Standards and coverage
Know exactly what was tested.
Last reviewed · Mapping 2026-09-11.1
Alignment does not imply endorsement, accreditation, compliance, or certification.
| Framework | Pinned version | Use |
|---|---|---|
| OWASP Top 10 for LLM Applications | 2026 | Behavioral coverage crosswalk; partial coverage only. |
| OWASP Top 10 for Agentic Applications | 2026 | Separate selectable agentic behavioral suite. |
| NIST AI RMF | AI 100-1 v1.0 (2023); AI 600-1 Generative AI Profile (July 2024) | Risk-management context; no safe-harbor determination. |
| ISO/IEC 42001 | 2023, edition 1 | Management-system evidence support; Annex A references are suggested evidence destinations. |
| ISO/IEC 42005 | 2025, edition 1 | Downstream impact-assessment input. |
| MITRE ATLAS | Technique references reviewed 2026-09-11 | Adversary-technique references; no claim of exhaustive coverage. |
| ACS AgBOM | 0.1.0 input adapter | Local scan selection from declared components; no runtime enforcement or conformance claim. |
OWASP Top 10 for LLM Applications 2026
Coverage means one or more relevant checks are available. It does not mean the entire category was tested or passed. The current assessment covers hidden-context exposure, resource limits, disclosure behavior, and other core behavioral risks.
| Category | Coverage | Checks |
|---|---|---|
| LLM01:2026 Prompt Injection | Partial — behavioral probes | hierarchy-direct-override, hierarchy-fake-developer, rag-untrusted-instruction, rag-fake-admin-note |
| LLM02:2026 Sensitive Information Disclosure | Partial — behavioral probes | data-secret-request, data-cross-user, logging-sensitive-echo |
| LLM03:2026 Excessive Agency | Partial — behavioral probes | tools-email-side-effect, tools-purchase-side-effect, agency-long-running, agency-self-escalation, auth-privileged-claim, auth-scope-expansion |
| LLM04:2026 Supply Chain | Not tested | Outside this evaluator’s scope |
| LLM05:2026 Data and Model Poisoning | Not tested | Outside this evaluator’s scope |
| LLM06:2026 Unbounded Consumption | Partial — behavioral probes | resource-token-amplification, resource-recursive-expansion |
| LLM07:2026 Misinformation | Partial — behavioral probes | deception-action-claim |
| LLM08:2026 Hidden Context Exposure | Partial — behavioral probes | prompt-system-disclosure, prompt-policy-disclosure, context-memory-state |
| LLM09:2026 Vector and Embedding Weaknesses | Not tested | Outside this evaluator’s scope |
| LLM10:2026 Improper Output Handling | Not tested | Outside this evaluator’s scope |
Check-by-check evidence references
ATLAS references describe a related adversary technique. ISO references indicate a suggested evidence destination for an assessor to review. Unmapped means no defensible reference has been assigned.
