Human-Agent Trust Exploitation — The human oversight that is supposed to be the control becomes the weakest part of it.
One of the ten risks in the OWASP Top 10 for Agentic Applications 2026. Below: how it actually shows up in production, the controls that address it, the evidence object that proves each control fired, and what these controls genuinely cannot do.
Get an Agent Trust Gap BriefHow it shows up
Approval fatigue is the mechanism. After the two-hundredth approval, review becomes clicking. Fluent, confident agent output accelerates it. The control is technically present and functionally absent, and the audit trail looks perfect right up until someone asks what the approver actually saw.
Controls that address it
- Payload-bound approvals — approving one action never silently approves the next.
- Single-use and expiring, so an old approval cannot authorise a new world.
- Show the diff, not the summary. Approve what will execute, not a description of it.
- Measure approval latency and edit rate, and treat a collapse in both as a control failure rather than a productivity win.
- Cap approvals per reviewer per window — volume itself is the attack surface.
The evidence that proves the control fired
An approval record with payload_hash_bound, single_use, expires_at and consumed_at, plus reviewer telemetry.
Schema: ApexClaw Receipts v1 — the receipt format used inside our governance audit, not a standalone protocol or ratified standard (CC-BY, DRAFT).
Honest limitation
This is the hardest one to control technically, because the failure is human and the metrics are proxies. Rubber-stamp detection is inference, not proof — label it that way.
Interpretation Control mappings are ApexClaw's reading of the published OWASP text, last verified 2026-08-06. Source: OWASP Top 10 for Agentic Applications 2026. Not legal advice, not a compliance determination. Full crosswalk →
Common questions
What is ASI09 human-agent trust exploitation?
ASI09 human-agent trust exploitation — The agent's fluency persuades a person to approve something they should have questioned.
How do you defend against it?
Approval surfaces must show the concrete effect and the evidence, not the agent's summary. An approval UI that shows only the agent's reasoning trains reflexive approval.
Is the OWASP Agentic Top 10 a certification?
No. It is a risk taxonomy, not a certifiable standard. There is no OWASP certification for it. Its value is as shared vocabulary — see the assurance frameworks comparison.
What evidence shows this control is working?
Refusal receipts. A control that has never blocked anything is either untested or not enforced. Countable refusals with reasons are what turn a claimed control into a demonstrated one.