The OWASP AI red teaming landscape and the new security stack

At a glance

What this is: NHI Mgmt Group's analysis, drawing on Lasso Security's blog post: OWASP's latest agentic AI red teaming landscape requires security teams to test behaviour, not just code, because AI systems can be manipulated through tools, memory, data and chained agent interactions.

Why it matters: For IAM, PAM and identity teams, the message is that agent permissions, runtime trust boundaries and delegated tool access now need continuous governance, not one-time validation.

Context

Traditional application security assumes a system is mostly deterministic, with stable inputs, stable outputs and controls that can be validated at build time. Agentic AI breaks that assumption because behaviour changes with prompts, tools, context, memory and runtime decisions, which means the security problem shifts from code defects to execution paths.

For identity and access programmes, that shift matters because agents do not merely consume credentials, they use them to act across tools, APIs and shared contexts. The question is no longer whether the model is safe in isolation, but whether delegated access, tool permissions and trust boundaries remain governable once the system starts chaining actions.

The article treats OWASP’s Q2 2026 Agentic AI Red Teaming Landscape as evidence that security for AI now has to be lifecycle-based and behaviour-led. That is an atypical starting position for most enterprise security programmes, which still separate testing, runtime monitoring and governance into different control planes.

Key questions

Q: What breaks when agentic AI is governed like a normal application account?

A: Security controls break down because agentic systems do not behave like fixed-function applications. They can choose actions at runtime, combine tools in unexpected ways, and move faster than periodic review cycles. That means static roles, annual recertification, and one-time approvals do not fully describe the risk or contain the behaviour.

Q: Why do excessive permissions create more risk in agentic AI systems?

A: Excessive permissions raise risk because agents can act autonomously, chain tool calls, and trigger downstream systems faster than a human can intervene. If an agent can read, write, or execute broadly, a small prompt manipulation can become data exposure, account misuse, or infrastructure change. Tight task-scoped access limits what compromise can achieve.

Q: How do security teams know if agentic AI controls are failing?

A: The main signs are session drift, repeated retry loops, unauthorized tool calls, and behaviour that diverges from the documented task sequence. If the agent keeps moving through steps after intent-to-tool alignment weakens, the system is drifting beyond its control envelope. In practice, teams should measure the full execution path, not isolated prompts.

Q: What governance model fits agentic AI better than traditional app security reviews?

A: A lifecycle model fits better because the risk evolves from planning through deployment and operation. Traditional reviews are too episodic for systems that change with data, tools and runtime decisions. The stronger model combines adversarial testing, live monitoring and governance evidence so security remains aligned with the system as it changes.

Technical breakdown

Why agentic AI needs behavioural red teaming

Agentic AI changes the attack surface because the system can choose tools, sequence actions and carry context forward across steps. That creates failure modes such as tool poisoning, cross-agent prompt injection, memory manipulation and privilege escalation inside agent chains. Traditional testing is weak here because a single prompt is not the whole attack; the exploit often emerges over multiple turns and across multiple tools. The useful unit of analysis is the execution path, not the isolated model output.

Practical implication: test end-to-end agent execution paths, not just prompt responses.

How lifecycle security differs from pre-production validation

The OWASP landscape frames security as a lifecycle, spanning planning, data adaptation, development, testing, deployment and continuous governance. That matters because AI risk is not confined to release time. Poisoned training data, malformed retrieval content and unsafe tool descriptions can alter behaviour later, while runtime controls must still catch abuse after deployment. Security teams therefore need traceability between adversarial scenarios, detected weaknesses and live controls, or the programme fragments into disconnected activities.

Practical implication: connect red-team findings to runtime enforcement and governance evidence.

Why runtime protection becomes part of the control plane

In agentic systems, runtime protection is not an optional monitoring layer. Once agents can call APIs, interact with tools and operate across trust boundaries, the defence has to act at the same speed as the system. That is why the article emphasises AI firewalls, policy enforcement and real-time monitoring in the execution path. The control problem is no longer simply detection after the fact; it is preventing unsafe agent actions before they complete.

Practical implication: place policy and inspection controls where agent actions are executed.

NHI Mgmt Group analysis

Behaviour, not code, is now the primary security boundary for agentic AI: OWASP’s landscape reflects a deeper shift than better testing guidance. The core risk is that agentic systems fail through execution, sequencing and tool use, not just malformed inputs or weak model responses. That means security teams must stop treating AI as a static application problem and start governing the runtime behaviour of systems that can act across trust boundaries.

