AEGISCONTROL

AEGIS against the OWASP Top 10 for Agentic Applications (2026)

The OWASP GenAI Security Project published this list on 9 December 2025, built by more than a hundred reviewers. It is the closest thing the field has to a shared vocabulary, which is why this mapping exists: an assessor should not have to learn this project's own words before deciding whether it addresses anything they care about.

Read the third column first. AEGIS is one layer of a defence, not a platform. It addresses three of the ten categories directly, contains four, contributes partially to two, and merely bounds the damage on one. A mapping that claimed ten out of ten would be worth less than this one, because nobody would believe it — and they would be right not to.

The verdicts are deliberately four rather than two. Addresses means a mechanism exists and a test exercises it. Contains means AEGIS cannot prevent the thing but stops it becoming an effect on production. Contributes means part of the answer, with the missing part named. Bounds means it happens anyway and only the blast radius is smaller.

Category AEGIS What it actually does, or does not
ASI01 Agent Goal Hijack Contains AEGIS cannot stop an agent's plan being hijacked — it never sees the plan. What it stops is the hijacked plan becoming an effect: the action must fall inside a signed mission, carry two independent pieces of evidence and a human approval. A hijacked agent gets a refusal, not a quarantined workload.
ASI02 Tool Misuse & Exploitation Addresses The executor is typed and knows two verbs — isolate a pod, make a node unschedulable — each closed on its own target shape. There is no generic command to misuse, and an action cannot borrow another's target: the parser refuses a cordon carrying a namespace, which is the route "give one action another action's target". A deployment may also implement fewer verbs than the registry contracts, and the kernel refuses that gap before issuing authority rather than at execution.
ASI03 Identity & Privilege Abuse Addresses Every caller is a SPIFFE identity over mTLS. Authority is a one-shot capability bound to a target, an audience and a fifteen-second window, and it cannot be widened after issue. Five of the harness's eighteen routes attack this and none passes.
ASI04 Agentic Supply Chain Contributes A CycloneDX SBOM ships with every release, the scanners cover the commit history as well as the tree, and the release attaches checksums and a provenance statement. Each signed action now carries the digest of the SBOM that shipped with the build that issued it — so a holder can ask which build produced a decision without being handed the answer by whoever produced it. What is still missing is a signed attestation: GitHub will not persist one for a private repository, so slsa_provenance_pointer stays absent rather than pointing at an unsigned statement. See docs/scitt-transparency.md and SECURITY.md.
ASI05 Unexpected Code Execution Bounds, does not address AEGIS decides whether an action may happen. It does not sandbox the process that carries it out, so a compromised executor remains out of scope. What it now bounds is the blast radius: the container runs read-only, with no capabilities and no path to privilege escalation, and the container CI job asserts each of those took effect rather than trusting the flags — including by attempting a write to the root filesystem and requiring it to fail. See lab/hardening/security-context.yaml. A real sandbox — gVisor, Kata — is a runtime class in the deployment and still belongs alongside, not instead.
ASI06 Memory & Context Poisoning Contains AEGIS has no memory of its own to poison: every decision is re-derived from signed artefacts at the moment it is taken. Poisoned agent context still produces a proposal, and that proposal still meets the same five gates. Containment, not prevention.
ASI07 Insecure Inter-Agent Communication Contributes Two-party mTLS with SPIFFE identities is qualified in the hardened lab. A general multi-agent mesh is not: one qualified path is not a topology.
ASI08 Cascading Failures Addresses This is the category AEGIS was designed around. One action, reversible, bounded in time, with restoration pre-committed before execution and a durable emergency stop that halts new authority without stranding what is already quarantined — a property test/kernel.test.ts pins with a test.
ASI09 Human-Agent Trust Exploitation Contains The human approval is not a checkbox an agent can claim: it is a signed evidence record that the intent must reference, produced by a different identity than the operator. An agent cannot approve its own action — the harness tries, and is refused. What AEGIS cannot do is stop a human being persuaded to approve something they should not.
ASI10 Rogue Agents Contains A rogue agent holding a valid operator identity is exactly the adversary the harness plays. It gets eighteen attempts and no effect. What AEGIS does not do is detect that an agent has gone rogue — that is the SOC's job, and AEGIS consumes its alerts rather than replacing it.

Summary

Verdict Categories
Addresses — a mechanism exists and is tested ASI02, ASI03, ASI08
Contains — cannot prevent, but stops it becoming an effect ASI01, ASI06, ASI09, ASI10
Contributes — partial, with a named gap ASI04, ASI07
Bounds — cannot prevent, but limits the damage ASI05

The distinction between addresses and contains is the one worth keeping. AEGIS is not a detection product and cannot stop an agent being compromised. It is the layer that decides whether a compromised agent's intention becomes a change to production — which is a narrower promise, and one that can actually be kept.

Reproducing the claims

Every "addresses" or "contains" row above is exercised by something runnable:

npm run adversary        # eighteen attack routes, over HTTP, as an untrusted agent
npm run verify           # the full gate, including the kernel property tests
npm run formal:verify    # bounded model checking of the authority invariants

The adversarial harness begins by succeeding legitimately, so a scorecard of refusals cannot be produced by a harness that never reached the product.

References