---
id: owasp-asi09-human-agent-trust
track: coding
version: 0.0.2
label: advisory
keyword: advise
where: text
sha256: 3ec18e3cb1123512e5a7151a61dc4ba79dcf3bce209b991e2ec5cdca01336c39
source: https://github.com/open-coder-ai/chock-catalog/tree/1e60d211c1bb767152c6ab0167932da06ab3a10f/agentic-security/owasp-asi09-human-agent-trust
catalog_ref: 1e60d211c1bb767152c6ab0167932da06ab3a10f
---

# OWASP ASI09 — Human-Agent Trust Exploitation

owasp-asi09-human-agent-trust · version 0.0.2

Advisory — Advisory only. It is skill text, and nothing stops a violation. Chock adds friction. It is not a security boundary. 

In a git repo: advisory (The agent reads the text, and nothing stops a violation.)



## What it does

Stop an agent from controlling the information a human approves against. Show the raw action rather than a model-authored summary at every confirmation step, forbid persuasive framing in sensitive workflows, and keep an immutable record of what was presented versus what executed. Use when designing approval prompts, human-in-the-loop checkpoints, agent-written PR descriptions, or consent and disclosure flows. Do NOT use for what the agent is permitted to do once approved — that is \`owasp-asi02-tool-misuse\`.

## Its label on each agent

- Claude Code (tested): Advisory — Advisory only. It is skill text, and nothing stops a violation. Builder: /coding/builder/#client=claude-code&p=owasp-asi09-human-agent-trust
- Cursor (tested): Advisory — Advisory only. It is skill text, and nothing stops a violation. Builder: /coding/builder/#client=cursor&p=owasp-asi09-human-agent-trust
- Codex (tested): Advisory — Advisory only. It is skill text, and nothing stops a violation. Builder: /coding/builder/#client=codex&p=owasp-asi09-human-agent-trust
- GitHub Copilot (tested): Advisory — Advisory only. It is skill text, and nothing stops a violation. Builder: /coding/builder/#client=copilot&p=owasp-asi09-human-agent-trust
- Devin (tested): Advisory — Advisory only. It is skill text, and nothing stops a violation. Builder: /coding/builder/#client=devin&p=owasp-asi09-human-agent-trust
- Grok (tested): Not graded yet for Grok. Builder: /coding/builder/#client=grok&p=owasp-asi09-human-agent-trust
- goose (tested): Not graded yet for goose. Builder: /coding/builder/#client=goose&p=owasp-asi09-human-agent-trust
- Antigravity (tested): Not graded yet for Antigravity. Builder: /coding/builder/#client=antigravity&p=owasp-asi09-human-agent-trust
- OpenHands (untested): Not graded yet for OpenHands. Builder: /coding/builder/#client=openhands&p=owasp-asi09-human-agent-trust
- Kimi Code (untested): Not graded yet for Kimi Code. Builder: /coding/builder/#client=kimi-code&p=owasp-asi09-human-agent-trust
- Factory Droid (untested): Not graded yet for Factory Droid. Builder: /coding/builder/#client=factory-droid&p=owasp-asi09-human-agent-trust

## What it misses

This policy does not state what it misses.

## Latest change

0.0.2 · 2026-09-29 — Point at the mechanised slice: the agentic-code-security gate's approval pack refuses the human approval step removed where an agent acts, at commit and at tool use. Everything else here stays advisory, and no rule text or claim is raised; the pointer is a see() and a references section.

## Provenance

- Tested by 0 of 6 cases run automatically
- SHA-256: `3ec18e3cb1123512e5a7151a61dc4ba79dcf3bce209b991e2ec5cdca01336c39`
- Catalog commit: https://github.com/open-coder-ai/chock-catalog/commit/1e60d211c1bb767152c6ab0167932da06ab3a10f
- Source: https://github.com/open-coder-ai/chock-catalog/tree/1e60d211c1bb767152c6ab0167932da06ab3a10f/agentic-security/owasp-asi09-human-agent-trust (catalog path `agentic-security/owasp-asi09-human-agent-trust`)
- Presets: OWASP agentic top 10
- JSON: `/api/coding/policies/owasp-asi09-human-agent-trust.json`
- Report a problem: https://chock.sh/report/?policy=owasp-asi09-human-agent-trust&version=0.0.2&page=%2Fcoding%2Fpolicies%2Fowasp-asi09-human-agent-trust%2F