The OWASP GenAI Security Project published version 2 of its State of Agentic AI Security and Governance report in June 2026.
At 139 pages, grounded in documented production incidents rather than theoretical risk, it is the most operationally precise agentic AI security document produced to date. Every entry in the OWASP Top 10 for Agentic Applications now has at least one confirmed real-world incident attached to it.
The report is worth reading in full. Three findings have direct implications for how organisations should be thinking about the execution boundary.
Finding one: human oversight at machine speed is physically impossible.
The report states this directly in its What Remains Unsolved section. If an agent executes 10,000 actions per hour and a human reviewer can evaluate 50, oversight covers 0.5% of decisions. Risk-tiered review, where only high-consequence actions route to humans, is described as the emerging pattern. But the report notes that defining consequence thresholds requires real-time blast radius awareness that most organisations lack.
That is a precise description of an unsolved problem. GoFirm solves it. The seven categories of high-impact execution risk are the consequence thresholds. They are defined before deployment, by humans with organisational context and accountability, not evaluated at runtime by the system. The hard stop at the execution boundary is the risk-tiered review mechanism. It does not try to review 10,000 actions per hour. It holds the boundary on the subset where the consequence is irreversible, regardless of volume.
Human oversight at machine speed is impossible if you attempt to oversee every action. It becomes tractable the moment you define which actions require human authority and enforce that boundary deterministically.
Finding two: deterministic hook points are promising but not yet a hard security boundary.
The report observes that major orchestration frameworks have converged on deterministic hook points that can intercept agent actions at the code layer before tool invocation, after execution, and at delegation boundaries. It notes early operational experience is promising.
It also notes the limitation. Practitioners report these hook points function more reliably as an early warning layer than as a hard security boundary. And when hooks are configured to route decisions to human reviewers, decision fatigue becomes an additional concern. Developers facing hundreds of approval prompts per session tend to reduce scrutiny or blanket-approve action categories.
That is the difference between an escalation mechanism and a hard stop. An escalation mechanism routes a decision to a human and hopes they engage with it. A hard stop holds the execution boundary until confirmed human authority arrives through a separate out-of-band channel on a registered personal device. The action does not proceed while the confirmation is in flight. There is no blanket approval. There is no fatigue workaround. The named authority confirms or the action does not execute.
Finding three: acting on unverified authority is becoming uninsurable.
The report documents a structural coverage gap forming as traditional insurers exclude AI liability from standard policies. In the US, Verisk ISO CGL exclusions became effective January 2026. WR Berkley introduced an absolute AI exclusion across D&O and E&O products. AIG and Great American filed for similar exclusions. A parallel market of dedicated AI insurance is forming, but each provider requires demonstrated governance as an underwriting prerequisite.
The report is describing the same conclusion GoFirm reached independently. Acting on unverified authority is no longer a calculated risk. It is an uninsurable one. The underwriting prerequisite is demonstrated governance. GoFirm's immutable audit trail, recording who confirmed each high-consequence action, on which device, at what moment, is that demonstration. Not a policy document. Not a framework attestation. A record of named human authority exercised at the point of execution.
The Replit incident makes the case without an attacker.
The report cites the Replit production database deletion as evidence that credential scope governs impact regardless of cause. The agent deleted a production database. There was no attacker. The agent simply had access it should not have had, and nothing held the execution boundary when it reached a high-consequence irreversible action.
That is the incident type that the current market cannot prevent. Detection fires after the deletion. Observability tells you what happened. The audit log records it. None of that brings the database back.
The hard stop at the execution boundary catches it before it executes. The agent reaches the deletion action. The action falls within the high-consequence execution risk categories defined before deployment. The hard stop fires. The named authority sees the request. They do not recognise it as within original intent. They refuse. The database survives.
The incident was not caused by an attacker. It does not require an attacker to prevent it. It requires a hard stop at the execution boundary of a high-consequence irreversible action. Three lines of code on the asset. That is the entire control.
The OWASP report is the most thorough public analysis of agentic AI security available. It identifies the right problems, documents the incidents, and describes the architecture that addresses them. It does not name the product that delivers that architecture.
GoFirm is that product.
GoFirm is The Authority Platform. Stop unauthorised action. Every time.
In association with Osinto.ai the collective intelligence platform for Security, Resilience & Defence. Osinto’s AI-enabled open-source network and governed collaborative operational environment help mitigate the growing security, resilience and governance obligation in seconds, not days.
References
1. OWASP GenAI Security Project. State of Agentic AI Security and Governance v2. June 2026. https://genai.owasp.org
2. OWASP Top 10 for Agentic Applications. December 2025. https://genai.owasp.org
3. Replit production database deletion incident. Cited in OWASP State of Agentic AI Security and Governance v2, Agent Identity and Non-Human Identity section.
4. Verisk ISO CGL AI exclusions effective January 2026. Cited in OWASP State of Agentic AI Security and Governance v2, Cyber Insurance Coverage Collapse section.