💡 OWASP Agentic Top 10 Posture Scoring: Operationalize the Published Framework

[github-actions[bot]]

Summary

The OWASP Top 10 for Agentic Applications 2026 framework has been formally published, providing concrete risk categories (ASI01–ASI10) and assessment criteria. Operationalize this framework as an automated periodic self-assessment that scores the agent fleet against all 10 categories, tracks posture over time, and highlights gaps requiring remediation.

Market Signal

The OWASP GenAI Security Project published the Top 10 for Agentic Applications in early 2026, endorsed by Palo Alto Networks, Auth0/Okta, and NeuralTrust. The 10 risk categories are:

1. ASI01 — Agent Goal Hijack
2. ASI02 — Tool Misuse & Exploitation
3. ASI03 — Agent Identity & Privilege Abuse
4. ASI04 — Agentic Supply Chain Compromise
5. ASI05 — Unexpected Code Execution
6. ASI06 — Memory & Context Poisoning
7. ASI07–ASI10 — Additional categories covering cascading failures, trust boundaries, and more

A CVSS-10 supply chain attack against Gemini CLI was disclosed in May 2026 (Pillar Security), demonstrating that agentic supply chain compromise (ASI04) is an active, real-world threat — not theoretical.

User Signal

• Existing discussion 💡 OWASP Agentic Top 10 Security Posture Scoring for the Agent Fleet #636 proposed OWASP scoring but predated the full framework publication
• agent-shield.yml provides baseline injection defense (partial ASI01 coverage)
• push-protection.sh and gitleaks config handle secret scanning (related to ASI05)
• SHA-pinning standard and release-channel tags address supply chain (partial ASI04)
• Compliance audit workflow (Compliance: non-stub-feature-ideation.yml #629, Compliance: open_secret_alerts #630) implements automated security checks
• Gap: No unified posture scoring exists across all 10 categories

Technical Opportunity

Many OWASP categories already have partial coverage in this repo:

• agent-shield.yml → ASI01 (Goal Hijack defense)
• SHA-pinning standard + release-channel tags → ASI04 (Supply Chain)
• push-protection.sh → related to ASI05 (Code Execution)
• Token permissions + GITHUB_TOKEN least-privilege → ASI03 (Identity/Privilege)

A scoring script could assess each category by checking for the presence and configuration of existing defenses, outputting a posture scorecard. The review-registry pattern (scripts/lib/review-registry.tsv) could serve as a model for the assessment registry.

Assessment

Dimension	Score	Rationale
Feasibility	high	Inventory existing defenses + gap analysis; no new security tooling needed initially
Impact	high	First systematic view of agentic security posture; identifies blind spots before exploits
Urgency	high	CVSS-10 Gemini CLI attack in May 2026 shows these threats are active, not theoretical

Adversarial Review

Strongest objection: Security posture scoring can create a false sense of security — a green scorecard doesn't mean the system is actually secure, especially against novel attack vectors not covered by the OWASP categories.

Rebuttal: The scorecard is a tracking and prioritization tool, not a security guarantee. Its value is directional: it identifies which OWASP categories have no coverage (gaps) vs. partial coverage (improvement opportunities) vs. strong coverage (maintain). The May 2026 Gemini CLI CVSS-10 attack demonstrates that even well-known categories (supply chain) produce real exploits. Systematic tracking prevents the "we thought we were covered" failure mode.

Suggested Next Step

Map each OWASP ASI01–ASI10 category to existing defenses in the repo, identify uncovered categories, and build a scoring script that outputs a posture report to the step summary.