AI Agent Security Series: 2. Deriving the Attack Surfaces
In December 2025, OWASP released the 2026 edition of its Agentic Applications Top 10 [1], consolidating the threats to agentic applications into a standard list; the derivation below uses it as a reference. The first article took the agent runtime apart into six layers and two components and left behind two structural facts: structural fact 1 is that all external content converges at assembly into one flat token stream with no provenance markers, and structural fact 2 is that the permission checkpoint covers only the model-to-action segment, so content ingestion and configuration loading never pass through it. Derived along that structural diagram, the attack surfaces differ from the threat list: their value lies in testability, in that any new vulnerability or new technique can be located on one of the attack surfaces, while whatever fails to locate exposes a gap in the structural diagram, and both outcomes advance understanding. ...