③ Threat Landscape
③ Threat Landscape
This is the section to read first. Everything else in the roadmap — which role to target, which skills to build, which framework to cite — is downstream of understanding how agentic systems actually fail.
The shift from “a model that answers” to “an agent that acts” changes the security problem in four specific ways:
- The agent has capabilities. It calls tools, runs code, sends messages, and moves money. A successful influence operation against the model is now a successful action in the world.
- The agent has memory. What it learns in one session can persist into the next, which means a single poisoned input can have a delayed and repeating effect.
- The agent has an identity. It authenticates to systems, often with broader privileges than any single human user, and often without a clear owner.
- The agent trusts its inputs. Retrieved documents, tool outputs, and sub-agent messages all arrive in the same context window as the operator’s instructions, with no inherent privilege separation.
The most consequential structural weakness in agentic systems is that instructions and data share a channel. A retrieved web page, a code comment, a calendar invite, or a tool’s error message can carry text that the model treats as an instruction. Nearly every attack in this section is a variation on that theme — which is also why input filtering alone never fully solves it, and why control has to move to the tool and identity layer.
What this section covers
- OWASP LLM Top 10 — the application-layer baseline: prompt injection, insecure output handling, excessive agency, and the rest, with what each one looks like in an agentic system specifically.
- OWASP Agentic AI Threats & Mitigations — the agent-specific catalogue: memory poisoning, tool misuse, identity spoofing, cascading multi-agent failures, and the mitigations that actually hold.
- MITRE ATLAS — the adversarial tactics and techniques matrix for AI systems, and how to use it to structure a red team engagement rather than just cite it.
- Incident Patterns — recurring real-world failure shapes: agent hijacking via indirect injection, over-permissioned connectors, confused-deputy tool calls, and what the post-mortems keep concluding.
The application-layer baseline, read through an agentic lens
Memory poisoning, tool misuse, identity spoofing, cascade failures
Adversarial tactics and techniques for AI, applied to engagements
How these attacks show up in production, and what post-mortems find
How these frameworks relate
They are not competitors; they answer different questions and are usually used together in a single findings table.
| Framework | Question it answers | Use it for |
|---|---|---|
| OWASP LLM Top 10 | “What class of vulnerability is this?” | Triage and severity language shared with AppSec |
| OWASP Agentic AI Threats | “Which agent-specific mechanism was abused?” | Precise root cause and mitigation selection |
| MITRE ATLAS | “What was the adversary’s sequence of moves?” | Red team planning, detection engineering, threat intel |
| NIST AI RMF | “How should the organization respond and govern this?” | Turning findings into owned, tracked risk |
A finding that cites all four — vulnerability class, agent mechanism, adversary technique, and governance disposition — is the difference between a bug report and a professional deliverable.
Ready to try these against something you built? Lab 3: Red Teaming Your Own Agent walks through running indirect prompt injection and memory poisoning against your own pipeline and capturing the evidence.