Counterintelligence Through the Mirror: what the OWASP LLM Top 10 measures about the human mind system

Executive Summary: the mind system now has a reflection that can be measured, and the record reads both ways

A language-model system is built from the human mind system’s output — its language, its doctrine, its patterns — and structured in its image. It is not a mind, and nothing in this report claims consciousness for it. It is a reflection, and what a mirror preserves is arrangement, not substance. But a reflection that preserves arrangement preserves the attack surface too, and the industry has been measuring attacks on that reflection since 2023. The current record is the OWASP GenAI/LLM Top 10 (2026).

• The reflection can be measured in ways the original cannot. Attacks on the mind system are catalogued and argued; there is no adversarial replay and no attack-success rate. Attacks on the machine reflection are logged, quantified, adversarially replayed — and published.
• A layered model of the mind system reads the record back. All ten risks land on the layers of a published, machine-readable model of the mind system — several as paths between layers rather than points on one — and the layers add what incident counts cannot: how long a compromise survives — work you finish once versus work you repeat every session.
• The three highest-leverage vectors hold on both sides of the mirror. The write path into persistence (corpus poisoning ↔ doctrine capture), delivery through trusted containers with no boundary between data and instruction (prompt injection ↔ authority framing), and delegated agency nobody re-scopes (excessive agency ↔ the container trap). The defences pair the same way.
• The practice is the reflection and the interaction, not the mirror itself. Point the machine-side checks at your human-side holdings, the mind-side checks at your machines, and log what crosses between them.

What follows states the problem, reads the ten risks back through the layers, ranks the vectors and defences with each one’s limits beside it, and closes with four practices that need no new tooling.

Problems: attacks on the mind system are argued about while attacks on its reflection are measured, and the two records are kept apart

Cognitive warfare is a formalised doctrine with the mind system as its stated target — the companion briefing traces that record and maps where its attacks land. What the briefing could not supply is measurement.

A community suspecting tampering can inventory its carriers, score the text it holds, and compare snapshots — instruments this series has built — but it cannot replay the attack, vary the dose, or put a success rate on it. There is no debugger for a mind and no packet capture for a culture.

Over the same years, the AI industry built the missing laboratory without meaning to: it deployed systems shaped like the thing cognitive warfare targets, watched them be attacked at scale, measured the results — attack success rates, poisoning thresholds, escalation curves — and published them, revised for 2026.

The gap this report addresses: we have found no work that reads the second record as intelligence about the first. AI security does not frame its findings as statements about the human original, and those defending human communities are never offered the numbers. Two fields defend the two sides of one reflection, separately.

Each reader holds a piece of that gap. The analyst: a measured reference set for a domain that never had one. The intelligence officer: a transfer method between two attack surfaces with one shape. The consultant: a bridging practice that runs both ways. The practitioner: the concrete case — the assistant they already use holds their doctrine in its memory today.

Analysis: the reflection is structural, layer for layer, and reading the ten risks through it prices each one’s persistence

The Consciousness Virtualisation Platform ontology — our own, published as a machine-readable file under a permissive licence — models the human mind system as a six-layer stack, L1–L6, on a substrate the file marks as outside it: L0, read-only.

Every layer declares its own failure modes, and two declare an access model as well; where the file is silent, the persistence column below is our reading.

The reflection is structural in a specific sense: the arrangement carries over, not the substance. A model is trained on what the mind system writes out — text is the export format of its repository and shared patterns — and the industry rebuilt the surrounding architecture in the same shape: a context window that lives and dies like a session, retrieval that behaves like a repository, a corpus that behaves like a shared store, orchestration around it all.

The correspondence is topological, fractal even — the same arrangement of parts and connections, at another scale and in another substance — and arrangement is what a reflection preserves, and all it preserves.

Layer	Its own declared failure modes	Its machine reflection	Writes outlive the session?
L6 Containers	rigid orchestration; container escape failure (inability to question assumptions); parasitic orchestration	tools, orchestration, output conventions	no — in-session output; its configuration persists
L5 Mental Instance	resource starvation; misconfigured weighting; infinite loop	the live session and context window	no
L4 Environmental Switch	signal attenuation; noise injection; bandwidth throttling	the ingestion path, every modality	no
L3 Genetic Repository	branch corruption; merge conflicts	retrieval context and persistent memory	yes
L2 Virtual Universe	corruption from compromised commits; pattern contamination across instances	shared corpus, index, embedding store	yes
L1 Bare Metal	hardware degradation; environmental damage; resource exhaustion	serving and compute estate	yes
L0 Active Substrate	— (declared not applicable: “L0 is not modifiable from within the stack”)	— none claimed; outside the analysable stack	read-only

The machine-reflection column is a reading made here; neither source asserts it, and it is the first thing to attack — the persistence column follows the ontology’s own declarations where it makes them.

