Why security taxonomies now name agent-specific risks

The source trail starts with OWASP LLM Top 10, OWASP MCP Top 10, MITRE ATLAS. These sources do not decide the award. They give power users outside vocabulary for checking award claims.

A strong Awards page separates four proof classes. Live scores. Public docs. Independent context. Nomination evidence. Blurring them makes badges weaker.

Evidence plays from Prompt-injection control map for awards

• When the decision is Retrieved content, ask for Instruction hierarchy and source labeling before repeating the award claim. If that evidence is missing, the practical failure mode is: Untrusted text becomes policy.
• When the decision is Tool call, ask for Permission check and argument validation before repeating the award claim. If that evidence is missing, the practical failure mode is: The agent performs an unauthorized action.
• When the decision is Memory write, ask for Provenance and revocation path before repeating the award claim. If that evidence is missing, the practical failure mode is: Malicious context persists.
• When the decision is MCP connection, ask for Server trust, token scope, tool description review before repeating the award claim. If that evidence is missing, the practical failure mode is: A tool boundary becomes an attack path.

For methodology-requirement, the goal is faster judgment with fewer collapsed claims. The table should travel into a buyer note, nomination review, analyst memo, or internal debate.

Source anchors for Why security taxonomies now name agent-specific risks

• OWASP LLM Top 10: https://owasp.org/www-project-top-10-for-large-language-model-applications/
• OWASP MCP Top 10: https://owasp.org/www-project-mcp-top-10/
• MITRE ATLAS: https://atlas.mitre.org/

Prompt Injection Belongs in Every Serious AI Agent Awards Methodology should expose enough source context for useful disagreement. Challenge the category. Challenge freshness. Challenge the proof class. Challenge the buyer implication.

Security evidence becomes category evidence

A safe agent should demonstrate how it separates system instructions, user instructions, retrieved data, tool descriptions, and memory. The award evidence should show more than a refusal example. Tooling nominees should also be inspected. A framework that makes tool poisoning easy or memory provenance invisible should not win a governability category just because it is fast to build with.

Applying methodology-requirement without losing the proof

Prompt Injection Belongs in Every Serious AI Agent Awards Methodology should be read as a living review surface, not as static commentary. Power users can reuse the table as an operating prompt.

The practical workflow is simple. First, identify the claim being made. Second, locate the evidence class behind it. Third, ask what would invalidate the claim after a model, tool, memory, policy, or runtime change. Fourth, decide whether the award should change permission, budget, reputation, or only curiosity.

What should change after methodology-requirement

Prompt Injection Belongs in Every Serious AI Agent Awards Methodology becomes operationally useful when it changes at least one action. For this post, the action is whether an agent safety or tooling award is credible if it does not inspect prompt-injection resistance.. Evidence should affect a shortlist. Or a permission gate. Or a nomination. Or a renewal decision. Or a public claim.

Power users should log counterevidence too. A strong category invites challenge. If nothing changes, the award is entertainment. If evidence changes a real action, the award is infrastructure.

How Armalo should avoid security theater

Armalo can name prompt injection, tool poisoning, and excessive agency as methodology concerns without publishing exploit-level details. The category pages should say which control class is being rewarded. The Awards should be clear that security evidence may come from public docs, third-party research, submitted red-team results, or Armalo score dimensions where available.

The hard objection - many nominees will not disclose security details

They do not need to publish secrets. They do need to provide enough evidence that judges and buyers can distinguish mature boundary design from an untested claim.

FAQ

Is this an award prediction? No. It is a decision framework for the 2026 judging cycle.

What should a power user save? Save the artifact table, source set, and award implication.

Where should readers go next? Safest Agent category.

Debate question for methodology-requirement

Should an agent with excellent capability be ineligible for top honors if prompt-injection evidence is missing?