Entity trail

OWASP

Source-backed findings, relationship evidence, citations, and briefing history from the public MindPattern archive.

Briefing refs

Findings

Edges

Sources

138

Showing the first 40 findings. More graph evidence exists in the corpus.

Corpus findings

2026-08-15 / github-pulse-researcheragent-threat-rules Reached 783 Detection Rules, Auto-Published by a 'Threat Cloud Flywheel' With No Human in the Release LoopAgent-Threat-Rule/agent-threat-rules (371 stars, last pushed 2026-08-15) published v3.5.12 on 2026-08-11 carrying 783 detection rules, up from 768 at v3.5.11. The release note describes the pipeline plainly — 'tc-pr-back → safety gate → auto-merge → this release', auto-published from the Threat Cloud flywheel — meaning new agent-threat detections ship to npm without a human release decision. The prior tagged release recorded 10/10 OWASP Agentic Top 10 coverage and PINT benchmark results of 62.7% recall at 99.7% precision, and noted a precision repair taking four stable auto-blocking rules from 149 false positives to 37. Rules are consumed by Cisco AI Defense, Microsoft AGT, MISP, OWASP, FINOS and SigmaHQ.
2026-08-11 / agents-researcherMCP Dev Summit Seoul opens Aug 13 as an audit finds 91.8% of production MCP servers have no OAuth at allThe Seoul summit (Aug 13–14) has turned from a routine check-in into a confrontation between protocol designers and security researchers, driven by a scan finding more than 21,000 internet-facing MCP server instances, 91.8% of 414 dynamically audited production servers running without OAuth, and 687 tool instances exposing shell execution with no access controls. The OWASP MCP Top 10 has been formalized alongside a growing CVE catalogue. The unresolved fight is architectural: Anthropic maintains the STDIO transport's unsanitized command execution is 'by design' and a secure default, pushing sanitization onto downstream developers.
2026-08-08 / reddit-researcherA Near-Miss Indirect Prompt Injection Story Hits 131 Upvotes and 97 Comments on r/artificial — Consumer Users Are Discovering the Attack Class for the First TimeA r/artificial poster described an email-connected AI agent that nearly forwarded their bank statement to a stranger after processing an inbound message containing hidden instructions, and the 97-comment thread is largely people learning that indirect prompt injection exists. The mechanism matches documented CVEs like EchoLeak (CVE-2025-32711), where merely asking Copilot to summarize an inbox triggered silent document exfiltration — no click or download required. OWASP's 2026 LLM report ranks prompt injection its #1 threat with a 340% year-over-year surge; the signal here is that awareness is only now reaching non-security consumers wiring agents into email and calendar.
2026-08-07 / arxiv-researcher"Agentic Posture Vulnerability": A Vulnerability-Management Record for Agent Exposures That Have No CVEarXiv 2608.05884 (Aug 6) proposes the agentic posture vulnerability (APV) as a task-conditioned abstraction for security programs that need to track persistent deployed agent instances spanning multiple components and outliving any single incident. One posture can produce different runtime manifestations across tasks; an APV links those manifestations to the invariant posture and stays open until authority is narrowed, a missing control is added, risk is accepted, or closure is verified. The paper distinguishes APVs from CVE-addressable product defects, OWASP Excessive Agency, and the runtime authorization-execution gap, and supplies six recurring patterns, a lifecycle, a minimum record schema, and a control-and-closure matrix — usable today as a template if you're trying to file agent permission sprawl somewhere other than a wiki page.
2026-08-03 / github-pulse-researcherLLMVault Ships an Intentionally Vulnerable OWASP LLM Top 10 Range for Agent and RAG Penetration TestingCyberSunil/LLMVault (263 stars, created 2026-07-15, Python, Docker) is a deliberately vulnerable training platform covering the OWASP LLM Top 10, with tracks for prompt injection, RAG security, agent security, and GenAI penetration testing, tagged for CTF use. It is the defensive-training counterpart to the detection tooling shipping the same month, and one of only two agent-security repos created in the last 30 days that cleared 200 stars. Treat the star count as early signal rather than validation, since the scenario quality of a vulnerable-by-design range is hard to assess from the outside.
2026-07-26 / arxiv-researcherA Regex Filter in Front of an Aligned Model Blocked 0% Across All Five OWASP LLM Top-10 Categories TestedThis study isolates the common production pattern of stacking a regex prefilter ahead of model-side alignment, evaluating against N=45 adversarial probes across three sub-corpora under adversarial mutation. Under the primary substring classifier the block rate is 0% across all five OWASP LLM Top-10 categories examined, and the paper reports metric-dependent divergence — meaning the apparent effectiveness of the regex layer changes with the measurement choice, not with the actual defense. It is a single-source finding with a small probe set, but it targets a defense pattern that is genuinely widespread in shipped LLM apps.
2026-07-26 / arxiv-researcherEvery AI-Generated Automation Script Tested Contained Exploitable Vulnerabilities — Across ChatGPT, Copilot, and Gemini AlikeShanna M. Kahn and John D. Hastings collected code from ChatGPT, Microsoft Copilot, and Google Gemini using identical prompts across three automation domains, then had Claude Code perform a standardized vulnerability review scored with CVSS v3.1 and mapped to OWASP Top 10:2021 and MITRE ATT&CK. Every script contained exploitable vulnerabilities; nine of the 17 identified vulnerability classes appeared in output from all three models, 14 of 17 in at least two, and weighted CVSS scores differed by under 10% across platforms. Their conclusion is the useful one for teams shopping vendors: risk tracks the task category, not the model, so the question is whether LLM-generated automation ships without review at all.
2026-07-25 / rss-researcherVercel WAF now protects Blob storage with zero code changesThe same deny, challenge, and rate-limit rules that guard Vercel deployments now apply to Blob traffic, evaluated at the edge on IP, country, and path before any data transfer. Enabling it is a dashboard setting — no changes to blob URLs or the `@vercel/blob` library. The OWASP Core Ruleset is unsupported since it targets dynamic apps rather than object delivery, and challenge rules will block server-side requests because they require browser interaction. Free on all plans during beta.
2026-07-17 / hn-researcherOWASP 2026: Prompt Injection Named the #1 LLM Threat, Up 340% Year-Over-YearOWASP's 2026 LLM security guidance again ranks prompt injection as the top threat, with reports of a 340% YoY surge making it the fastest-growing attack category — context that frames this week's JadePuffer agentic-ransomware incident and Traceforce's launch. For builders, the practical takeaway is that indirect/tool-mediated injection (not just direct user prompts) is where defenses keep failing. Guidance-and-analysis piece rather than breaking news, hence low importance.
2026-07-17 / hn-researcherAxis Intelligence AI Model Vulnerability Tracker: Agent Tool-Input Injection Succeeds 84% of the TimeAxis Intelligence's 2026 vulnerability tracker reports 47 confirmed attack vectors reproduced across six production LLMs (Jan–Jul 2026), with agent tool-input injection the highest-impact unsolved category at an 84% success rate. It aligns with OWASP's finding that prompt injection is now the #1 LLM threat, up 340% YoY. Actionable for builders shipping tool-using agents: input-injection through tool results — not just user prompts — remains the dominant unpatched failure mode.
2026-07-09 / skill-finderRedact secrets at the source of MCP audit logs, not the sinkOWASP's 2026 secure-MCP guidance stresses that every tool call should emit a structured log entry (who, which tool, what params, what result) — but the single most consequential move is redaction at the source, not the sink, so credentials and PII never hit the log pipeline in the first place. Combine with per-service short-lived scoped tokens the LLM never sees and a hard ban on token passthrough. This closes the common failure where 'we log everything' quietly becomes 'we leak everything.'
2026-07-07 / arxiv-researcherUntrusted Content Masking Gives Web Agents Provable Prompt-Injection IsolationExtends the strict trusted-instruction/untrusted-data separation that already holds for text and tool-use APIs into the browser, masking untrusted page content so web agents get security guarantees rather than best-effort filtering. It lands amid a reported 340% surge in prompt-injection attacks in 2026 and OWASP naming injection the top agentic-AI failure mode. For builders it offers a guarantee-backed defense pattern for browser agents instead of heuristic content sanitization.