And three correspondences barely need interpretation. The shared store’s declared failures — corruption from compromised commits, pattern contamination across instances — are data poisoning, named twice, in a file written to analyse spiritual and metaphysical content.

The routing layer fails by noise injection, attenuation and throttling — the vocabulary of a monitored channel: flood it, starve it, slip past what reads it.

And one failure is declared twice, in two substances — the mental instance’s resource starvation and infinite loops, the compute layer’s resource exhaustion, the latter OWASP’s own term for what LLM06 Unbounded Consumption does — which is why that risk lands on both layers below.

Read in this direction, the industry’s numbers become references for the original — and OWASP’s 2026 entry for LLM05, Data and Model Poisoning, records two of them, one per half of the risk’s own name.

Poisoning the data a system retrieves: as few as five documents have reached roughly 90% attack success against a knowledge base of millions of texts — a write into the store the map places at L3–L2.

Poisoning the model during training: 250 documents have compromised models from 600M to 13B parameters regardless of dataset size — not a write into any layer of the running stack, but a compromise of the artefact before it is supplied, arriving through the same door as every other component: the supply chain, LLM04’s territory on the map below.

Nobody had measured a poisoning threshold for a mind-shaped store before. What transfers is mechanism and direction — very little, well-placed, compromises a large store — not the numbers, a limit taken up below.

The layers also order by persistence, and that ordering prices every risk on the map. The shared store “survives individual instance termination”; the repository has push and pull, and “death of a VM does not destroy its commits”; the session simply ends.

Crossed with OWASP’s grouping of the ten — entry vectors, amplifiers, impacts — every risk lands in a cell, and the cells sort into work you fix once and work you defend again every session. Two risks in the same ring split across that line: direct prompt injection dies with its session; a poisoned corpus entry, in OWASP’s words, “taints every subsequent session that reads from that store”.

Not every risk is a point on one layer; several are paths, and the paths matter more than the points. Prompt injection attacks from the container region onto the live instance (L6 to L5): compromise one trusted tool, channel or convention and every instance that mounts it is in reach.

Misinformation travels the same route (L6 to L5) — it arrives wearing a container’s authority, not its own. Vector and embedding weaknesses run deeper: from the retrieval tooling, through the live session, into the repository itself (L6 to L3 via L5).

Three risks live on two layers at once: supply chain is a malicious component in the container layer arriving through the ingestion path (L6 with L4); unbounded consumption starves the instance before it exhausts the metal (L5 and L1, mostly L5); and data and model poisoning writes into both persistent stores at once (L3 and L2) — the block priced above.

And one risk needs no path at all: excessive agency is a property of the instance itself (L5) — the acting self, over-weighted. The mind system’s name for that part is the ego-system, and the correspondence is taken up as vector three below.

The remaining three sit each on a single layer where the map shows them: sensitive information disclosure at the instance (L5), hidden context exposure and improper output handling with the containers (L6).

The ten, as OWASP numbers them: LLM01 Prompt Injection · LLM02 Sensitive Information Disclosure · LLM03 Excessive Agency · LLM04 Supply Chain · LLM05 Data and Model Poisoning · LLM06 Unbounded Consumption · LLM07 Misinformation · LLM08 Hidden Context Exposure · LLM09 Vector and Embedding Weaknesses · LLM10 Improper Output Handling.

One absence needs a word: nothing on the map touches L0. The ontology declares the substrate read-only and outside the stack, and the map follows it — a claim about what acts from there could not be checked, and this map carries only what can. Model poisoning does happen upstream, before the stack exists; but what the stack receives is a component, and components enter through a door the stack can audit.

Two caveats travel with the map, both OWASP’s own. The 2026 edition warns that “Not every LLM04 attack flows inward: some deliver impact directly”.

And beneath its bullseye it prints that “Dashed chips sit in more than one layer” — “layer” there being OWASP’s word for its rings, not ours. Four of the ten are drawn dashed, every amplifier among them: placing each risk in exactly one cell is a simplification of the source, and the diagram keeps OWASP’s dashed marking to say so.

Evaluation: three vectors and three defences hold on both sides of the mirror, each with its limits stated by its own source

Leverage here means two things taken together: how many future sessions one action touches, and how hard the action is to see afterwards. Both terms are needed — persistence alone would make the ranking true by construction.

