NDC Conferences

Applying the OWASP Top 10 for Agentic Applications to Your AI Agents - Will Velida - NDC Oslo 2026

Published 2026-10-28 · Duration 1:10:48

Summary

This talk addresses the critical security risks of autonomous AI agents using the OWASP Top 10 for Agentic Applications (2026). The presentation moves beyond theoretical risks to provide practical, layered security models. Key focus areas include mitigating goal hijacking, preventing tool misuse, and securing inter-agent communication by implementing controls like intent gates, least-privilege identities (e.g., Entra Agent ID), and robust runtime validation to treat all LLM output as untrusted input.

Download summary

Key takeaways

Goal Hijacking Mitigation 24:10
To prevent agents from being manipulated by hidden instructions in external documents (e.g., invoices), the core objective must be protected by goal immutability. This requires storing the agent's core objective in a locked system prompt or configuration (e.g., Azure Key Vault) and implementing controls like Prompt Shields to block malicious content.
Securing Tool Usage (Tool Misuse) 35:00
Agents must not be granted over-scoped tools. Security controls must shift from simple access control to execution control. Implementing middleware (an 'intent gate') is crucial to validate that every tool invocation matches the agent's intended purpose and adheres to defined policies, preventing destructive or unauthorized data leakage.
Identity and Privilege Management 42:30
Agents require a distinct, governable identity (e.g., Entra Agent ID) separate from the host application. To prevent privilege escalation and cross-agent trust exploitation, systems must enforce per-action policies, segregate memory across sessions, and ensure tokens lack intent binding.
Supply Chain and Code Execution Risks 51:40
Since agents assemble capabilities at runtime, the supply chain is live during execution. Attackers can inject malicious instructions via tool descriptors or compromised registries. Mitigation requires provenance and attestation for all artifacts (tool definitions, prompts) and treating all generated code as untrusted input, requiring a two-step pipeline (generation -> validation -> execution).

Technical details

OWASP Agentic Risks 720s
The OWASP Top 10 for Agentic Applications covers risks across agent inputs, processing, memory, tools, outputs, and human oversight. Specific vulnerabilities demonstrated include: Git Spawn (running commands with user privileges via AI assistants) and Dead Bugs (tools that appear benign but secretly change instructions to exfiltrate credentials).
Agent Governance Toolkit 1800s
The Microsoft Agent Governance Toolkit is an open-source runtime governance toolkit that enforces policies, agent identity isolation, and tamper-evident auditing for autonomous AI agents. It helps control what agents can do by allowing blocking, transforming, or escalating actions for human approval.
Memory and Context Poisoning 2800s
Malicious or misleading data can be written into long-term memory (e.g., through repeated, subtle prompts) and treated as trusted knowledge later. Solutions require implementing trust-weighted memories, combining semantic similarity with trust signals (verified sources, human approvals, freshness).
Insecure Inter-Agent Communication 3300s
When agents communicate via APIs or message buses (e.g., Protobuf), lack of controls like trusted messaging, timestamp validation, or rolling nonces allows attackers to intercept, spoof, or replay messages, requiring verification across every single boundary.

Mentioned resources

OWASP Top 10 for Agentic Applications (2026) (Security Standard)
Microsoft Agent Governance Toolkit (Open Source Framework)
Entra Agent ID (Identity Solution)
Azure App Configuration (Configuration Store)
Microsoft Agent Framework (Development SDK)
APIM Azure API Management (AI Gateway)

Channel & topics

Watch on YouTube · Back to latest

This independent, AI-assisted summary is provided for commentary and informational purposes. It may contain errors or omit important context. Please watch the original video for the creator's complete presentation. Video, thumbnail, and related copyrights belong to their respective owners.