T19 · Helmwart ID · OWASP MAS Guide source
A flaw in a programmable agent workflow definition causes the pipeline to skip critical validation steps or run steps out of order, even when each individual tool works correctly.
ExtendsT2: Tool Misuse · base threat in OWASP v1.1 catalog
A Robotic Process Automation (RPA) agent, due to a flaw in its workflow definition within the agent framework, executes steps in an incorrect order or skips critical validation steps entirely. The threat is distinct from T2 Tool Misuse. It is not about misusing a specific tool, but about the incorrect execution of the overall workflow. The workflow definition file or configuration is the attack surface.
An RPA expense reimbursement agent is designed to execute three sequential steps: (1) extract structured data from the claim, (2) validate the data against company policy, (3) submit the approved claim for payment. A bug in the workflow graph (an incorrectly wired conditional branch or a missing guard condition) causes step 2 to be skipped when the claim amount falls below a certain value. Claims under that threshold are submitted directly for payment, bypassing the policy validation gate entirely.
The bug may be latent through normal test cases and surface only on specific input shapes encountered in production, by which time irreversible payment actions have already been committed.
Agentic workflows are defined programmatically and executed autonomously, without a human reviewing the step sequence before each run. The gap between intended and actual execution is invisible without step-level audit logging. In a multi-agent pipeline where the RPA agent’s output feeds a payment agent or approval agent, a skipped validation step produces a downstream cascade: the payment agent receives a claim that was never validated and processes it as authorised. State inconsistency between agents (T21) can also compound the effect when the validation agent’s result was never written before the routing agent read it.
The clearest signal for T19 is an absent step-completion event: a workflow audit log where the expected sequence of step identifiers has a gap.
step_1_complete directly to step_3_complete with no step_2_complete event in between. Alert on any workflow run where a declared mandatory step ID is missing from the event sequence.policy_validation_result field in its state record: query the state store on each payment submission and reject if the validation field is absent or null.workflow_run record whose total elapsed time is shorter than the minimum expected duration for a three-step pipeline (establish a floor from historical runs; alert on any run completing below the 5th-percentile duration).T19 extends T2 Tool Misuse. Where T2 focuses on individual tool invocations being misused, T19 operates at the orchestration level: the workflow engine itself executes the wrong sequence, bypassing the validation tools that should have been called. T21 (Inconsistent Workflow State) is the companion threat where the wrong step is taken because state synchronisation fails between agents rather than because the workflow graph is miswired.
The Agentic Top 10 (ASI01 through ASI10) is a separate practitioner-facing publication that maps onto the master Threats & Mitigations threat numbering. T19 is covered by the following Top 10 entries:
An attacker manipulates an agent's objective, task selection, or decision pathway (via injected prompts, deceptive tool outputs, forged peer messages, or poisoned retrieval data) so that the agent pursues the attacker's goal rather than the operator's. Unlike a single-turn injection, the harm compounds across many authorised steps before any drift is visible.
An agent applies authorised tools in ways their operator did not intend, driven by prompt injection, misaligned reasoning, or manipulated tool outputs. Every individual call looks clean; the harm is in the sequence: data exfiltrated via successive reads, workflows hijacked by parameter tampering, or a legitimate API weaponised across turns.
Source: OWASP Top 10 for Agentic Applications 2026 (Dec 2025) · the Top 10 is a compass into the master Threats & Mitigations taxonomy, not a replacement for it.
When T19 is present, these security design principles are the ones being violated or tested. Each links to the full principle; the mitigations below are how you restore them.
Auto-generated from the mitigation catalog: every mitigation whose coverage map includes T19, sorted by maturity tier (Tier 1 production-canonical first, then Tier 2, then Tier 3 research-stage).
A plan-then-execute agent produces a sequence of steps before acting. If the planner is manipulated, it will emit steps that serve the attacker's goal rather than the user's. Plan-vs-goal validation addresses this by placing an independent validator between the planner and the execution loop: it evaluates each proposed step against the originally-declared goal before the agent is permitted to act on it.
why it helps Unintended Workflow Execution is the triggering of a workflow the user did not sanction, often by constructing a plan step whose effect is a workflow invocation. Plan validation catches this at the step layer: a step that initiates an unsanctioned workflow is evaluated against the declared goal and flagged as goal-divergent before the workflow starts.
An agent's authority is normally bounded only by its own reasoning. If that reasoning is manipulated, or the agent's identity is compromised, it will attempt actions the operator never intended to permit. Policy-bound autonomy addresses this by placing a declarative enforcement point between the agent and every consequential action: a policy engine evaluates the agent identity, the target tool, and the parameter envelope before execution, and the agent cannot reason or argue past the result.
why it helps Unintended Workflow Execution is an agent initiating a workflow it was not explicitly directed to start. A policy rule that maps each workflow-initiation action to a permitted set of agent roles blocks any agent from triggering a workflow outside its declared scope, so the unauthorised initiation is refused at the enforcement point rather than discovered after the fact.
When multiple agents read and write shared workflow state concurrently, a network partition, a delayed message, or an adversarially timed race condition can produce divergent views. An agent acting on stale or conflicting state may authorise an action it would reject given correct current state. Hash-chained state snapshots, merge-point conflict detection, and optimistic concurrency control close that window.
why it helps Unintended workflow execution allows a step to be advanced before its required predecessor state is complete. An explicit state-transition gate at each step means a workflow step cannot be initiated until the predecessor state has been committed and verified, blocking the jump-ahead scenario.
MITRE ATLAS catalogues adversary techniques against AI systems. Where this OWASP threat has an attacker-perspective counterpart, the ATLAS technique is shown below. That is what a red team would actually be doing on the wire. Use this for detection-signal anchoring, threat-hunting hypotheses, and IR runbooks. Source: mitre-atlas/atlas-data v5.6.0.
© 2026 The MITRE Corporation. ATLAS content is reproduced and distributed with the permission of The MITRE Corporation.
AML.T0053AI Agent Tool Invocationview on ATLAS ↗Adversary causes an agent to invoke a legitimate tool with attacker-controlled parameters, turning a sanctioned capability into an attack vector.
Agentic angle: Maps directly to OWASP T2 Tool Misuse: the agent's tools are operating within their declared scope, but the chosen invocation is unsafe.
AML.T0081Modify AI Agent Configurationview on ATLAS ↗Adversary alters an agent's configuration (system prompt, tool list, allowed actions, persona) to change its behaviour without retraining.
AML.T0067LLM Trusted Output Components Manipulationview on ATLAS ↗Adversary manipulates the structured parts of an LLM response (citations, tool-call arguments, approved-action markup) that downstream systems treat as trusted.
Agentic angle: Structured outputs are exactly what agent frameworks parse to decide what to execute. Undermining the structure undermines every safety check downstream.
Adapted by Helmwart from the OWASP source(s) above underCC BY-SA 4.0(changes: normalized IDs, added MAESTRO-layer, agentic-factor, and mitigation mappings). This entry is licensed CC BY-SA 4.0.
Press play. The voice downloads once, then it’s cached.
On-device · private