Defender Impact
For the first time, defenders have an authoritative, architecture-aware containment playbook for agentic AI systems — moving the conversation beyond “turn off the model” to a tested sequence that addresses workflow state, credential validity, tool access, and network reachability as distinct control surfaces. This closes a gap that has grown increasingly urgent as organisations deploy AI agents with real tool integrations and persistent identities.
Capability Overview
The OWASP GenAI Security Project’s October 2026 roundup formalises what it means to stop an AI agent that is behaving outside its intended scope. The core insight is architectural: an AI agent is not a monolithic process but a composition of a model endpoint, an orchestrator managing workflow state, an identity supplying credentials, tools or APIs executing actions, and network paths determining connectivity. Disabling any single layer does not guarantee containment across the others.
The playbook sequences containment across four layers:
- Workflow suspension — stop active runs and suspend triggers, retries, and queued jobs. Critically, this is distinct from stopping the model endpoint; queued jobs may continue processing via an orchestrator even when the model is offline.
- Credential revocation — invalidate the specific tokens and credentials the agent was using. The roundup notes that revoking one credential does not automatically invalidate separate tokens or already-established sessions.
- Tool and integration disablement — remove the agent’s access to connected APIs, plugins, and data stores.
- Network restriction — apply network-layer controls to prevent established connections from completing in-flight work.
The roundup also defines a signal taxonomy: unexpected tool or resource calls, unusual read/write/export volumes, workflows continuing after an operator believes they have been paused, unexpected credential or integration use, and log activity that does not match baseline behaviour. Importantly, the framework cautions that a log entry showing an attempted action does not confirm the action succeeded — a distinction critical for accurate incident scoping.
Defensive Advances
- Tested kill-switch design: Security teams can now design and validate containment sequences against a published reference model rather than improvising under incident pressure.
- Anomaly signal catalogue: The enumerated behavioural signals provide a direct input to detection engineering — these can be translated into SIEM rules, alert policies, or agent monitoring dashboards.
- Evidence hygiene guidance: The directive to cross-correlate agent logs with identity-provider, API, application, and network records reduces over-reliance on agent-generated logs, which may themselves be incomplete or manipulated.
- Scope-testing methodology: The recommendation to explicitly test whether containment revokes both credentials and network access gives red and blue teams a reproducible validation exercise they can run against any agentic deployment.
Residual Gaps
The roundup is explicitly a selected collection, not an exhaustive survey, and the playbook is architecture-dependent — the right containment sequence varies by deployment. Several maturity questions remain:
- Tooling integration: No vendor-neutral automated containment primitive exists yet. Teams must manually stitch together workflow orchestrator controls, identity provider APIs, and network policy enforcement, which requires significant platform engineering maturity.
- Orchestrator diversity: The playbook’s applicability varies significantly across orchestration platforms. Teams using different frameworks will need to adapt the sequence, and coverage guidance for specific platforms is absent.
- Detection baseline establishment: The signal taxonomy is only actionable if organisations have already established normal behaviour baselines for their agents — a prerequisite that many early-stage deployments have not completed.
- Log availability: Cross-layer log correlation assumes that identity-provider, API, and network logs are centralised and queryable. Many organisations deploying agentic AI have not yet extended their SIEM coverage to these new surfaces.
Framework Mapping
- AML.T0086 (Exfiltration via AI Agent Tool Invocation) and AML.T0083 (Credentials from AI Agent Configuration): The containment playbook directly addresses scenarios where an agent has used tool invocations or harvested credentials to perform unauthorised actions.
- LLM08 (Excessive Agency): The framework is a direct operational response to the Excessive Agency risk category, providing the detection and response layer that OWASP’s design guidance alone does not supply.
- LLM01 (Prompt Injection): The signal taxonomy includes inputs that may indicate prompt injection — unexpected tool calls and out-of-scope resource access are canonical post-injection behaviours.
Deployment Considerations
Organisations should begin by mapping their existing agentic deployments against the four containment layers to identify which are currently addressable and which require new controls. Priority should go to credential revocation automation — this is the layer most likely to be incomplete in early deployments. Network restriction controls should be pre-staged rather than improvised during an incident. Teams should treat prompt-based stop instructions as communication, not containment — the playbook is explicit that telling an agent to stop is not a control.
Defender Checklist
- Audit each agentic deployment against all four containment layers: workflow, credential, tool, and network
- Automate credential revocation paths for agent identities in your identity provider
- Extend SIEM ingestion to cover agent orchestrator logs, API gateway logs, and identity-provider audit trails
- Establish behavioural baselines for each deployed agent to make the OWASP signal taxonomy actionable
- Run a containment drill to verify that revoking credentials also invalidates active sessions and queued work
- Document the correct containment sequence for each deployment architecture before an incident occurs
- Validate that network restriction controls can be applied to agent tool connections independently of broader service disruption