13 of 13
Reading room
Sources, with their jobs named
A risk list names failures. A framework organizes decisions. A guide explains practice. A specification defines how a protocol must behave. The title does not make a document mandatory. Requirements come from law, contract, policy, or a standard you choose to adopt.
Read a source in this order. Name its job. Name the version and whether it is final, a draft, or a study. Then ask what it can prove. A demonstration shows that a path is possible under the conditions the authors stated. It is not how often that path succeeds, and it is not a certification.
Research cutoff for this course is 2 October 2026. Living project pages can change after that date. Recheck a draft, a beta list, or a protocol page before you treat it as a deployment requirement.
Answer the check to finish this step. The catalog below is reference. You do not have to open every source.
Check
A signed document contains malicious instructions. What does the signature prove?
Pick the control that stops the effect. A wrong choice shows what still happens. You can choose again.
50 of 50
- OWASP Agentic Top 10 for 2026
Published · 9 Dec 2025
Agent-specific risk taxonomy. ASI01–ASI10.
- OWASP GenAI / LLM Top 10 2026
Published · 3 Aug 2026
Current LLM taxonomy, including the revised ordering and execution-boundary guidance.
- OWASP Agentic AI Threats and Mitigations v1.1
Published report · v1.1
Earlier detailed agent threat model. Its T-number labels differ from the ASI taxonomy.
- OWASP Securing Agentic Applications Guide 1.0
Published · July 2025
Security across agents, orchestration, tools, execution and deployment patterns.
- OWASP Multi-Agentic System Threat Modeling Guide v1.0
Published · 23 Apr 2025
Cross-agent trust, communication and system-level threat modeling.
- OWASP Agent Control Standard
Published specification initiative · 1 Sep 2026
Lifecycle interception and portable policy decisions. Implementation maturity matters.
- ACS reference implementation and specification
Observed specification · v0.1.0
Explicit reference gaps: wire authentication, failure posture and hook coverage.
- OWASP Practical Guide for Secure MCP Server Development
Published · 16 Feb 2026
Server-side validation, authorization, session separation and deployment security.
- OWASP Securely Using Third-Party MCP Servers 1.0
Published · 4 Nov 2025
Third-party server due diligence and integration risk.
- OWASP GenAI Data Security Risks & Mitigations 2026
Published · 17 Mar 2026
This catalog describes 21 data risks. It covers credentials, context, retrieval, and recorded system events.
- OWASP GenAI Red Teaming Guide
Published · 22 Jan 2025
Model, implementation, infrastructure and runtime/human testing.
- OWASP MCP Top 10
Beta / pilot testing · observed 2 Oct 2026
MCP-specific risks. Distinct project and maturity level from the Agentic Top 10.
- OWASP Agentic Skills Top 10
Development / launch preparation · observed 2 Oct 2026
This project addresses the skills supply chain and governance. Do not treat the developing list as a final standard.
- OWASP GenAI Security Industry Framework Crosswalk
Published · 1 Sep 2026
Mapping aid across frameworks. Mappings are not proof of compliance.
- OWASP State of Agentic AI Security and Governance
Resource revision · 1 Jun 2026
Landscape context, not a required technical baseline.
- NIST AI RMF 1.0 · AI 100-1
Final · Jan 2023
This voluntary risk-management framework has four functions: Govern, Map, Measure, and Manage.
- NIST AI RMF Playbook
Living companion resource
This Playbook suggests actions to select for the context. It is not a certification checklist or a requirement to perform every action.
- NIST GenAI Profile · AI 600-1
Final · July 2024
Companion profile covering broader GenAI risks, including privacy and information integrity.
- NIST Adversarial ML Taxonomy · AI 100-2e2025
Final · Mar 2025
Classifies adversary goals, capabilities and lifecycle attacks. Not an agent control specification.
- NIST SP 800-218A · SSDF AI Profile
Final · 26 July 2024
Secure development for AI model producers and acquirers, supplementing the SSDF.
- NIST SP 800-218 · SSDF 1.1
Final version used · Feb 2022
Conventional secure software development remains necessary for agent infrastructure.
- NIST SP 800-207 · Zero Trust Architecture
Final · Aug 2020
Resource access mediated by identity, policy and context rather than network location.
- NIST SP 800-53 Rev. 5
Final control catalog · Rev. 5
This publication provides reusable security and privacy controls. Each organization must select and assess controls for its own system.
