How ALOS meets the OWASP risks.

OWASP is the Open Worldwide Application Security Project, a non-profit that publishes the security industry's most widely used risk taxonomies: community-voted, open-source lists of the things that actually go wrong. Its GenAI Security Project now maintains four separate Top 10 lists that, stacked together, cover the whole AI agent.

ALOS maps its checks to all four. Two are stable and quoted verbatim below; two are still in beta, so we paraphrase rather than misquote.

Agentic Applications 2026

Ten risks unique to systems that plan and act: goal hijack, tool misuse, identity and privilege abuse, supply-chain compromise, cascading failures, human-AI agent trust exploitation, and rogue AI agents. Released December 2025.

MCP Top 10

Ten risks in the tool-calling protocol: token mismanagement, scope creep, tool poisoning, dependency tampering, command injection, weak authentication, shadow MCP servers, and context over-sharing.

AST10 and the MCP Top 10 are living, beta frameworks. Titles for those two are paraphrased from public drafts, not quoted as final OWASP wording.

When a skill or AI agent enters the ALOS library, it runs through a security scan. The skill's source is read, never executed. The output is a risk score plus a list of findings, each tagged to the OWASP categories it touches.

Package CVE lookup

Every third-party package a skill declares is checked live against authoritative public vulnerability advisories. Real CVE data, not a guess.

Static-pattern scan

The skill's source is read, never executed, and matched against a curated library of threat patterns: prompt-override and text smuggling, hard-coded secrets, sandbox escape, privacy over-reach, and risky system operations. Findings point to the exact line.

Permission over-reach check

The tools a skill declares in its manifest are compared against the privacy, secrets and sandbox reach it actually exercises. Anything it touches but never declared becomes its own finding.

Optional model judge

On an explicit scan, a model reads the skill and grades its intent risk, catching what pattern-matching misses. It is an opt-in assist, not a hard dependency: the scan stands on its own without it.

We are deliberate about this: the OWASP scan produces a risk score and findings, but it does not silently block a skill on its own. A score is evidence for a human decision, not a gate that fails closed in the dark. What is actually enforced in the platform is a separate, harder set of controls: only approved models run, irreversible actions never run when they are called, and every call lands on the record.

And the honest boundary: this is automated triage, a static scan plus live CVE data and an optional model judge. It is not a substitute for a full code review, and ALOS attests to its own controls, not to any third-party figure.

Three of the four AI agent frameworks were published or revised inside the last twelve months. We track them so the library's checks track them.

OWASP Top 10 for Agentic Applications 2026

A peer-reviewed framework for autonomous systems that plan, call tools and act with delegated authority. Built with more than a hundred researchers and a review board including NIST, the Alan Turing Institute, Microsoft's AI Red Team and AWS.

OWASP MCP Top 10

OWASP's first Top 10 dedicated to a single protocol surface, the Model Context Protocol. Between January and February 2026, researchers filed more than thirty CVEs against MCP servers and clients; 43% were shell injections.

OWASP Agentic Skills Top 10 (AST10)

The skill-content layer: what reusable AI agent skills actually do. Led by Ken Huang. An OWASP scan of 3,984 skills found 36.82% carried security flaws.

The AI Vulnerability Storm briefing

SANS, the Cloud Security Alliance and the OWASP GenAI Security Project published an emergency strategy briefing as AI-driven vulnerability discovery compressed exploit timelines from weeks to hours.