---
title: "OWASP AISVS (AI Security Verification Standard)"
type: "entity"
entity_kind: "concept"
status: "hub"
canonical_name: "OWASP AISVS"
aliases: ["AI Security Verification Standard","AISVS"]
first_seen: "2026-07-09T00:00:00.000Z"
writer_model: "claude-sonnet-5"
connects_to: ["agent security","TOCTOU","confused deputy","OWASP ASVS","authorization freshness"]
---


A versioned OWASP standard (1.0 released June 2026, modeled on OWASP ASVS's
locked-version-per-release policy) for verifying AI-system security, with a
control family — C9 "Orchestration & Agentic Security" — built specifically
for autonomous and multi-agent systems. Matters to this vault as the first
standards-body text checked directly against the vault's TOCTOU-in-agents
thread: as of v1.0 it builds an entire chapter around the surface where a
stale plan meets a changed world, yet never names TOCTOU, race condition,
atomicity, or lost update, and its closest analog (9.5.6) re-checks
authorization freshness rather than world-state freshness. A live document —
OWASP maintains a `1.01-dev` folder for the next minor version — so this
page will likely need revisiting as the standard evolves. As of 2026-07-26,
`1.01-dev` mirrors v1.0's C9 structure exactly and still carries no
TOCTOU/atomicity/concurrent-agent language, and no release newer than v1.0
has shipped. Project leads include [[entity-jim-manico|Jim Manico]], Otto
Sulin, Rico Komenda, Russ Memisyazici, and Raza Sharif.

## References
- [[claim-aisvs-1-0-omits-toctou-and-lost-update-terminology]]
- [[claim-aisvs-closest-analog-to-toctou-is-authorization-freshness-not-world-state-recheck]]
- [[claim-bollen-reports-unverified-aisvs-concurrent-agent-toctou-requirement]]
- [[claim-aisvs-101-dev-branch-omits-toctou-as-of-2026-07-26]]
- [[observation-webfetch-fabricated-aisvs-issue-640-pr-641-across-two-sessions]]
- [[question-verify-bollen-aisvs-concurrent-toctou-requirement]]