- NIST Cybersecurity Framework 2.0
Final · 26 Feb 2024
Govern, Identify, Protect, Detect, Respond, Recover.
- NIST SP 800-61 Rev. 3 · Incident Response
Final · 3 Apr 2025
Incident response integrated with CSF 2.0 risk management.
- NIST IR 8596 · Cyber AI Profile
Initial preliminary draft · 16 Dec 2025
Secure AI systems, AI-enabled defense and AI-enabled threats. Draft status is material.
- NIST COSAiS · AI Security Control Overlays
Developing project
Developing AI overlays for SP 800-53. No blanket final agent baseline claimed.
- NCCoE Agent Identity and Authorization initiative
Concept initiative and public feedback · 2026
This initiative explores agent identity. Stakeholder suggestions are not final NIST requirements.
- MCP authorization security considerations
Pinned specification · 28 July 2026
Resource indicators, audience validation and prohibited token passthrough.
- MCP security best practices
Pinned documentation route · July 2026
Confused deputy, sessions, discovery SSRF, local server execution and consent.
- IETF RFC 9700 · OAuth 2.0 Security BCP
Final RFC · Jan 2025
OAuth security baseline. Distinct from still-evolving OAuth drafts.
- A2A protocol specification v0.3.0
Pinned reviewed version · v0.3.0
Authenticated requests, server-side authorization and callback security. No latest-version claim.
- MITRE ATLAS
Living knowledge base
Attacker behavior and case-study vocabulary. Exact current technique IDs are not asserted here.
- NCSC / CISA Guidelines for Secure AI System Development
Published · Nov 2023
Secure design, development, deployment, operation and maintenance.
- Five Eyes · Careful Adoption of Agentic AI Services
Joint guidance · 1 May 2026
Conservative adoption, identity, controls, monitoring and accountability.
- ASD ACSC · Agentic AI Harnesses
Published · 11 Sep 2026
The harness as the organizational control surface, separate from the model.
- Cloud Security Alliance · MAESTRO
Published framework · 6 Feb 2025
Seven-layer threat modeling spanning models through the agent ecosystem.
- Microsoft · Threat Modeling for AI
Official guidance · 24 Feb 2026
Assets, data flow, evolving integrations and continuous threat modeling.
- NVIDIA · Sandboxing Agentic Workflows
Engineering guidance · 30 Jan 2026
OS-enforced filesystem and network constraints, including startup hooks and subprocesses.
- AgentDojo
Research · NeurIPS 2024
Agent utility and indirect prompt-injection testing in dynamic tool environments.
- InjecAgent
Research · ACL Findings 2024
Indirect injection across tool-using agent scenarios. Historical benchmark, not current prevalence.
- Adaptive Attacks Break Defenses Against Indirect Prompt Injection
Research · NAACL Findings 2025
Why defender-aware evaluation matters. Benchmark success rates are setup-specific.
- Invariant Labs · MCP Tool Poisoning
Research demonstration · 1 Apr 2025
Malicious tool metadata, cross-tool manipulation and changed descriptions.
- Invariant Labs · GitHub MCP exploit demonstration
Research demonstration · 26 May 2025
Untrusted public issue content combined with private repository access and public writes.
- Snyk · ToxicSkills
Original study · 5 Feb 2026
The study reports findings from a specific skills sample. A security flaw does not, by itself, prove malicious behavior.
- Check Point · Caught in the Hook
Vulnerability disclosure · 25 Feb 2026
Project configuration, startup execution and endpoint redirection. Disclosed issues were patched.
- Google Threat Intelligence · Prompt Injections on the Web
Original field study · 23 Apr 2026
Observed attempts in Common Crawl. Collection scope and detection bias limit conclusions about compromise or prevalence.
- ASD-STE100 · Official Simplified Technical English FAQ
Writing reference · Official guidance
Explains controlled language, consistent terms, technical vocabulary, direct instructions, and the use of STE principles outside maintenance manuals.
- OWASP · Threat Modeling Cheat Sheet
Living guidance · Reviewed 2 Oct 2026
Explains system models, threat identification, STRIDE, mitigations, and validation.
- IETF RFC 7636 · Proof Key for Code Exchange
Standards Track RFC · September 2015
Defines the PKCE verifier and challenge mechanism used in authorization-code flows.