Topic starter
05/07/2026 6:54 pm
TL;DR: CVSS alone does not capture how agentic systems amplify risk once autonomy, tool use, and multi-agent coordination are involved, according to Lakera’s analysis of OWASP’s AIVSS. The practical shift is to score vulnerability severity in the context of agent behaviour, not just code weakness, because access, memory, and runtime action can turn moderate issues into material exposure.
Editorial analysis by NHI Mgmt Group, based on content published by Lakera: “Why We Need OWASP’s AIVSS: Extending CVSS for the Agentic AI Era”.
Key questions
Q: What breaks when CVSS is used alone for agentic AI systems?
A: CVSS breaks when the system can act, choose tools, and continue without human gating, because severity is no longer just a property of the code.
Q: Why do agentic AI vulnerabilities need a separate severity model?
A: They need one because autonomy changes the impact of a flaw at runtime.
Q: What signals show that an agentic AI risk score is too low?
A: A score is too low when the agent can reach external tools, delegate work to other agents, or turn a narrow defect into a chained action path.
Practitioner guidance
- Score agent behaviour separately from code severity Use CVSS as the starting point, then add a behaviour layer for autonomy, memory, tool access, and multi-agent coordination before setting prioritisation.
- Review tool permissions as part of severity analysis Document which tools an agent can invoke, which actions those tools expose, and whether a moderate code flaw becomes high impact once tool execution is available.
- Map cascading agent dependencies Identify where one agent’s output feeds another agent’s decision path, then score those chains as a single risk surface rather than isolated events.
Bottom line: Agentic AI makes vulnerability scoring a behaviour problem as much as a code problem, because autonomy and tool use can magnify ordinary flaws.
Explore further
View Full Forum → | NHI Foundation Course → | Our Services → | Read the full analysis →
05/07/2026 7:16 pm
CVSS alone is structurally incomplete for agentic AI. The score was built for software weakness, not for systems that can choose tools, sequence actions, and continue without human gating. Once an agent can improvise at runtime, the vulnerability no longer behaves like a static code issue, so the risk score must reflect behaviour as well as defect severity. Practitioners should treat this as a scoring-model boundary, not a tuning problem.
A few things that frame the scale:
- Only 13% of organisations feel extremely prepared for the reality of agentic AI despite the majority racing toward autonomous adoption, according to the 2026 Infrastructure Identity Survey.
A question worth separating out:
Q: How should teams decide whether to trust a CVSS score for AI agents?
A: Use CVSS only when the agent behaves like a conventional application with tightly bounded actions. If the system can improvise, retain memory, or coordinate across agents, CVSS should be treated as incomplete and supplemented with agentic behaviour scoring before prioritisation.
👉 Read our full editorial: Why OWASP's AIVSS changes risk scoring for agentic AI