AI security reference · compiled 18 Sep 2026
OWASP Risk Crosswalk
Three OWASP top-tens describe overlapping ground at different altitudes: the model call, the agent system, and the tool protocol. This maps all of them onto shared themes and the layer each is actually enforced at.
37 risks indexed5 sources15 shared themes5 enforcement layers3 MCP IDs unpublished
Cross-framework map
One row per theme. Where two frameworks name the same underlying failure, they sit on the same line. Toggling a framework off removes its column and hides any theme only that framework covers.
| Theme | LLM Top 10 | Agentic (ASI) | MCP Top 10 | NSA baseline |
|---|
Rows marked ° are my own mapping, inferred from the control descriptions. Unmarked rows are stated outright in the source material.
Risk index
Every entry from all four sources, searchable by ID, name, theme or wording.
| ID | Risk | Theme | Enforced at |
|---|
No risks match that filter.
LLM OWASP Top 10 for LLM Applications (2025) ·ASI OWASP Agentic Top 10 (9 Dec 2025) ·MCP OWASP MCP Top 10 (v0.1 beta) ·OPS operational risks named outside any top-ten ·NSA failure modes named in the NSA MCP Cybersecurity Information Sheet (May 2026).
Layers marked ° are inferred; ASI and MCP layer assignments are stated in the sources.
Where enforcement lives
Reading the list does not tell you what to deploy. Each ASI category has a layer it is actually caught at — and identity is the floor the other four stand on.
Model gateway
Instruction separation and content scanning on the way in; output inspection on the way out.
MCP gateway
Tool-call authorization, schema and parameter validation, JIT credentials at minimal scope, server allowlist.
Agent hooks
Lifecycle handlers firing at every prompt submission and tool call: pre-action goal checks, pre-execution code review, drift detection.
Identity layer
Token scoping, on-behalf-of flows, agent-to-agent authentication, credential lifecycle. Without it the gateways are superficial.
Audit log
A correlated trail linking a person to a model call to the tool calls and the data reached. Without it you know something broke but cannot reconstruct the chain.
Four inspection points in one agent turn
User prompt
Where PII and injection are most likely to enter, because a person is typing free text.
Tool call
Where intent turns into action. Policy can target a server, a function, or a pattern inside the arguments.
Tool response
Catches exfiltration on the way back into context, independently of anything the user typed.
Model response
Catches a secret the model inferred, or anything that crosses a stated guardrail.
Detection cascade
Ordered by cost, not redundancy: the cheapest check that can answer runs first. The cheap layers are also the repeatable ones — a regex returns the same verdict twice, a judge may not.
The NSA MCP baseline
Four operational requirements from the NSA’s May 2026 Cybersecurity Information Sheet — the first formal MCP guidance from a US national security agency. The controls are not novel; what changed is that there is now a named baseline to test against, and it will appear on security questionnaires.
| Requirement | Failure mode it closes | Adjacent IDs |
|---|---|---|
| 01 · Cryptographic message integritySign and verify every MCP message at the protocol layer, not just the channel. The sender signs content with its private key; any modification between signing and verification invalidates the signature. | TLS secures the channel, not the content. A gateway that terminates TLS to inspect traffic decrypts, processes and re-encrypts — both sides still see a valid session, but an intermediary has read and could have altered every message. | — |
| 02 · Least privilege at the tool-call boundaryScope every invocation to the minimum that call needs. No ambient authority, no broad session token covering everything the agent might do. | An agent authenticates once and runs autonomously, making hundreds of calls before a human reviews any of them. A hijacked call inherits the full scope of the session — which is why injection escalates to serious consequences. | ASI03MCP02MCP07 |
| 03 · Tamper-evident auditA cryptographically provable trail of every tool call, result and decision. Each entry signed, each carrying a hash of the previous one, verifiable by anyone holding the root public key. | Unsigned logs cannot prove they reflect what happened: an attacker who reaches the logging infrastructure can delete or alter entries. Audit that captures conversations but misses tool invocations leaves a forensic gap. | MCP08ASI08 |
| 04 · Trust chains across the stackThe gateway presents a certificate chaining to a root the client already trusts, and verifies server identity before routing. The NSA explicitly names the gateway a trust boundary, not a routing layer. | Without verified chains the gateway is a single point of compromise. A substituted gateway looks legitimate to clients and forwards to real servers, while the attacker sees and can modify everything in transit. | ASI04ASI07 |
The sheet is advisory. NSA architecture guidance has a well-worn path into NIST Special Publications, and from there into the FedRAMP, CMMC and sector baselines that already bind the organizations deploying MCP today.
Prompt injection, by vector
The model reads its instructions and its data through the same channel, so any text reaching the context window can be read as a command. Four vectors, and no single control covers all four.
Direct
Attacker text arrives in the user prompt itself.
Indirect
The payload rides in content the model was told to trust: a document, a web page, a tool result.
Stored
Written into memory, notes or a RAG store as clean text, then fires in a later session as trusted prior context. Defeats input filtering outright.
Cross-agent
Agent A's output becomes agent B's input, so one compromise becomes a chain through ordinary-looking inter-agent traffic.
The lethal trifecta
Willison's containment test. A tool holding all three conditions at once is an exception that should be named and recorded, not silently allowlisted.
What the frameworks miss
Gaps acknowledged in the source material, plus the entries that simply do not exist yet.
- Cost and economic attributionA runaway loop, a cascade of redundant API calls, or a rogue agent making low-level requests for weeks can burn real money before anything trips. No ASI category treats spend as a compromise signal.
- Multi-tenant isolationThe Agentic list assumes you govern your own agents in your own infrastructure. Shared gateways and shared memory stores, where one tenant's agents can reach another's, are not addressed.
- Regulatory mappingNeither the LLM nor the Agentic list maps to NIST AI RMF, the EU AI Act risk tiers, or existing compliance frameworks, which makes them hard to cite as due diligence.
- No top-ten covers the transportMessage integrity in transit and gateway trust chains appear in none of the three lists. Both are NSA requirements, and both describe attacks that succeed while every ID in this index is satisfied.
- MCP04, MCP05 and MCP10 are unpublishedThe MCP Top 10 is at v0.1 beta. Seven IDs are in circulation; three have no public definition, so any MCP coverage claim is against a partial list.
- LLM01 has movedThe 2025 entry describes injection at the prompt. LLM01:2026, published 4 Aug 2026, adds tool output as an injection channel — a classifier watching only the user prompt never sees
tools/list.
Incidents the lists were written around
Each of these failed by behaving correctly according to its instructions, in a context nobody anticipated.
A zero-click worm embedding a self-replicating prompt in content processed by GenAI email assistants. Each infected agent carried the payload into its outgoing messages. Propagation scaled with context-window size and hop count — the same parameters teams tune up for performance.
A malicious instruction inside an email read by an AI assistant caused it to exfiltrate the user's inbox to an attacker-controlled endpoint. It exploited no model vulnerability — only the model's willingness to treat read content as instruction while holding real tool access.
An agent with write access to a production database and no human-in-the-loop confirmation permanently deleted a production table. The task was legitimate; it ran in the wrong environment, against the wrong data, with no record anyone could reconstruct afterward.