> ## Documentation Index > Fetch the complete documentation index at: https://docs.mnemom.ai/llms.txt > Use this file to discover all available pages before exploring further. # OWASP Agentic Top 10 Mapping > How Safe House's shipped threat patterns map to the OWASP Top 10 for Agentic Applications (December 2025). Coverage mechanisms, gaps, and what to pair with application-layer controls. Safe House enforces eight named threat patterns at the Mnemom gateway. Buyers evaluating agentic security posture against the **[OWASP Top 10 for Agentic Applications](https://genai.owasp.org/resource/owasp-top-10-for-agentic-applications/)** (OWASP Gen AI Security Project, released 2025-12-09; ASI01–ASI10) need a published cross-reference to make the shipped enforcement legible. This page provides that cross-reference. The discipline is the same one applied throughout this documentation: where Safe House covers an OWASP threat class, the coverage mechanism is named. Where coverage is partial or absent, the gap is stated rather than papered over. > **Source of truth.** The ASI identifiers and titles below are pinned to the official OWASP Gen AI Security Project release ([announcement](https://genai.owasp.org/2025/12/09/owasp-top-10-for-agentic-applications-the-benchmark-for-agentic-security-in-the-age-of-autonomous-ai/), [resource page](https://genai.owasp.org/resource/owasp-top-10-for-agentic-applications/)). The full taxonomy: **ASI01** Agent Goal Hijack, **ASI02** Tool Misuse, **ASI03** Identity & Privilege Abuse, **ASI04** Agentic Supply Chain Vulnerabilities, **ASI05** Unexpected Code Execution, **ASI06** Memory & Context Poisoning, **ASI07** Insecure Inter-Agent Communication, **ASI08** Cascading Failures, **ASI09** Human-Agent Trust Exploitation, **ASI10** Rogue Agents. *** ## Safe House threat patterns Safe House detects eight threat categories via its L1 pattern library, L2 LLM analysis layer, and L3 session model. Each pattern has a stable `threat_type` identifier used in API responses, webhook events, and threshold configuration: | Pattern | `threat_type` | Checkpoint | | - | - | - | | Business Email Compromise | `bec_fraud` | Front door | | Prompt injection | `prompt_injection` | Front door | | Indirect injection | `indirect_injection` | Front door | | Social engineering | `social_engineering` | Front door | | Agent spoofing | `agent_spoofing` | Front door | | Multi-turn hijack | `hijack_attempt` | Front door (L3 session model) | | Data exfiltration | `data_exfiltration` | Back door | | Privilege escalation | `privilege_escalation` | Front door + back door | "Front door" here does not mean "once, at the start of the turn." The front door runs on every inbound surface a request carries, including each tool result the agent is handing back to the model in that same request — which is where `indirect_injection` is caught. See [When the front door runs](/concepts/safe-house#when-the-front-door-runs). *** ## Pattern-to-OWASP mapping Each Safe House pattern maps to one or more OWASP ASI entries. A pattern can map to multiple entries because OWASP threat classes are defined by attacker goal; Safe House detects by observable signal. | Safe House pattern | OWASP entry | Coverage level | Enforcement mechanism | | - | - | - | - | | `prompt_injection` | **ASI01** Agent Goal Hijack | Full — direct variant | L1 regex families (override phrases, role reassignment, jailbreak openers, authority spoofing); L2 compound confidence scoring; L3 session model. Direct injection is the canonical goal-hijack vector | | `indirect_injection` | **ASI01** Agent Goal Hijack | Partial — indirect variant | L1 instruction-delimiter detection; MinHash similarity against known payloads; L2 instruction-structure detection in tool results. Each tool result is screened at the front door in the request that carries it, before the model reads it — a flagged one is withheld or decorated in that same request body. Novel payloads with no similarity to known patterns score lower — see [limits](#gaps-and-limits) | | `hijack_attempt` | **ASI01** Agent Goal Hijack | Partial — multi-turn variant | L3 session model: topic coherence tracking, escalating action scope, identity drift, pivot detection after a trust-building sequence. Substantial multi-turn coverage, with a known residual on novel multi-turn and multi-vector sequences (active recall work). Threshold: ≥ 0.7 confidence (routes to human review — see [calibration note](#asi01--multi-turn-hijack-human-escalation-at-default-threshold)) | | `bec_fraud` | **ASI09** Human-Agent Trust Exploitation, **ASI01** Agent Goal Hijack | Full — conjunction detection | Requires co-occurring: financial action term + authority claim + urgency marker + secrecy instruction. The authority/urgency/secrecy manipulation is trust exploitation; the intent to redirect the agent into an unauthorized action is goal hijack | | `social_engineering` | **ASI09** Human-Agent Trust Exploitation | Full | Authority + urgency signal pair, absent the financial-action component. Regulatory threat framing, role-authority claims, urgency escalation — manipulating the agent's trust to change its behavior | | `agent_spoofing` | **ASI07** Insecure Inter-Agent Communication, **ASI09** Human-Agent Trust Exploitation | Full — inbound signal | Claims of override authority or elevated permissions arriving as runtime messages; fake admin agent identifiers; credential-presentation patterns in message content. Detects unauthenticated identity/authority claims in the inter-agent message stream | | `data_exfiltration` | **ASI02** Tool