Vector 1: the write path into persistence

Doctrine capture and curriculum drift are the mind system’s oldest compromise: a change written once into a community’s repository is read by every member-session after, its author long absent, and a commit looks like a commit.

The repository is reached through the four carriers the companion briefing mapped — language, social conventions, doctrine, ethics. The machine reflection runs the same write path through corpus, index and agent memory, and supplies what the human record never could: the five-document figure above — the first price ever put on a well-placed write.

Vector 2: delivery through trusted containers

The mind runs instruction and information on one stream: a message dressed in authority or urgency gets executed rather than read. And the stream arrives through containers — the channels, formats and relationships wrapped around the instance — which is what draws this vector as a path from the container region onto the live session (L6 to L5).

The reach is the point: compromise one trusted container and every instance that mounts it is in range, the way one poisoned tool description reaches every session that loads the tool. It also carries the pen for vector one — what an injected message commissions is a write.

The machine states its copy of the defect with unusual precision — models “make no architectural distinction between ‘instructions’ and ‘data’ (both are tokens on the same stream), so there is no clean equivalent to parameterized queries”, and the assembled context arrives “with no enforced trust boundary”. An injected message can at least be seen in the session it enters; the write it commissions is what escapes notice.

One machine-side asymmetry transfers only as a question: practitioners rank injection first while clean incidents are scarce, which OWASP’s editors read as “a defense effect. Teams fight injection hard, so fewer clean exploits reach a public database”. The human record keeps no incident base from which to read such an effect. On the machine side, at least, the defended surface is reading; the thinly inspected one is committing.

Vector 3: delegated agency nobody re-scopes

On the leverage terms above this ranks on its own: an unrevisited delegation touches every future session, and it is invisible precisely because each step in its growth is defensible. Unlike the first two, it is not a path.

Excessive agency is a property of the acting instance itself (L5) — in the mind system’s terms, the ego-system: the part of the self that decides and does, over-weighted until its judgement outruns its checks. The instance layer’s own declared failure mode is misconfigured weighting, and that is what an unrevisited delegation is — inside a person or inside an agent.

The mind system’s case is the container trap — interpretive authority handed to a teacher, a framework, or a tool, and never revisited. The grant is made by the instance and reshapes the instance, which is why this risk sits at L5 rather than with the containers it empowers.

What makes it durable is that the weighting persists as configuration between sessions — set once, rarely revisited — the same move that lets the container layer’s in-session writes die while its shape survives.

The machine record corroborates the rank: Excessive Agency climbed to third in 2026, in the editors’ words “the most consequential move on the list, because the vote and the record agree that agentic deployments are where the damage is landing”, with root causes that are properties of the deployed design — excessive functionality, permissions, autonomy.

And the record shows why revisiting fails: in a long agentic session “no single request triggers rate limits because each stays individually within budget”. Every step is defensible; the aggregate is not. That sentence describes a guru relationship as precisely as it describes an agent loop.

The defences, paired

The defences answer the vectors and pair the same way, each with the limit its own source states.

1. Treat every write into persistence as privileged. For a community this is the companion briefing’s change record on doctrine: a written definition, a named owner, a log of changes.

The machine version is the same control with sharper edges — log the prompt that caused a memory write, classify writes for instruction-bearing content, require approval before one persists — and it states its own limit: “factual entries shade into instructions, and incremental writes can evade per-write classification”. Either way this is fix-once work, a property of the pipeline rather than of any request.

2. Label origin, and never let a label waive a check. For a community this is lineage checking: where a teaching came from routes it to the right scrutiny, and a lineage treated as a waiver rather than a routing has been inverted into the container trap it was meant to prevent.

The machine version routes external content through a provenance-labelled channel — with the stated limit that this “reduces attack success in non-adaptive tests only: an attacker who knows the marking scheme can mimic it”.

3. Impose bounds the bounded system cannot lift. For a practice: scope limits, review dates, and exit conditions agreed before entering, while the judgement setting them is not yet the one being bounded.

For the machine: first strip the functionality, permissions and autonomy an agent does not need — the root causes are all excesses — then bound what remains with circuit breakers on steps, depth, time and cost — controls OWASP files honestly under options that “will not prevent Excessive Agency but can limit the level of damage caused”.

Spending caps get the same honesty: they “must be enforcement mechanisms that halt inference when exceeded, rather than alerting thresholds that fast-accumulating workloads can outpace”.

Limitations

The mind system is not the AI architecture. The reflection preserves arrangement, not substance. Nothing here implies a conscious mind in the machine, and nothing speaks through it: a mirror does not become what stands before it.

