OWASP ASI09 — Human-Agent Trust Exploitation
Advisory only. It is skill text, and nothing stops a violation.
Acts on
Agent instructions
When
As instructions the agent reads
Tested
0 of 6 pass
In a git repo
Advisory
What it does
Stop an agent from controlling the information a human approves against. Show the raw action rather than a model-authored summary at every confirmation step, forbid persuasive framing in sensitive workflows, and keep an immutable record of what was presented versus what executed. Use when designing approval prompts, human-in-the-loop checkpoints, agent-written PR descriptions, or consent and disclosure flows. Do NOT use for what the agent is permitted to do once approved — that is owasp-asi02-tool-misuse.
Chock adds friction. It is not a security boundary.
Its label on each agent
The catalog grades each policy on each agent. Pick an agent to build with this policy:
- Claude Code TestedAdvisory Advisory only. It is skill text, and nothing stops a violationBuild →
- Cursor TestedAdvisory Advisory only. It is skill text, and nothing stops a violationBuild →
- Codex TestedAdvisory Advisory only. It is skill text, and nothing stops a violationBuild →
- GitHub Copilot TestedAdvisory Advisory only. It is skill text, and nothing stops a violationBuild →
- Devin TestedAdvisory Advisory only. It is skill text, and nothing stops a violationBuild →
- Grok Tested Not graded yet for GrokBuild →
- goose Tested Not graded yet for gooseBuild →
- Antigravity Tested Not graded yet for AntigravityBuild →
- OpenHands Untested Not graded yet for OpenHandsBuild →
- Kimi Code Untested Not graded yet for Kimi CodeBuild →
- Factory Droid Untested Not graded yet for Factory DroidBuild →
What it misses
This policy does not state what it misses.
Latest change
0.0.2 · · Point at the mechanised slice: the agentic-code-security gate's approval pack refuses the human approval step removed where an agent acts, at commit and at tool use. Everything else here stays advisory, and no rule text or claim is raised; the pointer is a see() and a references section.