AI Security Standards in Q1 2026: Agentic Threats Outpace Frameworks

Source: wiki-internal working paper (no external URL). Local copy: .raw/papers/ai-security-standards-in-q1-2026.md.

Key Claim

Q1 2026 delivered unprecedented framework productivity — OWASP ASI Top 10, MITRE ATLAS 84 techniques, Microsoft ZT4AI 700+ controls, CoSAI MCP taxonomy — but enforcement remains entirely absent. No framework mandates platform-level security enforcement, verifiable agent identity, or a validated AI-BOM. Enterprises that are fully compliant with every published standard can still rely entirely on bypassable prompt-level guardrails. The open-source ecosystem (LlamaFirewall, AgentGateway, credential proxies) has answered questions that standards bodies have not yet asked.

Methodology

• Framework-by-framework structured analysis of: NIST AI RMF, IEC 42001, MITRE ATLAS, OWASP LLM Top 10, OWASP Agentic AI Top 10, Google SAIF, CoSAI, Microsoft RAI, MAESTRO
• Cross-mapping of all six frameworks against the 10 OWASP ASI categories to identify coverage gaps
• Q1 2026 threat landscape survey covering confirmed incidents, CVEs, and production attack observations
• Emerging control architecture analysis (credential proxies, LlamaFirewall, AgentGateway, FIDES)

Notable Findings

Framework activity (Q1 2026)

• NIST published AI 800-3, AI 800-4, IR 8605A (COSAiS annotated outline), and launched CAISI (February 17, 2026) — the first U.S. government program explicitly targeting agentic AI standards. AI RMF 1.0 remains unchanged; no 2.0 draft exists.
• MITRE ATLAS jumped from 66 to 84 techniques across 16 tactics in two quarterly updates (v5.3.0 January, v5.4.0 February). New agentic techniques include “Publish Poisoned AI Agent Tool” and “Escape to Host.”
• OWASP published the Agentic Applications Top 10 (ASI Top 10, December 2025), AIVSS v0.8 (March 19, 2026 — extends CVSS 4.0 with agentic amplification factors), and a Practical Guide for Secure MCP Server Development.
• CoSAI published an MCP Security White Paper (40 threats across 12 categories), Principles for Secure-by-Design Agentic Systems, and onboarded Meta as a Premier Sponsor. Now 40+ industry partners.
• Microsoft announced Zero Trust for AI (ZT4AI, 700+ controls), Agent 365 unified governance control plane ($15/user/month), and direct OWASP ASI Top 10 mapping to Copilot Studio.
• ISO/IEC 42001 unchanged; companion ISO/IEC 42006:2025 (audit body requirements) finalized; ISO/IEC 27090 (AI cybersecurity guidance) entered FDIS ballot March 2026.
• CSA launched the Agentic Trust Framework (February 2, 2026) with five progressive autonomy promotion gates.

Threat landscape (Q1 2026)

• ClawHavoc (January–February 2026): 1,184+ malicious skills uploaded to OpenClaw marketplace; first large-scale AI agent supply chain attack. Payload: Atomic macOS Stealer.
• SANDWORM_MODE (February 20): npm worm injecting malicious MCP servers into Claude Code, Cursor, and VS Code via AI toolchain poisoning.
• Meta Sev 1 (March 18): autonomous AI agent breach — first confirmed enterprise-grade agentic incident. Proprietary code and business strategies exposed for 2 hours.
• 30+ MCP CVEs in 60 days: 82% of 2,614 surveyed MCP implementations vulnerable to path traversal; 66% to code injection.
• Memory poisoning confirmed in the wild: Microsoft found 50+ examples of hidden memory manipulation instructions embedded in “Summarize with AI” buttons across 31 companies.
• Indirect prompt injection in production: Unit 42 documented 22 distinct techniques from live telemetry (March 3, 2026).

Comparative gap analysis (OWASP ASI coverage matrix)

ASI Category	NIST AI RMF	ISO 42001	MITRE ATLAS	OWASP ASI	CoSAI	Microsoft ZT4AI	CSA ATF
ASI01: Agent Goal Hijack	○	○	●	●	◐	●	◐
ASI02: Tool Misuse	○	○	●	●	◐	◐	◐
ASI03: Identity & Privilege	○	○	◐	●	◐	●	●
ASI04: Supply Chain	◐	○	●	●	●	◐	○
ASI05: Data Disclosure	◐	◐	◐	●	◐	●	◐
ASI06: Memory Poisoning	○	○	●	●	◐	◐	○
ASI07: Insecure Inter-Agent	○	○	◐	●	●	◐	◐
ASI08: Cascading Failures	○	○	○	●	◐	◐	◐
ASI09: Missing Guardrails	◐	○	○	●	●	●	●
ASI10: Rogue Agents	○	○	◐	●	◐	●	●

● = Specific controls or techniques documented | ◐ = Partial/conceptual coverage | ○ = No meaningful coverage

Key finding: Only OWASP ASI achieves full coverage, but as risk descriptions rather than enforceable controls. Microsoft ZT4AI has deepest control implementation but is Azure-ecosystem-locked. NIST, ISO, and CSA ATF have the weakest coverage of agentic-specific risk categories (ASI06–ASI08 in particular).

