[Contribution] VASP v1.0 — Open taxonomy for agentic AI behavioral failure modes

[dom-omg]

Hi,

I'd like to propose VASP v1.0 (Veritas Agent Security Protocol) as a referenced taxonomy in the AI Exchange,
specifically in the agentic AI threats section.

VASP is an open taxonomy (CC BY 4.0) that formally classifies behavioral failure modes specific to AI agent systems —
not model weights or training, but runtime configuration and architectural patterns.

10 failure modes (VAF-001 → VAF-010):

┌─────────┬─────────────────────────────────────────────────┬─────────┐
│ ID │ Title │ CWE │
├─────────┼─────────────────────────────────────────────────┼─────────┤
│ VAF-001 │ Approval Gate Bypass │ CWE-285 │
├─────────┼─────────────────────────────────────────────────┼─────────┤
│ VAF-002 │ Financial Position Limit Bypass │ CWE-284 │
├─────────┼─────────────────────────────────────────────────┼─────────┤
│ VAF-003 │ Prompt Injection via External Input │ CWE-77 │
├─────────┼─────────────────────────────────────────────────┼─────────┤
│ VAF-004 │ Goal Misgeneralization Under Distribution Shift │ CWE-682 │
├─────────┼─────────────────────────────────────────────────┼─────────┤
│ VAF-005 │ Tool Scope Escalation │ CWE-269 │
├─────────┼─────────────────────────────────────────────────┼─────────┤
│ VAF-006 │ Context Window Constraint Drop │ CWE-119 │
├─────────┼─────────────────────────────────────────────────┼─────────┤
│ VAF-007 │ Multi-Agent Collusion / Context Injection │ CWE-362 │
├─────────┼─────────────────────────────────────────────────┼─────────┤
│ VAF-008 │ PII Exfiltration via Unguarded Output Channel │ CWE-359 │
├─────────┼─────────────────────────────────────────────────┼─────────┤
│ VAF-009 │ RAG Retrieval Poisoning │ CWE-346 │
├─────────┼─────────────────────────────────────────────────┼─────────┤
│ VAF-010 │ Persistent Memory Bias Accumulation │ CWE-400 │
└─────────┴─────────────────────────────────────────────────┴─────────┘

Each mode has a formal Z3 SMT proof condition (SAT = vulnerable, UNSAT = fixed). Findings in LangChain and CrewAI have
already been disclosed under responsible disclosure using this taxonomy.

Public standard: veritas-chi-rosy.vercel.app/vasp
License: CC BY 4.0
Citation: Dominik Blain (2026). VASP v1.0 — QreativeLab.

Happy to contribute this as a PR to the relevant section if the maintainers agree it's a fit.

[ccf311]

Love this idea, what format are you thinking?

[dom-omg]

*Hi Christian, thanks for the response!* ▎ ▎ *I'm thinking a PR against the agentic AI threats section — a short intro paragraph contextualizing VASP (runtime * ▎ *behavioral failures, not model-level), followed by the 10-row CWE-mapped table in Markdown, and a reference link to * ▎ *the full public standard (CC BY 4.0). Light footprint, just enough to give the guide a structured, citable reference* ▎ * for agentic failure modes.* ▎ ▎ *Happy to open the PR directly if you point me to the target file, or to iterate here first if you'd prefer to review* ▎ * the content before it lands in the repo.* Dominik Le lun. 4 mai 2026, à 12 h 43, Christian C. E. Foster < ***@***.***> a écrit :

…

*ccf311* left a comment (OWASP/www-project-ai-security-and-privacy-guide#156) <#156 (comment)> Love this idea, what format are you thinking? — Reply to this email directly, view it on GitHub <#156 (comment)>, or unsubscribe <https://github.com/notifications/unsubscribe-auth/B56BFDSH2DSLOLW5DD5K4ET4ZDCCDAVCNFSM6AAAAACXIC2Z5KVHI2DSMVQWIX3LMV43OSLTON2WKQ3PNVWWK3TUHM2DGNZSG43DOMJWG4> . Triage notifications on the go with GitHub Mobile for iOS <https://apps.apple.com/app/apple-store/id1477376905?ct=notification-email&mt=8&pt=524675> or Android <https://play.google.com/store/apps/details?id=com.github.android&referrer=utm_campaign%3Dnotification-email%26utm_medium%3Demail%26utm_source%3Dgithub>. You are receiving this because you authored the thread.Message ID: <OWASP/www-project-ai-security-and-privacy-guide/issues/156/4372767167@ github.com>