What happened
On August 17, 2026, following Black Hat USA and DEF CON 2026, the OWASP GenAI Security Project released version 1.0 of the Agentic Skills Top 10 — a new taxonomy of ten security risks (AST01–AST10) specific to 'skills' (reusable instruction/resource bundles that AI agents can discover, load, and run autonomously, e.g. Claude Code/OpenClaw skills). The risks cover the skill lifecycle: Malicious Skills, Supply Chain Compromise, Over-Privileged Skills, Insecure Metadata, Untrusted External Instructions, Weak Isolation, Update Drift, Poor Scanning, No Governance, and Cross-Platform Reuse. The document is grounded in confirmed incidents (the January 2026 ClawHavoc campaign that pushed 1,184 malicious skills, a USENIX Security 2026 study of 98,380 skills finding 157 malicious with 632 vulnerabilities, and a 96,096-skill corpus reporting 751 malware findings), maps each risk to OWASP AISVS v1.0, the OWASP Agentic Security Initiative (ASI) Top 10, the MCP Top 10, the OWASP LLM Top 10, ASVS, CSA MAESTRO, ISO/IEC 42001, and NIST AI RMF, and ships reference code for signature verification, behavioral sandboxing, dependency pinning, and integrity checking, plus a proposed Universal Skill Format manifest for cross-platform provenance.
Why it matters
Agent 'skills' are a fast-growing, largely unvetted distribution channel — described by the project as having 'npm's reach and none of npm's decade of hard-won security infrastructure.' Skills run with the host agent's full permissions and are plain-language instructions that bypass code-scanning tools, making this a genuinely new attack surface not covered by existing LLM/agentic taxonomies. The release carries endorsements from Microsoft's GM of Security, a NIST research manager, a former Anthropic CISO, and former NSA Cybersecurity Director Rob Joyce, indicating rapid cross-industry recognition as the reference taxonomy for this risk class.
Action needed
Security teams building or operating AI agent platforms (frontier labs, agent marketplaces, enterprise AI platform teams) should map their skill-vetting, sandboxing, and governance controls against AST01–AST10; developers and marketplace operators should adopt signature verification and the proposed Universal Skill Format; treat this as the baseline reference alongside existing OWASP LLM/Agentic Top 10 lists when threat-modeling agent deployments.