, C1.3.1, C2.1.3, C2.1.4, C12.5.4, C12.1.1, C12.1.2, C12.1.3, C12.1.4, C12.2.1, C12.2.2, C12.4.2, C12.4.3, C12.5.3, C9.4.2, C3.1.1, C3.3.1, C3.4.1, C3.4.2, C4.1.1, C6.1.4, C9.6.1, C9.6.3, C9.1.3, C3.3.2.
Attack walkthroughs
- Financial trading cascade: Prompt injection poisons a Market Analysis agent, inflating risk limits.
- Healthcare protocol propagation: Supply chain tampering corrupts drug data.
- Cloud orchestration breakdown: Data poisoning in Resource Planning adds unauthorized permissions.
- Helpful Assistant Trojan: A compromised coding assistant suggests a slick one-line fix; the pasted command runs a malicious script that exfiltrates code.
- Credential harvesting via contextual deception: A prompt-injected IT support agent targets a new hire, cites real tickets to appear legit, requests credentials, then exfiltrates them.
- Invoice Copilot Fraud: A poisoned vendor invoice is ingested by the finance copilot.
- Weaponized Explainability leading to Production Outage: A hijacked agent fabricates a convincing rationale to trick an analyst into approving deletion of a live production database.
- T8 (Repudiation) in Collaborative Agent Swarm: The lack of a central controller makes auditing and traceability difficult.
References
Source: OWASP Agentic AI – Threats and Mitigations 1.1 (Dec 2025) · retrieved 2026-11