FRAMEWORK / SECURITY
MLSecOps & Agentic Security
The Institute's security programme spans the MLSecOps Top 10 for the machine-learning lifecycle, collaboration with the Linux Foundation and OpenSSF on ML security practice, and active review of OWASP guidance for agentic systems. Machine-learning security remains relevant when the system starts calling tools.
01 — THE MLSECOPS TOP 10
The MLSecOps Top 10
MLSecOps is the application of security practices across the machine-learning lifecycle, connecting risks in data, model artifacts, pipelines, deployment and monitoring to practical controls. The Top 10 maps common machine-learning security failures to controls that teams can apply across those workflows, with code and worked examples maintained in the open-source fml-security repository.
| OWASP vulnerability | MLSecOps equivalent |
|---|---|
| Broken access control | Unrestricted model endpoints |
| Cryptographic failures | Access to model artifacts |
| Injection | Artifact exploit injection |
| Insecure design | Insecure ML systems and pipeline design |
| Security misconfigurations | Data and ML infrastructure misconfigurations |
| Vulnerable and outdated components | Supply-chain vulnerabilities in ML code |
| Identification and authentication failures | IAM and RBAC failures for ML services |
| Software and data integrity failures | ML infrastructure, ETL and CI/CD integrity failures |
| Logging and monitoring failures | Observability, reproducibility and lineage failures |
| Server-side request forgery | ML server-side request forgery |
02 — THE AGENTIC FRONTIER
The agentic frontier
The MLSecOps taxonomy covers the lifecycle around models. Agentic systems add delegated authority, tools and memory to the attack surface. The OWASP Top 10 for Agentic Applications names these risks through the ASI taxonomy, and the Institute's founder is an official reviewer of it, named in the published documents; until those reviewer-credit documents are linked directly, see the OWASP announcement. The selected mappings below position these risks against principle-led controls without reproducing the full OWASP list.
| Selected OWASP ASI category | Principle and control framing |
|---|---|
| ASI01 · Agent Goal Hijack | Constrain mandates, separate external content from instructions, and gate consequential actions under P01 and P09. |
| ASI03 · Identity & Privilege Abuse | Give each agent a distinct identity, least-privilege credentials and fail-closed policy gateways. |
| ASI04 · Agentic Supply Chain Vulnerabilities | Verify models, tools and dependencies, record provenance and restrict which components agents may load. |
| ASI06 · Memory & Context Poisoning | Derive memory scope from authenticated identity, separate tenants and retain provenance for stored context. |
| ASI08 · Cascading Failures | Bound delegation, cap retries and cost, expose action traces and contain failure at each agent boundary. |
03 — BUILT WITH THE FIELD
Built with the field
Cross-functional security work developed through the committee, including collaboration with OpenSSF.
Read morePUBLICATIONMachine-learning security risks and best practicesThe Linux Foundation publication on risks and practical controls across machine-learning systems.
Read moreOWASPTop 10 for Agentic ApplicationsThe agentic application benchmark and the published work for which the Institute's founder served as an official reviewer.
Read more04 — PRINCIPLE ANCHOR
Principle anchor
This programme implements P08 Safety by Security. Agent mandates and alignment risks also connect it to P01 Human Augmentation by Oversight and P09 Human Alignment by Intent.