OWASP Global AppSec: New AI vulnerability scoring system unveiled

Securing Agentic AI: Introducing the OWASP AI Vulnerability Scoring System (AIVSS)

The hum of servers almost beat like a heart in the sterile data center, a symphony of processing power.

In the brightly lit war room next door, a project manager beamed, gesturing at a screen displaying an AI agent autonomously optimizing supply chains.

She declared it to be true autonomy.

But in a quieter corner, the lead security architect traced a finger over a complex neural network diagram, a frown etched on their face.

Existing vulnerability reports, clean and green for traditional software, offered little comfort.

How does one measure the risk of a system that learns, adapts, and, in moments of extreme pressure, makes its own decisions?

How does one secure something that is not just running code, but thinking?

This is not just an abstract concern; it is the quiet tremor before a seismic shift in how we approach digital defense.

We are moving beyond predictable threats into a landscape where the very identities and behaviors of our AI agents are fluid, demanding a new kind of vigilance.

At the OWASP Global AppSec conference, Ken Huang, an AI expert, author, adjunct professor, and co-leader of the AIVSS project, stated that traditional threat-modeling frameworks like the Common Vulnerability Scoring System (CVSS) are inadequate to gauge the severity of vulnerabilities in agentic AI (CyberRisk Alliance, 2025).

This is not just an academic debate; it is a foundational challenge to how we protect our most critical digital assets.

As organizations increasingly deploy advanced AI, the gap between rapid innovation and security practices widens, creating unprecedented exposure.

In short: The OWASP AI Vulnerability Scoring System (AIVSS) is a new framework designed to address the unique security risks of agentic AI.

It extends traditional vulnerability scoring (CVSS) by accounting for AI’s non-deterministic nature, autonomy, and dynamic identity management, providing a standardized way to assess and mitigate AI-specific threats.

The Inadequacy of Traditional Security for Agentic AI

For years, cybersecurity professionals have relied on established frameworks like CVSS to quantify the severity of vulnerabilities in software.

These systems are robust, well-understood, and built on the premise of deterministic coding – if a piece of code does X, it will always do X under the same conditions.

Our application security strategies have been honed around this predictability.

But the advent of agentic AI shatters that paradigm.

Huang explained that these frameworks assume traditional deterministic coding, and that dealing with the non-deterministic nature of agentic AI is necessary (CyberRisk Alliance, 2025).

Agentic AI, by design, exhibits a degree of autonomy, allowing it to make choices and interact with its environment dynamically.

This autonomy, while critical for its functionality, introduces a layer of unpredictability that traditional threat models simply cannot account for.

It is akin to trying to measure the mood of a bustling marketplace with a thermometer designed for a single person’s fever – the tool is not built for the complexity.

Ken Huang noted that autonomy, often viewed as an advancement, is not a vulnerability in itself but significantly elevates risk by opening doors to new scenarios (CyberRisk Alliance, 2025).

Consider a plausible scenario: an autonomous AI agent designed to manage inventory across a global supply chain.

This agent needs the ability to dynamically assign identities and privileges to interact with various vendor systems – a far cry from the fixed machine identities in traditional software (Ken Huang, CyberRisk Alliance, 2025).

If this agent is compromised, its ephemeral, dynamically assigned privileges, meant to enable its efficiency, could be exploited.

An attacker would not be dealing with a static target but a chameleon-like entity capable of reconfiguring its own access in real-time.

This fluid identity management, essential for true AI autonomy, becomes a new vector for attack, a challenge that existing vulnerability scoring systems were never designed to address.

Introducing AIVSS: A New Framework for AI-Specific Risks

Recognizing this critical gap, the Open Worldwide Application Security Project (OWASP) stepped forward.

At the OWASP Global AppSec conference, Ken Huang detailed the culmination of significant effort: the AI Vulnerability Scoring System (AIVSS).

This framework is not merely an update; it is a re-imagination of how we quantify and manage AI security risks.

A Standardized Compass for Uncharted Waters.

The AIVSS project provides a standardized framework specifically crafted to score and manage vulnerabilities unique to agentic and AI systems (OWASP, 2025).

This means that for the first time, organizations have a common language and methodology to identify and discuss AI-specific risks that traditional methods utterly miss.

The practical implication is that it enables a more consistent and objective assessment of AI’s security posture, moving beyond gut feelings to data-driven insights.

A Tailored Metric for Dynamic Risks.

The AIVSS does not discard existing knowledge; it builds upon the familiar foundation of CVSS.

