The OWASP guide to AI agent security (and where deception fits)

In November 2025, a disclosed AI-orchestrated espionage campaign (GTG-1002) demonstrated an AI system executing an end-to-end intrusion at machine speed. This is the reality of the agentic threat: an autonomous agent navigating connected systems by combining valid credentials with approved APIs. While conventional controls faithfully record each individual action, they struggle to evaluate the broader sequence, where the true malicious intent actually lives OWASP’s agentic AI guidance is where most teams start.

At a glance

• Among AI agent security frameworks, OWASP’s is the most cited practitioner reference for application security teams. Its agentic AI security guidance identifies risks specific to autonomous agents, including prompt injection, excessive agency, and trust chain abuse, and gives teams a shared vocabulary for them.
• Each OWASP risk maps to a detection requirement. Preventive controls reduce exposure; they do not eliminate every failure mode, so runtime detection covers what gets through.
• Deception is additive to your SIEM, EDR, and identity controls, not a replacement. It adds a runtime detection layer through decoy APIs, deceptive credentials, and honeytokens placed where a misbehaving agent will reach.
• Deception is behaviorally independent: it produces a high-confidence signal of intent on the act of touching an asset no legitimate process should need, so there is no pattern for an attacker to study and avoid.
• 360 Deception covers approximately 20 MITRE ATT&CK techniques, many of which map to the attack patterns OWASP documents for agentic AI systems.

According to OWASP, AI agents are LLM-based systems that act autonomously. Not because they are conscious, but because they can reason, retain memory, and take action toward a goal. That autonomy is what makes them useful and makes their runtime behavior hard to judge based on any single action.

The primary reference here is OWASP’s AI Agent Security Cheat Sheet, which covers the core controls: least privilege, tool restrictions, prompt injection defenses, memory isolation, output validation, human approval, continuous monitoring, data protection, and adversarial testing.

The cheat sheet works alongside two related OWASP resources. The “Top 10 for LLM Applications” covers model-level risks and uses the numbered codes you will see throughout this post (LLM01, LLM06, and so on). The “Top 10 for Agentic Applications (2026)” ranks the risks specific to autonomous agents. Together, these resources give teams a shared language for how agents fail and the steps toward preventing those failures.

Prompt injection sits at the top of the OWASP Top 10 for LLM Applications, labeled LLM01, and the AI Agent Security Cheat Sheet treats it as the front door to agent compromise. The technique is simple, which is part of what makes it effective. Malicious instructions are hidden in a webpage, a document, or an email. The agent reads them and acts on them, because acting on instructions is what agents do.

An agent reading a poisoned document and updating its goals uses authenticated sessions and approved processes. SIEM and EDR record each action faithfully. What is hard to judge from that record alone is that the sequence now serves the wrong objective, because every individual step looks permitted. The intent lives in how the actions connect.

This is where deception fits: as an added layer of defense over your existing security stack. A hijacked agent has to act at some point. It will reach for a credential, map and follow a path, or touch a data object. If those are deceptive, the first out-of-scope move produces a high-confidence signal, no matter what the hidden prompt said.

Excessive agency means an agent has more power than the task requires: unnecessary functionality, permissions, or autonomy. Several triggers can push an agent into harmful action, including malicious prompts, model hallucinations, compromised tools, or bad output from another agent. The root issue is that the system can simply do too much.

Least privilege is the first defense. Agents should hold only the tools their task requires, and high-impact actions should require independent human approval. In practice, permissions drift, integrations change, and valid identities misbehave over time.

Deception gives you a high-confidence detection point against that drift, and it works best when it is autonomous. Manually deployed and maintained decoys cannot keep pace with an agent operating at machine speed, so automation is the entry requirement, not a nice-to-have. The ShadowPlex Preemptive Cybersecurity Platform places and refreshes deception that instruments agent identity paths at runtime: honeytokens inside out-of-scope data stores, fake API endpoints outside normal workflows, and deceptive credentials in high-value locations. A correctly configured agent never touches these assets. Any interaction is a high-confidence signal of intent: the agent did something other than what it was meant to do.

LLM08 covers vector and embedding weaknesses, and LLM09 covers misinformation. Both change what an agent retrieves and, by extension, what it believes and does. A compromised vector database inserts bad data into retrieval-augmented generation (RAG), and the wrong context is enough to redirect the agent’s plan without generating any obvious noise.

These problems begin early and surface during execution. A context-poisoned agent eventually makes a poor choice: requesting unusual data, using an unexpected credential, or calling an unapproved tool. That is the moment to catch it.

Deception cannot validate every embedding or stop every bad dependency. What it can do is instrument the environment around the agent, so fake assets provide clear detection points the moment those poor choices turn into action. The principle underneath is the one to keep in view for the whole category: why did anything touch an asset no legitimate process should need? These same techniques appear in stealthy identity threats that use valid credentials, where the account is real but the behavior is not.

360 Deception goes beyond standard decoys by blending realistic fake assets, deceptively realistic configured real assets, and intentionally suspicious artifacts into a combination designed to confuse and degrade automated attack tooling. It maps to roughly 20 MITRE ATT&CK techniques spanning discovery, credential abuse, lateral movement, and collection, though exact coverage depends on your environment. Signal quality depends on credible placement and automation at agent scale.