# OWASP ASI09 — Human-Agent Trust Exploitation

OWASP ASI09 — Human-Agent Trust Exploitation: what it does, its label on each agent, what it misses, and examples.

Catalog policy owasp-asi09-human-agent-trust, version 0.0.2, labelled advisory on Claude Code.

> Ask the user before running any command on this page: each one changes how their agent or repository behaves.

## What it does

Stop an agent from controlling the information a human approves against. Show the raw action rather than a model-authored summary at every confirmation step, forbid persuasive framing in sensitive workflows, and keep an immutable record of what was presented versus what executed. Use when designing approval prompts, human-in-the-loop checkpoints, agent-written PR descriptions, or consent and disclosure flows. Do NOT use for what the agent is permitted to do once approved — that is \`owasp-asi02-tool-misuse\`.

## On each agent

| Agent | Label | What it does there |
| --- | --- | --- |
| Claude Code | Advisory | Advisory only. It is skill text, and nothing stops a violation |
| Cursor | Advisory | Advisory only. It is skill text, and nothing stops a violation |
| Codex | Advisory | Advisory only. It is skill text, and nothing stops a violation |
| GitHub Copilot | Advisory | Advisory only. It is skill text, and nothing stops a violation |
| Devin | Advisory | Advisory only. It is skill text, and nothing stops a violation |
| Grok | Not graded | Not graded yet for Grok |
| goose | Not graded | Not graded yet for goose |
| Antigravity | Not graded | Not graded yet for Antigravity |
| OpenHands | Not graded | Not graded yet for OpenHands |
| Kimi Code | Not graded | Not graded yet for Kimi Code |
| Factory Droid | Not graded | Not graded yet for Factory Droid |

## What it misses

This policy does not state what it misses.

## More

- [The policy on the catalog pages](https://chock.sh/coding/policies/owasp-asi09-human-agent-trust/)
- [Source at the pinned catalog commit](https://github.com/open-coder-ai/chock-catalog/tree/1e60d211c1bb767152c6ab0167932da06ab3a10f/agentic-security/owasp-asi09-human-agent-trust)


---

Built from engine [5a4b6287a46e](https://github.com/open-coder-ai/chock/commit/5a4b6287a46e07f9f856d9bbe10622bd1ff2e021) and catalog [1e60d211c1bb](https://github.com/open-coder-ai/chock-catalog/commit/1e60d211c1bb767152c6ab0167932da06ab3a10f).