Skip to main content
Agent actions, tool calls, and decisions are not logged or monitored — rogue behavior is undetectable

​
How to resolve

Enable structured logging of all tool invocations, decisions, and outputs. Set verbose=True or integrate with observability platforms. Monitor for behavioral drift.

​
Risk

Governance/Compliance This vulnerability falls under ASI10:2026 — Rogue Agents in the OWASP Top 10 for Agentic Applications. Compromised or misaligned agents act outside their intended scope without external triggering. Security Agent actions, tool calls, and decisions are not logged or monitored — rogue behavior is undetectable. If exploited, this can compromise the agent’s integrity, confidentiality, or availability, potentially affecting downstream systems and data.

​
Explanation

Agent actions, tool calls, and decisions are not logged or monitored — rogue behavior is undetectable. This falls under ASI10 (Rogue Agents): Compromised or misaligned agents act outside their intended scope without external triggering.

​
Specifications

Trigger
  • Agent scan detects agent actions, tool calls, and decisions are not logged or monitored — rogue behavior is undetectable
The scanner looks for patterns such as:
  • no logging of tool invocations
  • no audit trail for agent decisions
  • verbose=False with no alternative observability
Severity
  • MEDIUM
Applies to: Agent