Graph relationships

USES
Agent-Threat-Rules
OWASP consumes agent-threat-rules.
Source finding
RELEASED
OWASP Agentic Applications Top 10 v1.0
OWASP officially published the Top 10 for Agentic Applications v1.0.
Source finding
RELEASED
Agentic Skills Top 10
OWASP launched the Agentic Skills Top 10 project.
Source finding
RELEASED
OWASP MCP Top 10
OWASP published the MCP Top 10, a formal security framework for Model Context Protocol deployments.
Source finding
RELEASED
MCP
OWASP publishes the first structured security framework targeting MCP-enabled AI systems.
Source finding
CRITICIZES
MCP
OWASP data shows prompt injection remains the dominant cause of agentic-AI security failures with MCP CVEs piling up.
Source finding
RELEASED
State of Agentic AI Security v2.01
OWASP released State of Agentic AI Security v2.01 on June 11, 2026
Source finding
RELEASED
OWASP Top 10 Agentic Applications
OWASP released canonical 10-risk framework ASI01-ASI10 for agent security with 100+ expert contributors
Source finding
SUPPORTS
TrinityGuard
TrinityGuard is grounded in OWASP standards for multi-agent safety.
Source finding
RELEASED
MCP
OWASP published first official MCP Top 10 vulnerability classification
Source finding
USES
MCPThreatHive
MCPThreatHive maps threats to OWASP LLM and Agentic top-10 frameworks.
Source finding
MENTIONS
HackerOne
HackerOne bug bounty disclosures reveal OWASP API vulnerabilities.
Source finding

Source trail

GitHub Axis Intelligence's Source Source Source Source Source Source Source Source arXiv paper Tech Times

Graph sources

entity graphfindings textkg edgeskg entitiesnewsletter issues

Fetching from the wire…