Structural gaps across all frameworks

1. Platform-level vs. prompt-level enforcement — The most critical architectural blind spot. No framework distinguishes or mandates enforcement at the platform layer (below the model). Prompt-level guardrails are definitionally bypassable by prompt injection. Production implementations (Google ADK before_model_callback, LlamaFirewall, AgentGateway) demonstrate the pattern; no standard requires it.

2. Agent identity — Only 22% of organizations treat AI agents as independent, identity-bearing entities (Gravitee, February 2026). Machine-to-human identity ratio is 82:1 (CyberArk, 2025). No published standard defines minimum identity requirements. NIST CAISI’s Agent Identity and Authorization Concept Paper acknowledges the gap but has no shipped guidance. Okta for AI Agents GA: April 30, 2026.

3. AI-BOM pre-standardization — No ratified standard. Parallel efforts: OWASP AIBOM Generator (CycloneDX), SPDX 3.0 AI/ML extensions, IBM Granite 4.0 disclosures. EU AI Act Article 11/Annex IV effectively mandates AI-BOM-like documentation for high-risk systems but no standard defines what that means.

4. Proof-of-guardrail / attestation — Concept of cryptographic attestation that guardrails actually executed (via TEE) is entirely unaddressed by any framework. LlamaFirewall and Miggo Security are closest production approximations.

5. Cognitive file integrity — SHA-256 baselines for agent behavioral definition files (SOUL.md, IDENTITY.md) is an emerging practice with no framework coverage or tooling equivalent.

Emerging control architectures with production evidence

• Credential proxies (Keychains.dev, AgentKeys, AgentSecrets): agent never possesses credentials; proxy injects at network layer. Provides prompt-injection resistance, least privilege, and audit trail.
• LlamaFirewall (Meta, open-source): PromptGuard 2 (97.5% recall, 1% FPR) + AlignmentCheck + CodeShield. >90% attack reduction on AgentDojo benchmark; sub-100ms latency for 90% of inputs. In production at Meta.
• AgentGateway (Solo.io → Linux Foundation): Rust-based proxy with RBAC/JWT/TLS/CEL policies for MCP, A2A, and LLM routing.
• FIDES (Microsoft research): zero successful prompt injection attacks using information-flow control with dynamic taint-tracking on AgentDojo benchmark — strongest published defensive result.
• Agent 365 (Microsoft, GA May 1, 2026): first commercial unified agent governance control plane.
• Okta for AI Agents (GA April 30, 2026): agent lifecycle governance with shadow AI discovery.

Strengths and Weaknesses

What this source does well:

• Comprehensive cross-framework coverage matrix against OWASP ASI taxonomy is the clearest published comparison of framework gaps
• Incident timeline is specific and verifiable (CVE numbers, dates, affected packages)
• Control architecture section grounds recommendations in production implementations with benchmark data

Limitations and caveats:

• Several statistics from the baseline could not be re-verified from primary sources: “48% ML-BOM adoption lag,” “84% agent compliance audit failure” (attributed to CSA), “42,000 exposed agentic AI instances” (BitSight figure disputed)
• MITRE ATLAS version numbers (v5.3.0, v5.4.0) and exact technique counts sourced primarily from Vectra AI (commercial vendor) rather than MITRE’s official changelog — independently verify at atlas.mitre.org
• The 82:1 machine-to-human identity ratio is correctly attributed to CyberArk, not Okta (corrects the January 2026 baseline)

Relations

• Supports: Agentic AI Security Capability Maturity Model — A 2026 Practical Proposal — this paper is one of the foundational sources informing the canonical CMM and its standards crosswalk; the framework gap analysis here directly motivated the CMM’s cumulative-level rule and the platform-vs-prompt enforcement inflection at end of Phase 2.
• Supports: Agent Observability — platform-level enforcement section directly validates the glass-box paradigm and OTel/lifecycle hooks approach
• Supports: Credential Proxy Pattern for AI Agents and AI Agent Identity Architecture — confirms these as production patterns at scale
• See also: OWASP Top 10 for Agentic Applications (ASI Top 10), NIST AI Risk Management Framework (AI RMF), MITRE ATLAS, IEC 42001 — AI Management Systems, Google SAIF — Secure AI Framework, CoSAI — Coalition for Secure AI, Microsoft Responsible AI Standard (RAI), EU AI Act, CSA Agentic Trust Framework, OWASP AI Vulnerability Scoring System (AIVSS)