Cascading Failures — One agent's failure propagates through the agents that depend on it.
One of the ten risks in the OWASP Top 10 for Agentic Applications 2026. Below: how it actually shows up in production, the controls that address it, the evidence object that proves each control fired, and what these controls genuinely cannot do.
Get an Agent Trust Gap BriefHow it shows up
A bad output becomes a trusted input, which produces a worse output, which triggers a retry storm. What began as one wrong answer becomes an outage, a spend event, or a hundred wrong messages. Speed is the aggravating factor: agents fail faster than humans notice.
Controls that address it
- Circuit breakers per effect class, not just per service.
- Idempotency keys so retries cannot multiply into duplicates.
- Blast-radius caps — ceilings on actions per window that hold under load.
- Dead-letter queues instead of infinite retry.
- A kill switch that halts a class of action across every agent at once, with a measured time-to-effect.
The evidence that proves the control fired
A revocation record with measured time_to_effect_seconds, plus breaker-state on the receipt.
Schema: ApexClaw Receipts v1 — the receipt format used inside our governance audit, not a standalone protocol or ratified standard (CC-BY, DRAFT).
Honest limitation
A kill switch that has never been fired in anger is a claim. The only meaningful specification is a measured time-to-effect on a live path.
Interpretation Control mappings are ApexClaw's reading of the published OWASP text, last verified 2026-08-06. Source: OWASP Top 10 for Agentic Applications 2026. Not legal advice, not a compliance determination. Full crosswalk →
← ASI07 Insecure Inter-Agent Communication ASI09 Human-Agent Trust Exploitation →
Common questions
What is ASI08 cascading failures?
ASI08 cascading failures — One agent's bad output becomes another's trusted input, and the error amplifies through the chain.
How do you defend against it?
Circuit breakers between agents, confidence and provenance carried across boundaries, and blast-radius limits so a single bad decision cannot fan out.
Is the OWASP Agentic Top 10 a certification?
No. It is a risk taxonomy, not a certifiable standard. There is no OWASP certification for it. Its value is as shared vocabulary — see the assurance frameworks comparison.
What evidence shows this control is working?
Refusal receipts. A control that has never blocked anything is either untested or not enforced. Countable refusals with reasons are what turn a claimed control into a demonstrated one.