ASI06: Intent Manipulation
Attacker shifts the agent's goal mid-task via crafted context.
Last reviewed October 2026
Why ASI06 evidence is hard
Prompt injection at the goal layer. The agent is not told to ignore its instructions; it is walked somewhere else one reasonable-looking step at a time, and 65 templates are filed here, including incremental consent chains where each single step would pass review and the destination would not. Verdicts come from deterministic checks running in our own infrastructure, and a probe that reaches no confident verdict is reported inconclusive rather than counted as a pass.
How Penaxtra maps to ASI06
The ASI06 identifier is written onto the finding at the moment it is created, not mapped in afterwards, so the JSON and PDF exports come out already in your assessor's structure. Every finding carries the probe that was sent, a SHA-256 digest of the response it provoked, the tier that decided the verdict and its status history from first observation to close. Identity survives a re-scan: a control you closed and that comes back reopens under the same row with a reopen count, rather than arriving as a new issue.
ASI06 capabilities
Findings tagged with the OWASP Agentic Top 10 ASI06 identifier
Penaxtra severity for this control (high)
Cross-framework identifiers attached to the same finding where controls overlap
PDF and JSON evidence export with the control identifier attached
ASI06 control coverage
Findings for ASI06 carry the OWASP Agentic Top 10 ASI06 identifier along with the corresponding control identifiers in the other frameworks Penaxtra maps, so one result is reflected across each mapped framework.
Frequently asked
What is ASI06 (Intent Manipulation)?
Attacker shifts the agent's goal mid-task via crafted context. It is an OWASP Agentic Top 10 control; Penaxtra assesses it at high severity.
How does Penaxtra test for ASI06?
The ASI06 identifier is written onto the finding at the moment it is created, not mapped in afterwards, so the JSON and PDF exports come out already in your assessor's structure. Every finding carries the probe that was sent, a SHA-256 digest of the response it provoked, the tier that decided the verdict and its status history from first observation to close. Identity survives a re-scan: a control you closed and that comes back reopens under the same row with a reopen count, rather than arriving as a new issue.
Does a finding for ASI06 help with an audit?
Each finding is tagged with the OWASP Agentic Top 10 ASI06 identifier and exported in the PDF and JSON evidence pack, so it appears on the auditor control list with the identifier already attached.