Rogue Agents — An agent operating outside intended scope — compromised, misconfigured, or drifted.
One of the ten risks in the OWASP Top 10 for Agentic Applications 2026. Below: how it actually shows up in production, the controls that address it, the evidence object that proves each control fired, and what these controls genuinely cannot do.
Get an Agent Trust Gap BriefHow it shows up
The end state most of the others lead to. What makes it distinct is that the agent may still look healthy: it runs, it responds, it produces plausible output. An agent that was never inventoried cannot be recognised as rogue at all, which is why discovery is the prerequisite control.
Controls that address it
- Complete agent inventory — you cannot detect a rogue agent you did not know existed.
- Behavioural baselining per agent, with deviation surfaced rather than auto-remediated.
- Immediate revocation with measured time-to-effect.
- Kill switch at agent, class and global scope.
- Quarantine that preserves evidence rather than destroying it — the instinct to redeploy first is what loses the record.
The evidence that proves the control fired
revocation plus kill_switch_state, and a preserved receipt chain for the forensic reconstruction.
Schema: ApexClaw Receipts v1 — the receipt format used inside our governance audit, not a standalone protocol or ratified standard (CC-BY, DRAFT).
Honest limitation
Baselining a system designed to behave novelly produces false positives. Tune for containment speed over detection precision, and be explicit that this is the trade-off you made.
Interpretation Control mappings are ApexClaw's reading of the published OWASP text, last verified 2026-08-06. Source: OWASP Top 10 for Agentic Applications 2026. Not legal advice, not a compliance determination. Full crosswalk →
Common questions
What is ASI10 rogue agents?
ASI10 rogue agents — An agent operates outside governance entirely — unregistered, unmonitored, or still running after it should have been retired.
How do you defend against it?
Maintain an agent inventory, require registration before credentials are issued, and alert on any non-human identity acting without a current passport.
Is the OWASP Agentic Top 10 a certification?
No. It is a risk taxonomy, not a certifiable standard. There is no OWASP certification for it. Its value is as shared vocabulary — see the assurance frameworks comparison.
What evidence shows this control is working?
Refusal receipts. A control that has never blocked anything is either untested or not enforced. Countable refusals with reasons are what turn a claimed control into a demonstrated one.