Identity assumptions break once an agent can act, re-plan and chain tools: least privilege was designed for access that is assigned, reviewed and understood in advance. That assumption weakens when an agent can choose actions at runtime, reuse context and combine permissions in ways the original provisioning decision never anticipated. The implication is that identity governance has to account for action paths, not only entitlement sets.

Continuous red teaming is becoming the practical control model for agentic systems: one-off validation does not hold up when data, tools and context continuously change system behaviour. OWASP’s lifecycle framing makes the case for treating testing, runtime monitoring and governance as one loop rather than separate functions. Practitioners should read that as a signal that evidence of control effectiveness must be continuous, not episodic.

Tool poisoning and cross-agent manipulation create a new governance concept: behavioural trust debt: every shared tool, delegated permission and reused context adds hidden exposure that accumulates across the agent chain. The article shows that risk is not just whether a tool is allowed, but whether the surrounding execution model can still be trusted after repeated interactions. For identity programmes, behavioural trust debt becomes the measure that matters.

Agent chains turn access control into an orchestration problem: when one agent can influence another, the security boundary is no longer a single identity or a single policy decision. The governance question shifts to who can influence execution, what context is shared, and how privilege propagates across agents and tools. Practitioners need to evaluate the whole chain, because the weakest hop defines the real control surface.

From our research library:

• Only about one-third of approximately 500 organizations surveyed by McKinsey in 2026 report maturity level three or higher across agentic AI governance controls.
• Read next: Agentic AI Identity Maturity Model

What this signals

Behavioural trust debt: each shared tool, delegated permission and reused context increases the amount of agent risk that sits outside traditional access review cadences. That is why identity and security teams need to shift from entitlement snapshots to continuous observation of what agents actually do at runtime.

The next programme question is not whether an AI system has access, but whether it can be governed after access is granted. In practice, that means aligning agent permissions, monitoring and policy enforcement so that runtime behaviour can be verified, not merely assumed.

69% of security leaders agree identity management must fundamentally shift to address agentic AI systems, according to the 2026 Infrastructure Identity Survey. That sentiment reflects a broader move from static identity controls to behavioural governance for autonomous execution.

For practitioners

• Test complete agent execution paths Build red-team scenarios around tool poisoning, cross-agent prompt injection and multi-turn manipulation so you can observe how agents behave when context changes over time.
• Map delegated permissions to runtime actions Inventory which tools, APIs and data sources each agent can touch, then compare that to the actions the agent can trigger without human approval.
• Add runtime policy enforcement at the execution layer Place inspection and blocking controls where agent actions are actually executed, so unsafe calls can be stopped before they complete.
• Create a closed loop between testing and monitoring Feed adversarial findings into live detections, guardrails and governance reporting so security controls improve as the system changes.

Key takeaways

• Agentic AI creates security failure modes that emerge during execution, not only in code or model outputs.
• The article shows that behaviour-driven red teaming, runtime policy enforcement and lifecycle governance are now part of one control loop.
• For practitioners, the main shift is to govern tool use, context reuse and cross-agent influence as access risks, not just application risks.

Key terms

• Agentic AI Red Teaming: Agentic AI red teaming is the practice of testing autonomous AI systems for unsafe behavior, misuse, and control failures. It uses adversarial scenarios to probe how an agent plans, acts, calls tools, handles prompts, and responds to manipulation, with attention to identity, authorization, data exposure, and unintended actions.
• Behavioral Attack Surface: The part of an AI system exposed through decisions, tool calls, memory, and orchestration rather than code alone. It matters because attackers can shape what the system does, not just what it says, which makes runtime governance a core security requirement.
• Cross-Agent Prompt Injection: Cross-agent prompt injection occurs when one agent manipulates another through shared context, tool output or orchestration layers. It is especially relevant in multi-agent systems because trust is transferred between components, allowing malicious instructions to spread across otherwise separate workflows.
• Behavioural Trust Debt: Behavioural trust debt is the hidden risk created when a system relies on historical account behaviour as proof of present safety. Over time, that trust accumulates, and an attacker who compromises the account later can exploit the account's established normality to make malicious actions look legitimate.

Deepen your knowledge

NHI governance, agentic AI identity, and machine identity lifecycle are core topics in our NHI Foundation Level course, the industry's only accredited NHI security programme. If you are building or maturing an IAM programme, it is worth exploring.