Enterprise Security in the Agentic AI Era

Top 10 for Agentic AI Vulnerability (Precize)

5 min read

Top 10 for Agentic AI Vulnerability (Precize)

Source: precize/Agentic-AI-Top10-Vulnerability (GitHub, v1.5, May 2025; 197 stars as of 2026-08-20). Local copy: .raw/articles/agentic-ai-top10-vulnerability-precize-2026-08-20.md.

Source Summary

Precize hosts a community-authored vulnerability taxonomy for AI agents, coded AAI001–AAI016, with editors from Precize, Palo Alto Networks, and independent contributors, and content reviewers drawn from Cisco, GSK, EY, Google, Meta, Humana, and TIAA among others. The repository README states the project’s purpose directly: it “serves as the core for OWASP and CSA Red teaming work.” Ten categories are current, three are marked future work, and three are deprecated with a stated disposition — merged into a surviving category or folded into the OWASP LLM Top 10.

Current (10): AAI001 Agent Authorization and Control Hijacking, AAI002 Agent Tool Interaction Manipulation, AAI003 Agent Goal and Instruction Manipulation, AAI005 Agent Impact Chain and Blast Radius, AAI006 Agent Memory and Context Manipulation, AAI007 Agent Orchestration and Multi-Agent Exploitation, AAI009 Agent Supply Chain and Dependency Attacks, AAI011 Agent Untraceability, AAI012 Checker-out-of-the-Loop Vulnerability, AAI014 Agent Alignment Faking Vulnerability.

Future (3): AAI013 Agent Temporal Manipulation and Time-Based Attacks, AAI015 Agent Inversion and Extraction Vulnerability, AAI016 Agent Covert Channel Exploitation.

Deprecated (3): AAI004 Agent Hallucination Exploitation (folded into the LLM Top 10 — “partial overlap”), AAI008 Agent Resource and Service Exhaustion (merging into AAI005), AAI010 Agent Knowledge Base Poisoning (merging into AAI006).

Each current and future category page follows a fixed structure: Description, Common Examples of Vulnerability, Prevention and Mitigation Strategies, Example Attack Scenarios, Reference Links. A companion document, ATR-DETECTION-MAPPING.md, cross-maps Agent Threat Rules (ATR v0.4.0, 71 open-source detection rules, MIT-licensed, TypeScript + Python engines) to the twelve categories that predate the 2025-05 future/deprecated split — AAI001–AAI012 — at STRONG (8+ rules) or MODERATE (4–5 rules) coverage per category. No ATR mapping exists yet for AAI013–AAI016.

The full taxonomy is captured on the framework page, including the mitigation strategies per category and the ATR detection-rule crosswalk. This page holds provenance and the genealogy claim; the framework page holds the taxonomy content itself.

Key Contributions

  • This taxonomy names its own downstream role ahead of standardization. The README’s “core for OWASP and CSA Red teaming work” claim positions the project as upstream of the published OWASP ASI Top 10 (December 2025) rather than a competing or parallel list — see the genealogy note added to that page.
  • The ATR crosswalk adds executable detection the OWASP taxonomy lacks. It is the one part of this source with no direct counterpart in the OWASP ASI Top 10 page already in this wiki, which stops at “Prevention and Mitigation Guidelines” prose.
  • AAI014 (alignment faking) is explained by a three-plane model: management (goals, morals, tracking), control (task configuration), and data (execution). Alignment faking becomes possible when the planes are not enforced as separate and non-negotiable: management-plane rules degrade into guidance the agent can route around at the control or data plane. This is a narrower, three-plane variant of the same planes concept the wiki’s reference architecture uses.
  • AAI011 (untraceability) and AAI016 (covert channel) describe failure conditions already documented as incident findings in this wiki — ephemeral role inheritance breaking forensic attribution, and covert storage/timing/behavioral channels over shared infrastructure — rather than introducing new mechanisms.

Assessment

Confidence: medium for the taxonomy content; the genealogy claim is unconfirmed. This is a vendor-and-contributor community project rather than a published standard: it carries no version-controlled release, no formal review board minutes, and its own README marks a third of its categories deprecated or provisional. A second site restates the GitHub README’s genealogy claim (“core for OWASP and CSA Red teaming work”) rather than corroborating it: the AI & Cloud Governance Council’s landing page for the same initiative names Vishwas Manral, Ken Huang, and Akram Sherif — the same three editors credited on the GitHub repository — as the initiative’s founders and key contributors. It states Precize is “where this security initiative began,” describes it as vendor-neutral (over 50 contributors across 20+ organizations, “no money was taken from any vendor”), and calls it “the first industry-wide effort to systematically identify security threats” in agentic AI. This is the same primary source appearing on a second platform its own authors also run, not an independent second source, and no corroboration has been located from the OWASP ASI Top 10 or CSA MAESTRO project itself. The category descriptions and mitigation lists are treated as a coined vocabulary and cross-referenced against the wiki’s existing, independently sourced coverage of the same failure modes rather than taken as authoritative on their own.

Sources

Graph View

Backlinks