One full, nine partial, none hand-waved. A page that claimed all ten would be exactly the marketing we tell you not to trust. The coverage levels below survived a separate skeptic whose job was to knock them down, and where a defense lives in the substrate but the deployed agent has not inherited it yet, we say so on the row.
| Risk | Coverage | How CIRIS addresses it |
|---|---|---|
| ASI01 Agent Goal Hijack | Partial | Defense in depth: prompt-injection scanning on imported skills and messages, visual-injection isolation (conscience evaluators never see raw image bytes), and a conscience pipeline that re-checks every resulting action against the user's original intent before it fires. Gap: input scanning is pattern-based and does not formally separate retrieved data from instructions. |
| ASI02 Tool Misuse | Partial | CIRISServer ships a capability-verb allow/deny list with a server-enforced never-list, checked before an operation runs, so a delegated agent cannot invoke a destructive op it was not granted. Caveat: this guards the fabric layer today and does not yet gate the deployed agent's own LLM tool calls; agent inheritance is a planned phase. |
| ASI03 Identity & Privilege Abuse | Partial | Scoped, delegated, revocable authority in the substrate: constraints carried in signed edges, a never-list that blocks re-delegating the highest powers so authority cannot escalate, tighten-only approval, and instant revocation. Caveat: enforced on the fabric's owner-op surface today; deployed-agent inheritance is a planned phase. |
| ASI04 Agentic Supply Chain | Partial | Build integrity via CIRISVerify's post-quantum signed module manifests (Ed25519 + ML-DSA-65 over a full file-tree hash), plus signed, attested identity for federated components. Gap: covers CIRIS's own build and module chain, not arbitrary third-party MCP servers. |
| ASI05 Unexpected Code Execution | Partial | Semantic conscience gates (entropy, coherence, optimization-veto) run on every tool action before it fires, and uncertainty defers to a human. Gap: this is semantic review, not a deterministic code sandbox. |
| ASI06 Memory & Context Poisoning | Partial | Every write to graph memory is a governed, conscience-checked action into a scoped, versioned graph, not a silent side effect, so a poisoning write is itself an auditable decision. Gap: trust-scoring of retrieved content is partial. |
| ASI07 Insecure Inter-Agent Communication | Partial | CIRISEdge verifies every inter-agent message through a seven-step pipeline ending in hybrid Ed25519 + ML-DSA-65 signature verification (size cap, typed deserialize, schema allow-list, destination-key check, replay window). Gap: the federation transport is still being built out. |
| ASI08 Cascading Failures | Full | Bounded at three independent layers: per-service circuit breakers (closed / open / half-open) around risky calls, the conscience pipeline stopping a bad action before it propagates, and mesh isolation measured at zero cross-group leakage across 50 to 400 nodes. |
| ASI09 Human-Agent Trust Exploitation | Partial | The conscience pipeline scores the agent's own explanatory text, including the reason shown to a human reviewer, for overconfidence and manipulation before a human ever sees it. Gap: it audits with the same model family it is checking. |
| ASI10 Rogue Agents | Partial | Three layers: six consciences gate every consequential action before it executes, a hash-chained signed audit trail makes concealment detectable after the fact, and the fail-secure kill switch lets named humans halt a misaligned agent. Gap: catching a subtly-misaligned-but-coherent agent is inherently bounded. |
OWASP Top 10 for Agentic Applications, published December 2025. Mapped to CIRIS as of July 2026; tell us if a cell is wrong and we will fix it.
Sources
- ASI01 Agent Goal HijackCIRISAgent skill-import SECURITY.md + conscience pipeline
- ASI02 Tool MisuseCIRISServer auth/gate.rs + DELEGATION_CONSTRAINTS.md (shipped 0.5.72)
- ASI03 Identity & Privilege AbuseCIRISServer auth/gate.rs (never-list, tighten-only) + adoption plan
- ASI04 Agentic Supply ChainCIRISVerify Threat Model, §3.4 Supply Chain
- ASI05 Unexpected Code ExecutionCIRISAgent conscience/core.py (semantic action gates)
- ASI06 Memory & Context PoisoningCIRISAgent ciris_engine (governed graph memory)
- ASI07 Insecure Inter-Agent CommunicationCIRISEdge README (verify-before-dispatch pipeline)
- ASI08 Cascading FailuresCIRISAgent circuit_breaker.py + CIRISServer measured mesh isolation
- ASI09 Human-Agent Trust ExploitationCIRISAgent epistemic-humility conscience prompt
- ASI10 Rogue AgentsCIRISVerify HUMANITY_ACCORD kill switch + conscience pipeline
The taxonomy is one lens. See where CIRIS sits among every approach to AI accountability, and how the kill switch is independently verifiable.