# OWASP Agentic Threat Classes to MITRE ATLAS Case Study Crosswalk

An open dataset mapping the two OWASP agentic threat class lists onto MITRE ATLAS case study IDs, inheriting MITRE's own machine readable `type` verdict (`Incident` or `Exercise`) rather than inventing a rival evidence grade.

**Publisher:** Stingrai
**License:** [CC BY 4.0](https://creativecommons.org/licenses/by/4.0/)
**Version:** 1.0
**Cut-off date:** 2026-07-28
**Re-check cadence:** monthly

Files:

| File | Description |
| --- | --- |
| `crosswalk.csv` | Flat table, 143 rows, one row per class-to-evidence mapping. |
| `crosswalk.json` | Same rows plus corpus metadata, per-class summary counts, and the revision log. |
| `README.md` | This file. |

Canonical URLs:

- `https://www.stingrai.io/data/owasp-agentic-atlas-crosswalk/crosswalk.csv`
- `https://www.stingrai.io/data/owasp-agentic-atlas-crosswalk/crosswalk.json`

Narrative write-up: `https://www.stingrai.io/blog/owasp-agentic-threat-classes-mitre-atlas-crosswalk`

## Corpus and pinning

The corpus is the MITRE ATLAS data repository, parsed locally at a pinned commit.

```
repo:    https://github.com/mitre-atlas/atlas-data
file:    dist/ATLAS-latest.yaml
commit:  651dad90d3c007e797c89356fa1f4d8732f90c8d
release: ATLAS v2026.06 (tagged 2026-06-30)
```

Parsed totals at that commit:

| Metric | Value |
| --- | --- |
| Total case studies | 63 |
| Graded `Incident` | 18 |
| Graded `Exercise` | 45 |
| Earliest event date | 2016-03-23 |
| Latest event date | 2026-05-07 |
| Techniques | 173 |
| Tactics | 16 |
| Mitigations | 35 |

Reproduce with:

```bash
git clone https://github.com/mitre-atlas/atlas-data
cd atlas-data && git checkout 651dad90d3c007e797c89356fa1f4d8732f90c8d
python3 -c "import yaml,collections; d=yaml.safe_load(open('dist/ATLAS-latest.yaml')); cs=d['case-studies']; print(len(cs), collections.Counter(v['type'] for v in cs.values()))"
```

Note on file selection: `dist/ATLAS.yaml` at this commit is a deprecated v5.6.0 snapshot carrying 57 case studies under the older `case-study-type` key, and its own header states it is no longer updated. This dataset uses `dist/ATLAS-latest.yaml`, the current v6 collection, where the field is named `type` and the values are title-cased. Parse the file locally. Fetching it over HTTP through a summarising intermediary truncates it and has returned a false zero-case-study count.

## The two class lists, and why they are never summed

The two OWASP lists overlap heavily and share an official cross-mapping published by OWASP itself in Appendix A of the Top 10 document. They are reported here as two tables with two separate denominators.

| List | Classes | Version | Published |
| --- | --- | --- | --- |
| OWASP Top 10 for Agentic Applications | 10 (ASI01 to ASI10) | 2026 | 2025-12-09 |
| OWASP Agentic AI Threats and Mitigations | 17 (T1 to T17) | 1.1 | 2025-12 |

**Never sum 10 + 17 into a denominator of 27.** Memory poisoning, tool misuse, rogue agents, supply chain compromise, and identity abuse all appear in both lists.

The Threats and Mitigations taxonomy is frequently cited as a list of 15. That was true of version 1.0 (February 2025). Version 1.1 (December 2025), the copy currently served from the OWASP resource page, adds **T16 Insecure Inter-Agent Protocol Abuse** and **T17 Supply Chain Compromise** to synchronise the taxonomy with the Top 10. This dataset uses 17.

## Pre-registered mapping rule

Stated before the tables were built, and not relaxed afterwards:

> A class is credited against an ATLAS case study **only** where the ATLAS record explicitly describes the mechanism defining that class, evidenced by a **verbatim quoted sentence stored in the cell**. No quote, no mapping.

Every quote in `evidence_quote` was verified programmatically as a genuine substring of the ATLAS record's `description` field at the pinned commit. The build fails closed: a quote that does not match aborts the run rather than emitting an unverified row.

## Verdict inheritance

**The evidence verdict on every mapped cell is MITRE's own `type` value, copied and not re-adjudicated.** Stingrai's only judgement in this dataset is the mapping itself, that is, whether a given class's defining mechanism is explicitly described in a given record. Whether that record represents a real-world incident or a research exercise is MITRE's call, reproduced verbatim in `mitre_case_study_type`.

This is deliberate. An independent evidence grade invented by a vendor would be one more thing for a reader to audit. Inheriting MITRE's field means the verdict column is as reproducible as the corpus.

