FRAMEWORK / SECURITY

Agentic & ML Security

The Institute's security programme spans the MLSecOps Top 10 for the machine-learning lifecycle, collaboration with the Linux Foundation and OpenSSF on ML security practice, and active review of OWASP guidance for agentic systems — machine-learning security doesn't stop being relevant when the system starts calling tools.

01 — THE MLSECOPS TOP 10

The MLSecOps Top 10

MLSecOps connects common machine-learning security failures to controls that teams can apply across data, model, deployment and monitoring workflows.

OWASP vulnerability	MLSecOps equivalent
Broken access control	Unrestricted model endpoints
Cryptographic failures	Access to model artifacts
Injection	Artifact exploit injection
Insecure design	Insecure ML systems and pipeline design
Security misconfigurations	Data and ML infrastructure misconfigurations
Vulnerable and outdated components	Supply-chain vulnerabilities in ML code
Identification and authentication failures	IAM and RBAC failures for ML services
Software and data integrity failures	ML infrastructure, ETL and CI/CD integrity failures
Logging and monitoring failures	Observability, reproducibility and lineage failures
Server-side request forgery	ML server-side request forgery

Code and worked examples are maintained in the open-source fml-security repository.

02 — THE AGENTIC FRONTIER

The agentic frontier

The MLSecOps taxonomy covers the lifecycle around models. Agentic systems add delegated authority, tools and memory to the attack surface. The OWASP Top 10 for Agentic Applications names these risks through the ASI taxonomy; the selected mappings below position them against principle-led controls without reproducing the full OWASP list.

Selected OWASP ASI category	Principle and control framing
ASI01 · Agent Goal Hijack	Constrain mandates, separate external content from instructions, and gate consequential actions under P01 and P09.
ASI03 · Identity & Privilege Abuse	Give each agent a distinct identity, least-privilege credentials and fail-closed policy gateways.
ASI04 · Agentic Supply Chain Vulnerabilities	Verify models, tools and dependencies, record provenance and restrict which components agents may load.
ASI06 · Memory & Context Poisoning	Derive memory scope from authenticated identity, separate tenants and retain provenance for stored context.
ASI08 · Cascading Failures	Bound delegation, cap retries and cost, expose action traces and contain failure at each agent boundary.

The Institute’s chief scientist is an official reviewer of the OWASP Top 10 for Agentic Applications and is named in the published documents. Until the reviewer-credit documents are linked directly, see the OWASP announcement.

03 — BUILT WITH THE FIELD

Built with the field

COMMUNITYML Security Committee at LF AI & Data

Cross-functional security work developed through the committee, including collaboration with OpenSSF.

The Linux Foundation publication on risks and practical controls across machine-learning systems.

The agentic application benchmark and the published work for which the Institute's chief scientist served as an official reviewer.

Read more

04 — PRINCIPLE ANCHOR

Principle anchor

This programme implements P08 Safety by Security. Agent mandates and alignment risks also connect it to P01 Human Augmentation by Oversight and P09 Human Alignment by Intent.