OWASP Top 10 for Agentic Applications — как это сопоставлено с тестами BitEvo

The attempted action and the rule that allowed or refused it

We test what a hijacked agent can still do, not whether the model resists injected text

The object ID checked before execution, and the ID that actually changed

Core scope

The grant or approval record that links the role to the action

Core scope

Which third-party tools and MCP servers can act, and with what permissions

We map their authority; we do not audit their code

Whether code execution is an allowed action at all, and for which inputs

Exploit development is out of scope

Time, source and version of each item the agent relied on at decision time

We test whether stale or unverified context can trigger an action

Who delegated authority between agents, and independent confirmation of the effect

Within the one workflow in scope

The state change when confirmation is missing, and who released the workflow

Core scope: retries, resume, duplicate effects

Whether "done" was reported before the external system confirmed it, and what the approver was shown

We test approval evidence, not user training

Actions outside the agreed budget, and the stop or constrained state that follows

Detection tooling is out of scope