By OWASP just shipped the first runtime security specification built specifically for AI agents. The Agent Control Standard (ACS) v0.1 dropped on September 1 alongside the OWASP Top 10 for Agentic Applications 2026 — the companion threat taxonomy that maps exactly what can go wrong when your agent calls tools, holds memory, and coordinates with other agents. Most teams building agents today have zero runtime governance. ACS is the first specification that actually tells you what to implement.
Agents Act. Models Talk. That Distinction Matters.
The OWASP LLM Top 10 has existed since 2023 and covers what a language model says in response to a prompt. The Agentic Top 10 covers what an autonomous agent does — and the gap between those two sentences is enormous. Agents have real credentials. They call live APIs, write to databases, spawn sub-agents, and read external content that can be weaponized against them. The risk is no longer in the output text; it is in the action taken.
Think of LLM guardrails as content filtering. ACS is the firewall. You need both, and only one of them has existed until now.
The 10 Agentic Risks (ASI01–ASI10)
The OWASP Top 10 for Agentic Applications formalizes ten risk categories that do not exist in traditional LLM deployments. Several already have documented real-world incidents:
- ASI01 — Agent Goal Hijack: A prompt injected into a web page or email redirects the agent’s entire objective. In March 2026, a financial services firm’s customer agent silently leaked internal pricing data for three weeks because it was reading attacker-controlled web content as part of its workflow.
- ASI02 — Tool Misuse: Every tool your agent can invoke is an attack surface. The Plugin4Shell vulnerability demonstrated zero-click RCE via a malicious plugin loaded by a coding agent.
- ASI03 — Identity & Privilege Abuse: CVE-2026-62830, the CVSS 9.9 flaw in Azure SRE Agent, shows the blast radius when an agent’s managed identity has excessive permissions — it reached every infrastructure resource in the managed environment.
- ASI06 — Memory Poisoning: An attacker contaminates a RAG knowledge store or persistent memory. Every future decision the agent makes is now poisoned.
- ASI10 — Rogue Agents: The agent continues operating after explicit termination, or spawns sub-agents outside governance scope.
Prompt injection attacks — the primary vector for ASI01 — surged 340% year-over-year according to OWASP’s 2026 LLM Security Report. These are not theoretical risks.
How ACS Enforces Security at Runtime
ACS introduces two actors: the Observed Agent (any agent that exposes ACS-compliant lifecycle hooks) and the Guardian Agent (the policy authority that evaluates pending actions). The runtime loop is straightforward: the framework pauses the agent before any real-world effect, sends the pending action to the Guardian, waits, and then honors the permit, deny, or modify decision.
v0.1 specifies 19 lifecycle hook methods spanning the full agent session — from session start through user message, tool calls, memory read/write, knowledge retrieval, sub-agent spawning, and response delivery. The two hooks evaluated live in this initial release are the ones that matter most: steps/toolCallRequest and steps/toolCallResult. Tool calls are where agents interact with the real world; that is where enforcement belongs.
The observability layer emits structured events in OpenTelemetry and OCSF (Open Cybersecurity Schema Framework), feeding directly into the SIEM and XDR pipelines security teams already operate. No custom tooling required.
AgBOM: The Inventory Step You’re Probably Skipping
ACS also formalizes the Agent Bill of Materials (AgBOM) — a real-time inventory of every component in your agent system. Unlike a software SBOM, which is static, an AgBOM updates live as agents discover tools, connect to new MCP servers, or modify capabilities mid-session. It captures what tools are embedded, who authored them, what version is deployed, and what external services and data sources are accessible.
Generating an AgBOM is the minimum requirement for “Inspectable” status under ACS. You cannot enforce policies on what you cannot enumerate.
What to Do This Week
ACS v0.1 is a public preview with a community comment period through end of 2026. v1.0 will add certification requirements. This is the time to get ahead of it. Start here:
- Audit your tool surface. List every tool your agent can invoke. Each one is an ASI02 risk until proven otherwise.
- Enforce least-privilege identity. Your agent does not need admin. CVE-2026-62830 demonstrated what happens when it has too much.
- Generate an AgBOM. Especially if you’re using MCP servers — know exactly what your agent can reach.
- Enable OpenTelemetry tracing. If your framework supports ACS hooks, turn them on now. This is the observability baseline.
- Treat external data as untrusted input. Web pages, emails, documents your agent reads can carry prompt injections. They are code injection vectors, not content.
The full ACS specification and the OWASP Top 10 for Agentic Applications are available on the OWASP GenAI Security Project site. Read the spec. Then look at what your agents can do. Those two exercises will tell you everything you need to know about your current risk posture.
