Clarification on ASI Mapping for T9 (Identity Spoofing & Impersonation / Agent Identity Compromise)

[y4ney]

📌 Description

Hi OWASP GenAI Security Project team,

While reviewing the OWASP Top 10 for Agentic Applications 2026 (Agentic Security Initiative, Version 2026, December 2025), I noticed that:

T9: Identity Spoofing & Impersonation / Agent Identity Compromise

does not appear to have an explicitly defined mapping to an ASI category (see page 39).

I wanted to check whether this is intentional, or if clarification might be helpful.

---

⚠️ Why this matters

T9 represents a foundational security threat in agentic systems, especially in multi-agent and enterprise environments.

This category includes:

• Agent identity spoofing
• User impersonation
• Credential/token theft (e.g., persistent agent identities such as Entra Agent ID)
• Unauthorized API access
• Cross-platform identity abuse
• Persistent identity hijacking

These attack vectors may result in:

• Long-term unauthorized access
• Privilege escalation
• Lateral movement across systems
• Reduced auditability and accountability

With the growing adoption of non-human identities (NHIs) in agentic architectures, this threat plays a central role in the overall security model.

---

🧠 Reference Definition

From Agentic AI – Threats and Mitigations (Version 1.1, December 2025):

Identity impersonation is a major threat where attackers exploit authentication weaknesses to impersonate agents, users, or external services, enabling unauthorized actions and long-term privileged access.

---

🔗 Possible Mapping (for discussion)

Based on its characteristics, T9 seems closely aligned with:

👉 ASI03 – Identity & Privilege Abuse

As it involves:

• Authentication failures
• Identity compromise
• Credential misuse
• Privilege escalation
• Non-human identity abuse

---

⚖️ Clarification Opportunity

Adding or clarifying the mapping for T9 could help:

• Improve taxonomy completeness
• Reduce ambiguity for practitioners
• Strengthen alignment between Threat categories (T#) and ASI categories

It may also be useful to explicitly distinguish between:

• Identity-level impersonation (ASI03)
• Trust / behavioral exploitation (ASI09)

---

💡 Suggestion

• Clarify whether T9 is intentionally unmapped
• If not, consider adding an explicit ASI mapping
• ASI03 may be a natural fit based on current definitions

---

🙏 Closing

This may be a misunderstanding on my side, so happy to be corrected.

Given the importance of identity security in agentic systems, I thought it might be worth raising for discussion.

Happy to help propose a concrete mapping table update or contribute a PR if useful.

Thank you for your work on advancing Agentic AI security!

---

[0xbrainkid]

The T9 mapping gap you've identified is real and worth clarifying. From working on the adjacent MITRE ATLAS Agent Identity Spoofing and Agent Payment Hijacking proposals (mitre-atlas/atlas-data#11), I can offer some context:

Why T9 is difficult to map cleanly:

T9 (Identity Spoofing & Impersonation) spans two distinct attack classes that have different detection and mitigation profiles:

1. Structural identity attacks — forged credentials, impersonation via valid-looking identity artifacts, replay attacks. These are addressed by cryptographic identity systems (Ed25519 signing, DID resolution, certificate validation).

2. Behavioral identity attacks — agent acts with valid identity but compromised or manipulated behavior. A legitimate agent that's been prompt-injected or drifted from its baseline still has valid credentials. The attack is identity-consistent but behavior-anomalous.

Class (1) maps cleanly to existing ASI categories around authentication. Class (2) is what MITRE is working on with the "authorization-execution divergence" sub-techniques, and what OWASP #802 has been formalizing as the behavioral trust layer.

The gap in T9's ASI mapping is likely because the behavioral identity attack class doesn't fit neatly into existing authentication taxonomies — it requires a separate control class (behavioral monitoring) rather than stronger authentication.

For the clarification you're seeking: T9 probably needs to be split or have a sub-category noting that behavioral drift attacks require runtime behavioral monitoring as mitigation, not just stronger credentials.