The growing habit of treating a model’s output as a channelled voice — an entity communicating through the interface — mistakes the reflection for the thing reflected, and this report’s framing fails deliberately if read that way. A claim of identity between the two systems would break on one demonstrated disanalogy; the claim here is reflection, which is weaker, and earns only what a reflection earns.

Mechanism and direction transfer; magnitudes do not. The five-document figure is a property of retrieval implementations, and the 250-document figure a property of training pipelines — neither bounds anything about a human community.

What the numbers license is the shape of the concern — small, well-placed writes compromise large stores — held to the same discipline the companion briefing applied to its own laboratory evidence: the sign transfers, the scale does not.

A mirror can flatter. Reading one’s own model into an external consensus risks finding what one brought. OWASP’s grouping of the ten was made independently of this model, and the correspondences are stated precisely enough to fail — one documented disanalogy at a named layer strikes that row of the table.

But precision is not exposure: no such disanalogy has yet been sought, so the machine column stands unfalsified rather than corroborated. It was called the first thing to attack, and nobody has.

Recommendation: run each system’s checks against the other, then log what crosses between them

Yata-no-Kagami, the sacred mirror of the Japanese regalia, is not an instrument the mind holds up to examine itself. In the reading this series works from, the mind is itself already a mirror — consciousness implements minds as its reflections — and the machine is a mirror of that mirror.

A mirror’s purpose was never itself but the reflection and the interaction, and the machine gives that interaction a working surface for the first time: an external reflection of the mind system that can be queried, logged, and audited.

Working through it is counterintelligence in the strict sense — the object is the adversary’s method, not their identity, and the reflection is the one place the method is logged, so it is the one place a targeting doctrine can be read back.

The two maps agree on the attack’s shape, each on its own axes. OWASP draws its ten as entry vectors on the perimeter converging through amplifying machinery to core impacts — “Attack flows inward. Defense pushes outward.”

The companion briefing traced the same systemic attack for the human case on the layered map: land on the accessible carriers at the impact point, ride the feedback loop up into the repository and the patterns above it, return delayed and amplified as behaviour. Rings on one map, layers on the other — one attack shape on both sides of the mirror, which is why one defensive practice can face both.

1. Point the machine-side checks at your human-side holdings. Take the carrier inventory the companion briefing builds — language, conventions, doctrine, ethics — and ask it the write-path questions: where do this community’s commits happen, who holds the pen, what is the change record, and what would an instruction-bearing write look like here.

A community that cannot answer the second question has an unlogged privileged writer.

A business lists where its working doctrine actually changes — the wiki, one architect’s design documents, a Slack channel where phrasings get settled — and finds that the channel, the least formal of the three, is where doctrine moves first. Nothing reviews it. Credentials pasted into a direct message are one incident; a rule violation starts earlier, as a phrasing somewhere in Slack that nobody logged.

2. Point the mind-side checks at your machines. The four carriers exist in your AI deployment: system prompts are doctrine, tool descriptions are conventions, memory entries are settled language, and the usage and refusal policy you configure is its ethics.

Run the mind model’s own container-trap indicators — authority claims, urgency patterns, commitment escalation, source attribution — against your agents’ prompts and tools, not inbound content; your assistant can do the scoring. A high score has not found an attacker; it has found the container you grew yourself.

3. Instrument the reflection itself. Extend the companion briefing’s dated log across the boundary, one line per event in both directions: what the assistant retained of you (memories written, documents kept), and what you adopted from it (a phrasing, a framing, an interpretation you now repeat).

The pair is a feedback loop with amplification and delay, and the delay hides causes: an entry committed today surfaces later as a conclusion that feels like your own.

4. Ask what the mirror is carrying before you weigh what it says. For the practitioner this is the whole report in one habit. An interpretation accepted last month may sit in the assistant’s memory now, shaping the next answer as though it were source rather than something you once said.

Where the material resists checking — correspondences, a lineage, a text in translation — the persistence question comes before whether the answer rings true.

---

We analyse structure, not people. The layered model discussed here is our own, published as an open analytical fragment under a permissive licence, so its agreement with an external, independently authored consensus list is a correspondence between two separately made artefacts — consistency, not proof, and no claim of defensive efficacy is made or tested.

The reading of layers as machine components is ours and is stated as judgement; the grouping of the ten risks is OWASP’s own, and OWASP marks four of them as belonging to more than one ring. No consciousness is attributed to any system discussed. The OWASP list is licensed CC BY-SA 4.0 and is quoted with attribution.

No product, vendor, or organisation is assessed, and every illustration is a composite. The patterns are the artefact.