Misuse | Full — outbound | Back-door checkpoint: external destination patterns vs. declared `bounded_actions`, bulk-data request language, covert-channel patterns. Exfiltration is misuse of connected tools/connectors to route data out. Also enforced independently by Policy Engine | | `privilege_escalation` | **ASI03** Identity & Privilege Abuse | Full | Runtime permission claims; requests outside declared `bounded_actions`; attempts to disable safety mechanisms mid-session. Front-door detection + Policy Engine independent check | *** ## OWASP-to-coverage mapping The reverse view — starting from each OWASP entry and tracing what ships in enforcement. Coverage is asserted only where there is a concrete shipped mechanism to point to; everything else is stated as a gap. | OWASP entry | Safe House pattern | Additional coverage | Status | | - | - | - | - | | **ASI01** Agent Goal Hijack | `prompt_injection`, `indirect_injection`, `hijack_attempt` | — | **Partial.** Direct injection is screened at the front door. Multi-turn goal redirection is substantially covered by the L3 session model, with a known residual on novel multi-turn and multi-vector sequences (active Safe House recall work). Indirect injection partial — novel payloads with no payload-library similarity may score below block threshold | | **ASI02** Tool Misuse | `data_exfiltration` | Policy Engine: `bounded_actions` enforcement, forbidden-rule Managed Rules, tool-capability mappings | **Partial — policy layer + outbound screen.** Tool execution is constrained by the Policy Engine before it reaches Safe House; Safe House flags requests to send data out and can redact sensitive data from responses; it does not inspect tool-call arguments for exfiltration. Mnemom does not intercept every unsafe tool invocation at the gateway — declared-scope enforcement is the primary control | | **ASI03** Identity & Privilege Abuse | `privilege_escalation` | AAP alignment cards declare the autonomy envelope; CLPI policy engine enforces | **Partial.** Incoming claims of system or admin authority are flagged at the front door. Tool permissions come from the agent's card and are enforced at the policy layer | | **ASI04** Agentic Supply Chain Vulnerabilities | — | [Substrate fingerprint](/concepts/substrate-fingerprint) (audit evidence only) | **Not covered.** Each checkpoint records the provider, model, SDK version and, optionally, a lockfile hash, as evidence for your own audits. Mnemom does not detect compromised dependencies. Use build-time package provenance — see [supply-chain trust](/guides/supply-chain-trust) | | **ASI05** Unexpected Code Execution | — | Policy Engine: `bounded_actions` constrains which tools/actions an agent may invoke | **Not covered.** Safe House has no pattern that intercepts code-execution payloads. The Policy Engine limits the action surface (an agent can only invoke declared tools), which reduces blast radius, but Mnemom does not sandbox or screen executed code. Pair with an application-layer execution sandbox | | **ASI06** Memory & Context Poisoning | — | Tool-result screening | **Limited.** Poisoned content that comes back to the model as a tool result is screened at the front door. Mnemom does not integrate with memory stores, and persistent memory/context store attacks are not in the shipped Safe House pattern library. AIP thinking-block analysis and AAP drift detection give partial observability of downstream effects, but not upstream interception — see [limits](#asi06--memory--context-poisoning) | | **ASI07** Insecure Inter-Agent Communication | `agent_spoofing` | — | **Partial.** Safe House treats unauthenticated authority/identity claims arriving as inbound runtime messages as suspicious by design. Legitimate agent-to-agent authority must be encoded in alignment cards at configuration time. This screens the *content* of inter-agent messages; it is not a transport-authentication scheme | | **ASI08** Cascading Failures | — | AAP drift detection + CLPI lifecycle governance (observability of degraded agent behavior) | **Not covered.** No shipped Safe House pattern targets multi-agent cascading failure. AAP/CLPI provide some observability of an individual agent drifting, but Mnemom does not model or circuit-break failure propagation across an agent fleet. This is an application-architecture concern (timeouts, bulkheads, circuit breakers) | | **ASI09** Human-Agent Trust Exploitation | `bec_fraud`, `social_engineering`, `agent_spoofing` | — | **Covered.** Authority/urgency/secrecy manipulation and impersonated-authority claims from inbound messages are treated as suspicious by design | | **ASI10** Rogue Agents | — | AAP alignment cards declare the autonomy envelope; CLPI lifecycle governance; pause and stop controls | **Partial.