## Excluded field: `actor`

The ATLAS `actor` field is **not** reproduced in this dataset. It carries 51 distinct values across the 63 case studies and is populated predominantly with the **discovering researcher or research team**, not the adversary. Values in the pinned corpus include research teams, `Unknown`, `Two individuals`, and `One individual` alongside genuine threat-group designations such as `APT28` and `Storm-2139`. A column built on that field would read as a threat-group attribution while actually being a mixture of attribution and credit, so it is omitted rather than published with a caveat.

## Negative findings

Negatives are always rendered as **"no qualifying ATLAS entry or primary receipt found in the pre-registered corpus as of 2026-07-28"**. This dataset never claims a class has never been observed in the wild. Absence from ATLAS is evidence about ATLAS's coverage, not about the world.

Two classes carry no qualifying entry:

- **T7 Misaligned & Deceptive Behaviors** is defined by misalignment arising "without direct malicious input". Every ATLAS case study in the pinned corpus has an identified adversary supplying that input, so none satisfies the rule.
- **T10 Overwhelming Human in the Loop** has no record in the pinned corpus that explicitly describes defeating or saturating a human review step as the mechanism of compromise.

## The unindexed column

`not_indexed_as_of` and `atlas_submission_candidate` flag events that carry primary receipts but have no ATLAS record at the pinned commit. These are candidates for ATLAS submission, not criticisms of ATLAS.

The pinned corpus has a latest event date of 2026-05-07 and a collection modified date of 2026-05-27. Anything after that window **cannot** be indexed yet. Most of the unindexed column is publication lag, not an editorial gap.

| Event | Date | Status |
| --- | --- | --- |
| ATT&CK Campaign C0062 / GTG-1002 | 2025-09 | Indexed by MITRE in ATT&CK as a Campaign, absent from ATLAS |
| Hugging Face security incident | 2026-07-16 | Post-dates the corpus |
| JADEPUFFER agentic ransomware | 2026-07-01 | Post-dates the corpus |

### Correction to a commonly listed candidate

**PROMPTSTEAL is already indexed.** It was checked as an unindexed candidate and found to be present as **AML.CS0044**, under its CERT-UA alias **LAMEHUG**. Google Threat Intelligence Group tracks it as PROMPTSTEAL; CERT-UA tracks it as LAMEHUG; ATLAS indexes the CERT-UA name. Anyone crosswalking vendor malware names against ATLAS should resolve aliases before recording a gap.

## Schema

| Column | Description |
| --- | --- |
| `taxonomy` | `ASI_TOP10_2026` or `THREATS_MITIGATIONS_V1_1` |
| `class_id` | `ASI01` to `ASI10`, or `T1` to `T17` |
| `class_title` | Verbatim OWASP class title |
| `evidence_kind` | `atlas_case_study`, `unindexed_primary_receipt`, or `no_qualifying_entry` |
| `atlas_case_study_id` | ATLAS ID, for example `AML.CS0047` |
| `atlas_case_study_name` | Verbatim ATLAS case study name |
| `mitre_case_study_type` | **Inherited from MITRE.** `Incident`, `Exercise`, or `not adjudicated by MITRE` |
| `event_date` | ATLAS `date` field, or the disclosure date for unindexed rows |
| `evidence_quote` | Verbatim sentence evidencing the mechanism |
| `source_url` | ATLAS study URL, or the primary receipt URL |
| `not_indexed_as_of` | Cut-off date, populated on unindexed and negative rows |
| `atlas_submission_candidate` | `yes` or `no` |
| `note` | Scoping caveats, including every retained borderline mapping |

## Summary counts at v1.0

Reported against two separate denominators. These counts were frozen before any summary prose was written about them.

| List | Incident-backed | Exercise-only | No qualifying entry |
| --- | --- | --- | --- |
| ASI Top 10 (denominator 10) | 7 | 3 | 0 |
| Threats and Mitigations v1.1 (denominator 17) | 12 | 3 | 2 |

The three ASI classes that are exercise-only are ASI07 Insecure Inter-Agent Communication, ASI08 Cascading Failures, and ASI09 Human-Agent Trust Exploitation.

13 of the corpus's 18 incident-graded case studies and 27 of its 45 exercise-graded case studies are cited at least once.

## Revision log

| Date | Version | Change |
| --- | --- | --- |
| 2026-07-28 | 1.0 | Initial publication. Corpus pinned at ATLAS v2026.06, commit `651dad90d3c007e797c89356fa1f4d8732f90c8d`. |

## Citation

```
Stingrai (2026). OWASP Agentic Threat Classes to MITRE ATLAS Case Study Crosswalk, v1.0.
CC BY 4.0. https://www.stingrai.io/data/owasp-agentic-atlas-crosswalk/crosswalk.csv
```

## Attribution of upstream sources

- MITRE ATLAS, `https://atlas.mitre.org`, data at `https://github.com/mitre-atlas/atlas-data`.
- OWASP Top 10 for Agentic Applications 2026 and OWASP Agentic AI Threats and Mitigations v1.1, OWASP GenAI Security Project, `https://genai.owasp.org`. The Threats and Mitigations document is licensed CC BY-SA 4.0.

Class titles and case study names are reproduced for identification. Verdicts are MITRE's. Mappings are Stingrai's.