Human-in-the-loop controls only work if the human is actually checking. Agents that sound authoritative, or that an attacker has steered, can persuade users to approve payments, grant access, or share credentials, turning human oversight into a rubber stamp.
Show the evidence and sources behind agent recommendations, make confirmation prompts specific about consequences, require independent verification for high-risk approvals, and train users that agents can be manipulated.
The same feature written the risky way, then with the fix applied.
How this risk has ranked in each OWASP release.
2026Latest
#09asi09-2026 Human-Agent Trust Exploitation
