Tracking a 4-record pilot mapping submitted to the OWASP GenAI Crosswalk
(GenAI-Security-Project/GenAI-Data-Security-Initiative), which maps
OWASP's own vulnerability lists to third-party frameworks.
PR (external, awaiting maintainer review):
GenAI-Security-Project/GenAI-Data-Security-Initiative#66
Why a manual PR, not their automated classifier submission
Two things ruled out the JSON classifier intake:
- Both documented submission paths (
GenAI-Security-Project/crosswalk
and the web app's Submit-a-Standard form) are non-functional or
404 — confirmed directly, not assumed.
- A spot-check of the crosswalk's existing MITRE ATLAS mappings
against ATLAS's own authoritative data (mitre-atlas/atlas-data's
ATLAS.yaml) found 5 of ~8 checked technique IDs flatly wrong or
nonexistent — including a cited ID that doesn't exist anywhere in
the real 170-technique catalog. Full detail was kept in session
memory rather than filed here since it's about a third party's data
quality, not an AVE defect; happy to write it up properly if useful.
MITRE ATLAS's own entry in that crosswalk came in through the same
hand-authored markdown path, not the classifier — the precedent this
pilot follows.
What was submitted
Four records, each independently re-verified against the OWASP Agentic
Top 10 2026 primary-source PDF's own category text (not by
category-name resemblance, and not by trusting AVE's own existing
owasp_asi tag at face value — all four were untouched by the
owasp_asi audit in #196, which made them the highest-confidence
starting pool, but "untouched by that audit" turned out not to be
sufficient on its own, see below):
| AVE ID |
owasp_asi |
Basis |
| AVE-2026-00054 |
ASI05 |
OWASP's own text uses "sandbox escape" verbatim for this outcome |
| AVE-2026-00062 |
ASI04 |
Matches ASI04's "Pinning"/"Dependency gatekeeping" guidance almost word-for-word |
| AVE-2026-00068 |
ASI02 |
Matches ASI02's "authorized tool used unsafely" framing; no RCE/sandbox element |
| AVE-2026-00074 |
ASI04 |
Matches ASI04's "Impersonation and typo squatting" example |
Two candidates were considered and excluded: AVE-2026-00059 and
AVE-2026-00065 both carry a single ASI01 tag that was untouched by
#196's audit, but re-verification against the primary source found
their mechanisms matched ASI04's own named example scenarios
("Tool-descriptor injection," "Agent-in-the-Middle via Agent Cards")
at least as well as ASI01's — a real ambiguity the internal audit
didn't catch. Both are documented as excluded in the submitted file
itself (Agentic_AVE.md's methodology note) rather than silently
dropped.
Scope discipline
4 of 80 records, 3 of 10 ASI entries (ASI02, ASI04, ASI05). No claim is
made about the other 76 records or 7 entries. More can follow once
this format is confirmed correct by their maintainer — same
pilot-first approach as the OpenCRE submission.
Status
Open PR, needs a review from that repo's maintainer (I don't have
write access and can't self-merge). Will update this issue when it
resolves one way or the other.
Tracking a 4-record pilot mapping submitted to the OWASP GenAI Crosswalk
(
GenAI-Security-Project/GenAI-Data-Security-Initiative), which mapsOWASP's own vulnerability lists to third-party frameworks.
PR (external, awaiting maintainer review):
GenAI-Security-Project/GenAI-Data-Security-Initiative#66
Why a manual PR, not their automated classifier submission
Two things ruled out the JSON classifier intake:
GenAI-Security-Project/crosswalkand the web app's Submit-a-Standard form) are non-functional or
404 — confirmed directly, not assumed.
against ATLAS's own authoritative data (
mitre-atlas/atlas-data'sATLAS.yaml) found 5 of ~8 checked technique IDs flatly wrong ornonexistent — including a cited ID that doesn't exist anywhere in
the real 170-technique catalog. Full detail was kept in session
memory rather than filed here since it's about a third party's data
quality, not an AVE defect; happy to write it up properly if useful.
MITRE ATLAS's own entry in that crosswalk came in through the same
hand-authored markdown path, not the classifier — the precedent this
pilot follows.
What was submitted
Four records, each independently re-verified against the OWASP Agentic
Top 10 2026 primary-source PDF's own category text (not by
category-name resemblance, and not by trusting AVE's own existing
owasp_asitag at face value — all four were untouched by theowasp_asiaudit in #196, which made them the highest-confidencestarting pool, but "untouched by that audit" turned out not to be
sufficient on its own, see below):
Two candidates were considered and excluded:
AVE-2026-00059andAVE-2026-00065both carry a singleASI01tag that was untouched by#196's audit, but re-verification against the primary source found
their mechanisms matched ASI04's own named example scenarios
("Tool-descriptor injection," "Agent-in-the-Middle via Agent Cards")
at least as well as ASI01's — a real ambiguity the internal audit
didn't catch. Both are documented as excluded in the submitted file
itself (
Agentic_AVE.md's methodology note) rather than silentlydropped.
Scope discipline
4 of 80 records, 3 of 10 ASI entries (ASI02, ASI04, ASI05). No claim is
made about the other 76 records or 7 entries. More can follow once
this format is confirmed correct by their maintainer — same
pilot-first approach as the OpenCRE submission.
Status
Open PR, needs a review from that repo's maintainer (I don't have
write access and can't self-merge). Will update this issue when it
resolves one way or the other.