The AIVSS score takes the CVSS base score for a traditional vulnerability and then adds an agentic-capabilities assessment.

This assessment factors in critical risk-amplifying elements like autonomy, non-determinism, and the AI’s ability to use various tools.

The sum is divided by two, and the result is then multiplied by an environmental context factor (OWASP, 2025).

This holistic calculation is critical.

It provides a nuanced view, acknowledging the intertwined nature of traditional software flaws and novel AI risks.

For businesses, the practical implication is the ability to conduct more granular and accurate risk assessments, allowing for resource allocation where it truly matters.

Highlighting the Most Pressing AI Threats.

As part of its initial rollout, the AIVSS framework also illuminates the 10 most severe agentic AI core security risks (OWASP, 2025).

These are not just theoretical; they are the battlegrounds where the future of AI security will be won or lost.

This list provides immediate, actionable focus areas for any team developing or deploying autonomous systems.

The practical implication for AI risk management is clear: security professionals can prioritize their defenses against threats such as Agentic AI Tool Misuse, Agent Access Control Violation, Agent Cascading Failures, and Agent Identity Impersonation (OWASP, 2025).

Your Playbook for AI Security in an Agentic World

The unveiling of AIVSS is not just news; it is a call to action.

As a senior marketing and AI consultant, this is a critical moment for every organization dipping its toes, or diving headfirst, into the waters of autonomous systems.

Here is a playbook to help you navigate this new landscape.

First, educate your teams on agentic AI nuances.

Your security, development, and operations teams need a foundational understanding of what makes agentic AI different – its non-deterministic nature, autonomy, and dynamic behaviors.

This is not just about technical skills; it is a mindset shift.
Second, adopt AIVSS as your core framework.

Visit the AIVSS website at https://aivss.owasp.org/ and begin integrating its principles into your threat modeling and vulnerability management processes (OWASP, 2025).

Do not wait for version 1.0; start with the draft documents and leverage the structured risk assessment guides.
Third, rethink identity and access management for AI.

Traditional fixed identities will not suffice.

Implement systems that can manage ephemeral, dynamically assigned identities and privileges for your AI agents (Ken Huang, CyberRisk Alliance, 2025).

This requires a shift in how you envision AI interactions with other systems.
Fourth, prioritize the OWASP Agentic AI Core Security Risks.

Focus your immediate mitigation efforts on the top 10 risks identified by AIVSS, such as Agent Goal and Instruction Manipulation or Insecure Agent Critical Systems Interaction (OWASP, 2025).

These are your most likely points of failure.
Fifth, foster cross-functional collaboration.

AI security is not just a security team’s job.

It requires close collaboration between AI developers, data scientists, security engineers, and even legal and compliance teams.

Shared understanding is your strongest defense.
Sixth, integrate AIVSS into your SDLC (Secure Development Lifecycle).

Make AIVSS assessments a mandatory step in your AI development pipeline, from design to deployment and beyond.

Proactive integration is far more effective than reactive patching.
Finally, embrace continuous threat modeling.

Agentic AI is constantly evolving.

Your threat modeling efforts must be continuous, adapting to new AI capabilities, tool integrations, and observed behaviors.

Navigating the Ethical Waters: Risks, Trade-offs, and Trust

The power of autonomous systems comes with inherent risks, and neglecting these can lead to catastrophic consequences.

The nature of agentic systems means that seemingly small vulnerabilities can cascade into significant failures (OWASP, 2025).

Imagine an Agent Cascading Failure where a minor misconfiguration in one AI agent triggers a chain reaction across an entire fleet, leading to widespread operational disruption.

Or consider Agent Goal and Instruction Manipulation, where a sophisticated attack could subtly alter an AI’s objectives, causing it to act against organizational interests, potentially even with ethical implications if it impacts human well-being.

Another critical concern is Agent Untraceability.

If an AI agent’s actions are too opaque or its identity too ephemeral, reconstructing incident timelines and assigning accountability becomes incredibly difficult.

This lack of transparency erodes trust, not just in the AI system itself, but in the organizations that deploy it.

Mitigation guidance here leans heavily into intentional design.

We must build AI systems with clear, auditable logs, robust human-in-the-loop oversight mechanisms, and explicit boundaries on autonomy.

Ethical reflections should be embedded into every stage of AI development, ensuring that the drive for innovation does not outpace our responsibility to secure and control these powerful autonomous systems.

This demands a commitment to transparency and a willingness to accept trade-offs between absolute autonomy and absolute security.

