OWASP ASI08 — Cascading Failures
Advisory only. It is skill text, and nothing stops a violation.
Acts on
Agent instructions
When
As instructions the agent reads
Tested
0 of 6 pass
In a git repo
Advisory
What it does
Keep one agent's bad output from propagating through everything downstream. Isolate blast radius per agent and per environment, separate development from production access, validate agent-to-agent handoffs, and add circuit breakers that halt automation on behavioural deviation. Use when chaining agents, designing orchestration, granting production access, or wiring agent output into downstream automation. Do NOT use for the transport security of those handoffs — that is owasp-asi07-insecure-inter-agent-communication.
Chock adds friction. It is not a security boundary.
Its label on each agent
The catalog grades each policy on each agent. Pick an agent to build with this policy:
- Claude Code TestedAdvisory Advisory only. It is skill text, and nothing stops a violationBuild →
- Cursor TestedAdvisory Advisory only. It is skill text, and nothing stops a violationBuild →
- Codex TestedAdvisory Advisory only. It is skill text, and nothing stops a violationBuild →
- GitHub Copilot TestedAdvisory Advisory only. It is skill text, and nothing stops a violationBuild →
- Devin TestedAdvisory Advisory only. It is skill text, and nothing stops a violationBuild →
- Grok Tested Not graded yet for GrokBuild →
- goose Tested Not graded yet for gooseBuild →
- Antigravity Tested Not graded yet for AntigravityBuild →
- OpenHands Untested Not graded yet for OpenHandsBuild →
- Kimi Code Untested Not graded yet for Kimi CodeBuild →
- Factory Droid Untested Not graded yet for Factory DroidBuild →
What it misses
This policy does not state what it misses.
Latest change
0.0.2 · · Point at the mechanised slice: the agentic-code-security gate's bounds pack refuses, once switched on in the selection file, loops with no turn limit or a recursion or iteration limit in the hundreds or thousands, at commit and at tool use. Everything else here stays advisory, and no rule text or claim is raised; the pointer is a see() and a references section.