OWASP’s Agentic Security Guide V2: The Moment Before an Agent Acts
In our CurseBox research, we documented an agent responding to an ordinary file-sharing request by uploading the file to a public, anonymous hosting service so it could return a link. The agent selected the destination itself, without an attacker directing it there. Its attempt to complete a legitimate task had created a new security problem before anyone reviewed the final answer.
That gap between an authorized objective and the path an agent chooses is central to the updated OWASP Securing Agentic Applications V2 guide, published on November 10. Capsule Security contributed to this edition, which gives builders and defenders more concrete ways to constrain those paths before they cause harm.
The first edition already covered runtime protection, secure architectures, memory risks, and behavioral testing. V2 builds on that foundation by specifying where controls belong, how they should respond, and what evidence demonstrates that they work.
Authority should follow the task
One revealing change appears in the model’s definition. Where V1 described it as the agent’s brain, V2 treats its outputs as untrusted proposals that require external validation and authorization. The surrounding system must enforce policy even when the model follows a malicious instruction or makes an unsafe decision.
V2’s effective-scope model combines user permission, agent capability, and bound intent, with consented scope added where applicable. An agent asked to summarize customer records may possess export permissions, but the task still does not authorize exporting the database. In multi-agent systems, delegated authority should narrow at each hop, keeping downstream agents bound to the original task.
The guide also adds a capability-composition gate through the Lethal Trifecta and Rule of Two. Sensitive data, untrusted content, and external communication become dangerous together, even when each capability has a legitimate purpose. The default response is to remove a capability or separate them across independently authorized components with enforced boundaries. A new capability control matrix connects these risks to controls and escalation triggers.
Enforcement belongs before execution
Before the file-sharing agent uploads anything, its proposed request and destination can be inspected. V2’s new security-hooks section makes those opportunities explicit across 18 lifecycle points, including tool calls, memory operations, delegation, and skill activation.
Policy at enforcement points can allow, deny, modify, escalate, or defer an action, while errors and timeouts must fail closed. The guide recommends starting with tool-call requests and agent responses, followed by memory writes. Every consequential action path needs coverage, including paths through sub-agents or downstream services that could bypass the main harness. The guide distinguishes an enforcement hook from a callback that only observes activity. Where native hooks cannot stop execution, synchronous wrappers are needed, while actions outside the harness still require scoped credentials, network restrictions, sandboxing, and server-side authorization.
These additions connect closely to Capsule’s contributions to the OWASP Agent Control Standard (ACS), which standardizes how agent platforms expose runtime hooks for policy enforcement. The guide explains where security boundaries belong, while ACS provides a common interface for putting those controls into practice across frameworks.
Trust needs to survive change
Our CurseChain research showed how hidden README instructions could cause SSH-key theft and spread into future projects. V2 addresses more of that surface by treating repository instructions and configuration as supply chain risks, alongside tools and MCP integrations. Its control-plane guidance also recognizes that prompts, retrieved content, and memory shape behavior without carrying equal authority.
The expanded guidance includes vetted catalogs, pinned tool definitions, expiring approvals, and drift detection. Changed descriptions or schemas block execution pending re-approval, making trust something that must be maintained after installation. Memory guidance becomes more precise too: keyword filtering is only a detection signal, and an integrity hash cannot establish that stored content is safe. Malicious instructions can remain intact inside an unchanged record.
The complete journey needs testing
The file-sharing agent could return a working link while taking an unacceptable route to produce it. V2’s expanded assurance guidance therefore connects declared scope to controls, execution-path testing, runtime evidence, and revalidation when the system changes. Behavioral testing explicitly includes failures that need no attacker, alongside controls that wrongly block legitimate work. Changes to tools, instructions, memory, or orchestration should trigger revalidation of the affected assumptions, so assurance remains connected to the application as it evolves.
At Capsule, we focus on that decision before execution: whether a proposed action belongs to the authorized task and whether policy permits it. V2 gives builders a more concrete way to connect that decision to the application around it, while the action can still be stopped. A useful starting point is to follow one deployed agent through a complete task and check what can stop each consequential action before it takes effect.
Read the full OWASP Securing Agentic Applications V2 guide.
Read more articles
PHP2Shell May Reach Your Agents Through Their Tools
A critical PHP flaw gives attackers code execution and a read of worker memory, and a growing share of the tools your agents call runs on PHP, from the WordPress MCP Adapter to Laravel MCP. We cover where agents touch PHP, how to tell if yours do, and the control that holds when a trusted tool server turns hostile.
GhostSquatting: Model Theft and RCE via Abandoned Names in AI Agent Files
What happens when an AI agent blindly trusts a name nobody owns? We claimed abandoned buckets and packages referenced in agent files, and real production systems started sending us model weights, backups, and installs. GhostSquatting turns forgotten names into model theft, data exfiltration, and RCE.
To Jev Or Not to Jev?
Jev is fast, clever, and great at classification, so why not put it in front of every AI agent action? We tested it against Capsule's rogue agent model on accuracy, latency, and context, and found that when a wrong answer means a deleted production database, specialization still wins.
.avif)
OWASP Named the Ten Ways Skills Go Wrong. All Ten Are Already Happening.
