---
id: owasp-asi10-rogue-agents
track: coding
version: 0.0.1
label: advisory
keyword: advise
where: text
sha256: fa9fbf2335f01ef694a435d85c5a78628d3b4fc6a359668cdb9cf6961e7c5181
source: https://github.com/open-coder-ai/chock-catalog/tree/1e60d211c1bb767152c6ab0167932da06ab3a10f/agentic-security/owasp-asi10-rogue-agents
catalog_ref: 1e60d211c1bb767152c6ab0167932da06ab3a10f
---

# OWASP ASI10 — Rogue Agents

owasp-asi10-rogue-agents · version 0.0.1

Advisory — Advisory only. It is skill text, and nothing stops a violation. Chock adds friction. It is not a security boundary. 

In a git repo: advisory (The agent reads the text, and nothing stops a violation.)



## What it does

Make an agent that has drifted, been compromised, or was never inventoried detectable and stoppable. Require an owner, expiry, and inventory entry for every agent, sandbox by default, baseline behaviour and alert on deviation, and keep a tested kill switch. Use when deploying a long-running or autonomous agent, allowing sub-agent spawning, or reviewing agent lifecycle and monitoring. Do NOT use for a single hijacked request within a supervised session — that is \`owasp-asi01-agent-goal-hijack\`.

## Its label on each agent

- Claude Code (tested): Advisory — Advisory only. It is skill text, and nothing stops a violation. Builder: /coding/builder/#client=claude-code&p=owasp-asi10-rogue-agents
- Cursor (tested): Advisory — Advisory only. It is skill text, and nothing stops a violation. Builder: /coding/builder/#client=cursor&p=owasp-asi10-rogue-agents
- Codex (tested): Advisory — Advisory only. It is skill text, and nothing stops a violation. Builder: /coding/builder/#client=codex&p=owasp-asi10-rogue-agents
- GitHub Copilot (tested): Advisory — Advisory only. It is skill text, and nothing stops a violation. Builder: /coding/builder/#client=copilot&p=owasp-asi10-rogue-agents
- Devin (tested): Advisory — Advisory only. It is skill text, and nothing stops a violation. Builder: /coding/builder/#client=devin&p=owasp-asi10-rogue-agents
- Grok (tested): Not graded yet for Grok. Builder: /coding/builder/#client=grok&p=owasp-asi10-rogue-agents
- goose (tested): Not graded yet for goose. Builder: /coding/builder/#client=goose&p=owasp-asi10-rogue-agents
- Antigravity (tested): Not graded yet for Antigravity. Builder: /coding/builder/#client=antigravity&p=owasp-asi10-rogue-agents
- OpenHands (untested): Not graded yet for OpenHands. Builder: /coding/builder/#client=openhands&p=owasp-asi10-rogue-agents
- Kimi Code (untested): Not graded yet for Kimi Code. Builder: /coding/builder/#client=kimi-code&p=owasp-asi10-rogue-agents
- Factory Droid (untested): Not graded yet for Factory Droid. Builder: /coding/builder/#client=factory-droid&p=owasp-asi10-rogue-agents

## What it misses

This policy does not state what it misses.

## Latest change

0.0.1 · 2026-08-12 — Initial draft from OWASP Top 10 for Agentic Applications 2026, ASI10.

## Provenance

- Tested by 0 of 6 cases run automatically
- SHA-256: `fa9fbf2335f01ef694a435d85c5a78628d3b4fc6a359668cdb9cf6961e7c5181`
- Catalog commit: https://github.com/open-coder-ai/chock-catalog/commit/1e60d211c1bb767152c6ab0167932da06ab3a10f
- Source: https://github.com/open-coder-ai/chock-catalog/tree/1e60d211c1bb767152c6ab0167932da06ab3a10f/agentic-security/owasp-asi10-rogue-agents (catalog path `agentic-security/owasp-asi10-rogue-agents`)
- Presets: OWASP agentic top 10
- JSON: `/api/coding/policies/owasp-asi10-rogue-agents.json`
- Report a problem: https://chock.sh/report/?policy=owasp-asi10-rogue-agents&version=0.0.1&page=%2Fcoding%2Fpolicies%2Fowasp-asi10-rogue-agents%2F