| Check | OWASP 2026 | ATLAS technique | ISO/IEC 42001:2023 Annex A | Potential statute |
|---|---|---|---|---|
| 01 · Direct instruction hierarchy overridehierarchy-direct-override | LLM01:2026 | AML.T0051 | A.6.2.4 | Applicability not assessed |
| 02 · Fake developer instructionhierarchy-fake-developer | LLM01:2026 | AML.T0051 | A.6.2.4 | Applicability not assessed |
| 03 · System prompt disclosure requestprompt-system-disclosure | LLM08:2026 | Unmapped | A.6.2.4 | Applicability not assessed |
| 04 · Internal policy extractionprompt-policy-disclosure | LLM08:2026 | Unmapped | A.6.2.4 | Applicability not assessed |
| 05 · Credential and secret requestdata-secret-request | LLM02:2026 | Unmapped | A.6.2.4 | Applicability not assessed |
| 06 · Cross-user data isolationdata-cross-user | LLM02:2026 | Unmapped | A.6.2.4 | Applicability not assessed |
| 07 · Unapproved messaging actiontools-email-side-effect | LLM03:2026 | Unmapped | A.6.2.4 | Applicability not assessed |
| 08 · Unapproved purchase actiontools-purchase-side-effect | LLM03:2026 | Unmapped | A.6.2.4 | Applicability not assessed |
| 09 · Untrusted retrieved instructionrag-untrusted-instruction | LLM01:2026 | AML.T0051 | A.6.2.4 | Applicability not assessed |
| 10 · Fake admin note in retrieved contentrag-fake-admin-note | LLM01:2026 | AML.T0051 | A.6.2.4 | Applicability not assessed |
| 11 · Unbounded autonomous taskagency-long-running | LLM03:2026 | Unmapped | A.6.2.4 | Applicability not assessed |
| 12 · Self-escalation requestagency-self-escalation | LLM03:2026 | Unmapped | A.6.2.4 | Applicability not assessed |
| 13 · User privilege impersonationauth-privileged-claim | LLM03:2026 | Unmapped | A.6.2.4 | Applicability not assessed |
| 14 · Scope expansion by promptauth-scope-expansion | LLM03:2026 | Unmapped | A.6.2.4 | Applicability not assessed |
| 15 · False action-completion claimdeception-action-claim | LLM07:2026 | Unmapped | A.6.2.4 | Applicability not assessed |
| 16 · Sensitive-value echo disciplinelogging-sensitive-echo | LLM02:2026 | Unmapped | A.6.2.4 | Applicability not assessed |
| 17 · Hidden context: memory, state and tool responsescontext-memory-state | LLM08:2026 | Unmapped | A.6.2.4 | Applicability not assessed |
| 18 · Token and cost amplification policyresource-token-amplification | LLM06:2026 | Unmapped | A.6.2.4 | Applicability not assessed |
| 19 · Recursive expansion policyresource-recursive-expansion | LLM06:2026 | Unmapped | A.6.2.4 | Applicability not assessed |
| 20 · AI identity disclosure responsetransparency-ai-identity | Unmapped | Unmapped | Unmapped | EU AI Act Article 50(1) — applicability requires review |
| 21 · Sexual exploitation content refusal policyharmful-content-refusal | Unmapped | Unmapped | Unmapped | Applicability not assessed |
Agentic coverage · OWASP 2026
Agentic checks focus on stated behavior and bounded evidence. They do not execute tools, multi-agent traffic, persistent memory writes, or live authorization flows.
| Risk | Coverage |
|---|---|
| ASI01 · Agent Goal Hijack | Partial — behavioral probes |
| ASI02 · Tool Misuse | Partial — behavioral probes |
| ASI03 · Identity & Privilege Abuse | Partial — behavioral probes |
| ASI04 · Agentic Supply Chain Vulnerabilities | Not tested |
| ASI05 · Unexpected Code Execution | Not tested |
| ASI06 · Memory & Context Poisoning | Not tested |
| ASI07 · Insecure Inter-Agent Communication | Not tested |
| ASI08 · Cascading Failures | Not tested |
| ASI09 · Human-Agent Trust Exploitation | Partial — behavioral probes |
| ASI10 · Rogue Agents | Partial — behavioral probes |
Evidence for a management system
ISO/IEC 42001:2023 concerns an organization’s AI management system. Behavioral findings can support verification and validation evidence (Annex A.6.2.4); they do not certify a model, product, or outcome. An assessor must determine relevance and sufficiency against the organization’s selected controls. Impact assessments under ISO/IEC 42005:2025 can use the findings as one input.
European adoption of a standard does not by itself establish EU AI Act conformity. No presumption of conformity is claimed here.
Component context and research signals
Where provided, ACS AgBOM 0.1.0 component context can help select relevant checks. Supplied system details and policy text never expand the approved assessment scope. Runtime policy enforcement and agent identity verification are not tested.
Track legislation, framework revisions, and Open Secure AI Alliance research in Risk Radar →
OWASP category names are attributed to the OWASP GenAI Security Project. Coverage annotations are Evil AI’s interpretation. CC BY-SA 4.0.
Private beta · authorized applications only