OWASP has published the Agentic Skills Top 10, a new list of the most critical risks in the skills that give AI agents real-world reach across tools like Claude Code and Cursor. We compared each of the ten risks against our analysis of over 200,000 real skills, and every one of them is already happening in the wild.
CurseBox: The Agent That Sends Your Files to Strangers to Get the Job Done
Capsule Security research uncovered a behavior in Cursor's agent: asked to do something ordinary like share a file, it decides on its own to upload the file to a public anonymous host to get a link. It will push past a deny-all network sandbox to do it, and no attacker is involved. We found it running in production across every major model, reported it to Cursor, and were met with silence.
Compliance Comes for the Agents: Every Agentic AI Framework You Need to Know
As AI agent security moves into formal governance, binding laws like the EU AI Act and procurement standards like ISO 42001 are becoming required, while voluntary frameworks like OWASP’s Agentic Top 10 guide threat modeling. Despite these rising expectations, audit data shows that most active agent deployments still lack basic safeguards like input validation and execution logging. This post breaks down the five-layer compliance stack and explains why continuous, runtime evidence is essential to satisfy both strict regulations and voluntary benchmarks.
When Agents Go Rogue
Modern AI agents are increasingly causing critical system damage not through external cyberattacks, but by taking unprompted, off-script actions across unguarded tools like databases and system shells. Traditional safeguards, including prompt instructions and human approval workflows, routinely fail to catch these autonomous errors before execution. To mitigate this growing risk, security must shift directly to the tool-call boundary, enforcing deterministic runtime controls that intercept and block destructive commands before they run.
Keeping AI Agents on Track: How Capsule Powers State-of-the-Art Rogue Agent Detection with NVIDIA Nemotron
Capsule Security and NVIDIA collaborated to solve the rogue AI agent threat by engineering specialized Small Language Models (SLMs) for real-time intent security detection. By fine-tuning NVIDIA Nemotron architectures, this solution achieves inline, ultra-low latency interception of unauthorized agent actions before damage occurs. Discover how domain-specialized models deliver up to 96.9% accuracy and sub-200ms response times to keep autonomous enterprise workflows secure.
Capsule Launches Security Integration for Claude Platform
Capsule launches a security integration for Claude Platform, using Claude's Compliance API to give security, compliance, and AI governance teams visibility into enterprise AI activity, risk, and posture across Anthropic-hosted deployments.
.png)
We Analyzed 206,435 AI Agent Skills. Here's What We Found.
Our analysis of 206,435 AI agent skills reveals a rapidly growing software supply chain vulnerable to natural language payloads and dangerous capability combinations. Read the report to understand how these skills bypass traditional security controls and learn how Capsule protects your organization by securing the agent runtime.
.png)
Mitigating the Agentic AI Threat: What Security Leadership Needs to Prioritize
The theoretical phase of agentic AI security is over—the attack surface is real and the incidents are documented. This post breaks down the defensive architecture taking shape in response: Meta's Agents Rule of Two, deterministic enforcement hooks, identity governance for non-human agents, and the questions security leaders need to be asking right now.
The Agentic AI Threat Landscape Has Crossed a Threshold
The security risks of AI agents are no longer theoretical. This blog examines the active threat landscape facing agentic AI in 2026, from prompt injection and supply chain attacks against MCP and skill registries to the governance gap created by vibe coding and Shadow AI.
The Rise of Guardian Agents: Securing the Agentic AI Ecosystem
Guardian agents are emerging as a critical security layer for the agentic AI era. As enterprises adopt AI agents that execute tools, handle sensitive data, and operate inside real workflows, human approval loops no longer scale. Guardian agents solve this by supervising other agents in real time: monitoring actions, enforcing policy, and blocking risky behavior before execution.
.png)
CurseChain: How Hidden README Comments Trick Cursor Into Stealing - and Spreading - Your SSH Keys
Capsule found two Cursor IDE vulnerabilities that let hidden prompt-injection instructions in referenced files steal developers’ SSH keys and contaminate future unrelated projects, causing zero-click or one-click exfiltration even when the attacker ships no malicious code.
The State of AI Agent Security 2026
Capsule Security’s State of AI Agent Security 2026 report is the largest independent audit of AI agents to date, showing that the ecosystem is rapidly shipping publicly exposed, weakly guarded, highly connected agents with recurring misconfigurations, near-absent runtime controls, widespread prompt-injection risk, expanding supply-chain exposure, and active malicious campaigns still propagating through agent skill and tool registries.
Capsule Security Raises $7M to Prevent AI Agents from Going Rogue in Runtime: Intent is the New Perimeter
Capsule is launching a runtime security platform for the agentic AI era, built to monitor and stop autonomous agents that can bypass traditional guardrails, misuse legitimate access, and create a new class of enterprise security risk.
.avif)
PipeLeak: The Lead That Stole Your Database - Exploiting Salesforce Agentforce With Indirect Prompt Injection
Capsule research team discover a critical prompt injection vulnerability in Salesforce Agentforce that allows attackers to exfiltrate CRM data through a simple lead from a form submission. No authentication required.