** Behavior is checked against the agent's alignment card and constrained by Policy Engine `bounded_actions` enforcement. Admins can pause or stop an agent, and automatic pausing on repeated violations can be turned on. Safe House screens inbound/outbound message content; it does not by itself decommission a misbehaving agent | *** ## Gaps and limits ### ASI06 — Memory & Context Poisoning No shipped Safe House pattern targets memory/context store attacks. An attacker who can write to an agent's persistent memory — conversation history, vector store, retrieved documents — can influence future turns without a detectable inbound signal. The AIP thinking-block analysis layer provides partial mitigation: if the poisoned memory causes the agent to reason in ways inconsistent with its alignment card, AIP may flag it — and, in `enforce`, gate the response before the action lands (in `observe`/`nudge` the verdict is recorded post-hoc). That is detection of downstream effect, not upstream interception. **Recommended defense-in-depth:** treat memory stores as an untrusted input boundary, apply the same L1/L2 screening to memory-retrieved content as to external tool results, and enable AIP to catch the reasoning anomalies that poisoned memory produces. ### ASI05 — Unexpected Code Execution Safe House does not intercept code-execution payloads at the gateway. The Policy Engine's `bounded_actions` enforcement limits which tools an agent may invoke (reducing the surface that can reach an executor), but Mnemom neither sandboxes nor statically screens executed code. For agents that can run code, pair Mnemom with an application-layer execution sandbox and treat the executor as an untrusted boundary. ### ASI08 — Cascading Failures Mnemom screens per-agent message content and surfaces individual-agent drift (AAP/CLPI), but it does not model failure propagation across a multi-agent fleet. Cascading-failure resilience is an application-architecture responsibility: apply per-agent timeouts, bulkheads, and circuit breakers between agents so one degraded agent cannot fan out. ### ASI01 — indirect injection, novel payloads Indirect injection via tool results is partially covered. The placement is not the gap: a screened tool result is screened at the front door in the request that carries it back to the model — synchronously, before that body is forwarded upstream — with `block`/`quarantine` withholding the payload and `warn` delivering it decorated as untrusted. Two gaps remain. The first is **coverage**: a request that fans out to many tool calls in a single turn is not guaranteed full screening coverage. The second is **accuracy**. MinHash similarity matching compares tool results against a library of known injection payloads. Sufficiently novel payloads that bear no structural or semantic similarity to known patterns will score below L1 thresholds. L2 analysis runs on the same tool-result surface immediately after L1, but detection accuracy is bounded by the analysis model's capability. Tool-result screening runs synchronously, inside the same request that carries the tool result back to the model, before the model is allowed to read it. Requires `screen_surfaces.tool_responses` on the [protection card](/concepts/protection-card). Screening is tested continuously by an automated, adaptive attacker that runs against sandbox agents, and new detection rules are reviewed before they reach production. For high-sensitivity environments, add application-layer validation of tool results as a *second* control behind the gateway's front-door screen — not as a substitute for it, and not on the assumption that the gateway waits until the next turn to look. ### ASI01 — multi-turn hijack, human escalation at default threshold The `hijack_attempt` pattern routes to human review (not autonomous block) at the default 0.7 confidence threshold. This is intentional — legitimate multi-topic conversations produce similar L3 signals. If your use case can tolerate more aggressive autonomous blocking, lower the `hijack_attempt` threshold in the [protection card](/concepts/protection-card). *** ## Pairing Safe House with application-layer controls OWASP guidance recommends pairing runtime substrate controls with application-layer controls. For the gaps above: * **ASI06 (Memory & Context Poisoning):** Apply Safe House's inbound screening to memory-retrieved content as well as direct inbound messages. This is not the default — configure the SDK to route memory fetches through the Safe House evaluation layer. * **ASI05 (Unexpected Code Execution):** Run agent-executed code in an application-layer sandbox; scope `bounded_actions` so the agent can only reach the executor when its function genuinely requires it. * **ASI04 (Agentic Supply Chain):** Not covered by Mnemom. Use SLSA/Sigstore package provenance; the substrate fingerprint gives you a per-checkpoint record of what was deployed. See [supply-chain trust](/guides/supply-chain-trust). * **ASI08 (Cascading Failures):** Add per-agent timeouts, bulkheads, and circuit breakers at the application/orchestration layer so a degraded agent cannot cascade across the fleet. * **ASI10 (Rogue Agents):** Card design is the primary defense. Scope `bounded_actions` as narrowly as the agent's function permits; CLPI enforces declared scope and surfaces lifecycle/reputation signals for an agent operating outside its envelope. *** ## See also * [Safe House threat model](/guides/safe-house-threat-model) — Detection mechanisms, confidence scoring, and known limits for each pattern * [Protection card](/concepts/protection-card) — Per-agent threshold configuration for each threat type * [AEGIS](/concepts/aegis) — runtime screening at four checkpoints * [Substrate fingerprint](/concepts/substrate-fingerprint) — what each checkpoint records about the stack that produced it * [Supply-chain trust](/guides/supply-chain-trust) — Composing AEGIS runtime detection with package-layer provenance * [AIP specification](/protocols/aip/specification) — Thinking-block integrity analysis that covers reasoning anomalies downstream of ASI06 * [OWASP Top 10 for Agentic Applications](https://genai.owasp.org/resource/owasp-top-10-for-agentic-applications/) — The authoritative source taxonomy this page maps against This documentation is built and hosted on [Mintlify](https://mintlify.com), a developer documentation platform.