Applying the OWASP Top 10 for Agentic Applications to Your AI Agents - Will Velida - NDC Oslo 2026
Title history
- Applying the OWASP Top 10 for Agentic Applications to Your AI Agents - Will Velida - NDC Oslo 2026 — observed on 20261028-0955 UTC (YouTube)
Keywords
Summary
173 words
Critical Evaluation
Value of the Information & Strength of the Argument
The talk provides high-value, practical information for securing AI agents. The argumentation is strong, supported by real-world examples and live demonstrations. The speaker effectively bridges the gap between theory (OWASP Top 10) and implementation, offering actionable controls and best practices. The emphasis on treating LLM output as untrusted and implementing layered security is well-argued and grounded in concrete scenarios. The demonstrations illustrate the vulnerabilities and the mitigations clearly, making the content both engaging and instructive.
Scientific Rigor, Source Quality, Title Accuracy
The sources referenced include OWASP (the framework) and Microsoft’s own tools and documentation, which are credible for the topic. The talk is based on the speaker’s expertise and practical experience. The title is perfectly aligned with the content, as the talk systematically applies each applicable OWASP risk to the speaker’s health agent example. No audience comments were provided, so no analysis was performed.
153 words
Title / Content Match
The title accurately reflects the content, which applies the OWASP Top 10 for Agentic Applications to AI agents with concrete examples and mitigations.
Quality & Reliability
8/10
Presentation by a Microsoft senior software engineer with practical demos and references to OWASP, but not peer-reviewed.
Key Moments
Markers derived by PSI from the transcript: the creator did not define chapters.
- Addressing the elephant in the room: recent AI safety concerns and realistic threat landscape.
- Introduction of recent attacks: GitSpy, Dead Bugs, and Hugging Face incident.
- Overview of the OWASP Top 10 for Agentic Applications and its five pillars: inputs, processing, memory, tools, outputs, and human oversight.
- Demo: Goal hijacking attack on an invoice review agent and mitigation using prompt shields in Microsoft Foundry.
- Discussion on tool misuse and exploitation, including cipher and policy enforcement with middleware.
Cited Sources
- NDC Conferences — The conference website where the talk was recorded.
- NDC Oslo — The specific NDC Oslo event page.
Concurring Sources
- OWASP Top 10 for Large Language Model Applications — The OWASP project that the agentic version is based on, providing similar risk categories and mitigations.
Contribution & Novelties
The talk contributes practical, actionable advice on applying OWASP Top 10 for Agentic Applications to real AI systems, using concrete examples and demonstrations. It stresses the importance of treating all natural language inputs as untrusted and implementing layered security controls such as goal immutability, least-privilege identities, and policy enforcement. The speaker’s use of a personal health agent case study makes the concepts relatable and directly applicable.
Pour aller plus loin :
- OWASP Top 10 for LLM Applications — The broader OWASP framework for LLM security, foundational to the agentic version.
- Microsoft Agent Governance Toolkit (no URL provided due to uncertainty) — An open-source toolkit for enforcing policies and auditing agent actions.
- Prompt injection attacks on Wikipedia — A general reference on the attack technique that underlies many of the risks discussed.
131 words
Radar Profile
The radar profile shows consistently high scores across all dimensions, indicating a technically deep, well-sourced, and reliable presentation with ample information. The talk balances quality and quantity effectively, making it a strong resource for practitioners.