Tools, Metrics, and the Rhythm of AI Security

Implementing the AIVSS framework effectively requires a blend of new and existing tools, coupled with a disciplined approach to metrics and review cadences.

For practical application, the AIVSS website (https://aivss.owasp.org/) offers guides for structured AI risk assessment and a scoring tool to calculate your specific AI risk (OWASP, 2025).

This tool will become your primary interface for understanding and quantifying vulnerabilities.

Beyond this, leverage your existing cybersecurity frameworks, SIEM (Security Information and Event Management) and SOAR (Security Orchestration, Automation, and Response) platforms, adapting them to ingest and analyze telemetry from your AI agents.

Look for emerging AI-specific security solutions that can provide behavioral analytics and anomaly detection tailored for non-deterministic systems.

When it comes to metrics, you need to move beyond traditional vulnerability counts.

Key performance indicators should include: AIVSS Score Reduction Rate, which measures the percentage decrease in average AIVSS scores over time, ideally greater than 15% improvement per quarter.

Time-to-Remediate AI Vulnerabilities, reflecting the average time taken to patch or mitigate AI-specific risks identified by AIVSS, with a target of less than 7 days for critical risks.

Incidents of Agentic AI Core Security Risks, counting the number of detected incidents related to the 10 AIVSS identified risks, aiming for zero incidents for high-risk categories.

Lastly, AI Security Training Completion, tracking the percentage of AI/ML engineers and security staff completing AIVSS training, with a goal of 100% within 3 months of AIVSS adoption.

Establishing a clear review cadence is equally vital.

Beyond continuous monitoring, conduct quarterly AIVSS reassessments for your critical AI systems.

Implement mandatory pre-deployment AIVSS checks for all new or significantly updated AI agents.

Furthermore, ensure regular discussions (at least bi-annually) at the executive level regarding your organization’s machine learning security posture and the evolving landscape of autonomous systems risks.

Glossary

Agentic AI: Artificial intelligence systems designed with a degree of autonomy, allowing them to make independent decisions and interact dynamically with their environment.
Non-determinism: The characteristic of AI systems where the outcome of an action or process cannot be precisely predicted, even with identical inputs, due to learning, adaptation, or random elements.
CVSS (Common Vulnerability Scoring System): A standardized, open framework for rating the severity of software vulnerabilities, primarily for traditional, deterministic codebases.
AIVSS (AI Vulnerability Scoring System): A new OWASP framework extending CVSS to specifically quantify and manage vulnerabilities unique to agentic and AI systems.
Ephemeral Identity: A temporary, dynamically assigned identity used by an AI agent for a specific task or period, contrasting with fixed, permanent identities.
Tool Misuse: An agentic AI core security risk where an AI agent improperly selects or uses external tools, potentially leading to unauthorized actions or unintended consequences.

Frequently Asked Questions

Q: What is the OWASP AI Vulnerability Scoring System (AIVSS)?

A: AIVSS is a new standardized framework developed by OWASP to quantify and manage vulnerabilities unique to agentic and AI systems, addressing the limitations of traditional scoring systems like CVSS (OWASP, 2025).
Q: How does AIVSS differ from CVSS?

A: While based on CVSS, AIVSS incorporates an agentic-capabilities assessment that considers risk-amplifying factors specific to AI, such as autonomy, non-determinism, and tool use, which CVSS does not cover (OWASP, 2025).
Q: What are some of the top AI security risks identified by AIVSS?

A: The AIVSS identifies risks like Agentic AI Tool Misuse, Agent Access Control Violation, Agent Cascading Failures, Agent Identity Impersonation, and Agent Goal and Instruction Manipulation, among others (OWASP, 2025).

The security architect in the war room, now armed with the details of AIVSS, breathes a little easier.

The fear is not gone, but it is now quantifiable, manageable.

The shift from fixed code to fluid intelligence is profound, but it is not a chasm.

It is an evolving landscape where our human ingenuity must match the complexity of the machines we create.

OWASP’s AIVSS offers not just a system, but a shared starting point for building a resilient future for AI.

We are all in this together, forging the path for cybersecurity frameworks that truly protect the next generation of digital minds.

I urge you to explore the AIVSS framework, engage with the working group, and contribute to shaping the secure AI systems of tomorrow.

References

CyberRisk Alliance. OWASP Global AppSec: New AI vulnerability scoring system unveiled, 2025.
OWASP. AIVSS Scoring System for OWASP Agentic AI Core Security Risks (Draft), 2025. URL: https://aivss.owasp.org/>

Article start from Hers……