OWASP Top 10 for Agentic Applications (2026) — AgentAuditKit coverage leaderboard
Generated file — do not edit by hand. Run
python scripts/gen_coverage.pyto regenerate; CI fails if it drifts (scripts/gen_coverage.py --check).
Methodology
Every row is derived from the live AAK rule registry (agent_audit_kit/rules/builtin.py): a rule lands in a category iff it declares that category in its OWASP references. Coverage labels are reproducible thresholds, not self-assessment — Full = ≥ 3 mapped rules, Partial = 1–2, None = 0. Deterministic and offline: same registry → same table, byte-for-byte.
AAK covers 10/10 categories with ≥ 1 deterministic rule. Rule IDs are listed so the claim is auditable — click through to docs/rules/. Source taxonomy: https://genai.owasp.org/resource/owasp-top-10-for-agentic-applications-for-2026/.
| OWASP | Title | Coverage | # rules | Rule IDs |
|---|---|---|---|---|
| ASI01 | Goal Hijack | Full | 16 | AAK-AGENT-001, AAK-AGENT-002, AAK-AGENT-003, AAK-AGENT-004, AAK-AGENT-005, AAK-AGENT-006, AAK-CREWAI-CHAIN-2026-04-001, AAK-DEEPSEEK-V4-MOE-TOOL-INJ-001, AAK-MCP-CODEWHALE-CVE-2026-75858-001, AAK-MCP-K8S-CVE-2026-61459-001, AAK-MCP-KONG-CVE-2026-13341-001, AAK-MCPWN-001, AAK-METIS-REFUSAL-REFEED-001, AAK-METIS-SCORING-SINK-001, AAK-SKILL-005, AAK-SKILL-006 |
| ASI02 | Tool Misuse | Full | 51 | AAK-AGENT-SHARED-RES-AUTHZ-001, AAK-AGENT-ZERO-CVE-2026-30624-PIN-001, AAK-ANTHROPIC-SDK-001, AAK-APPROVAL-PARSER-DESYNC-001, AAK-ASTROMCP-SQLI-CVE-2026-7591-001, AAK-CHATGPT-MCP-CVE-2026-7061-PIN-001, AAK-COMPOSE-001, AAK-COMPOSE-002, AAK-CREWAI-CVE-2026-2285-001, AAK-DOCSGPT-MCP-STDIO-MITM-001, AAK-DORIS-001, AAK-EXCEL-MCP-001, AAK-FLOWISE-001, AAK-GPTRESEARCHER-MCP-STDIO-MITM-001, AAK-HOOK-007, AAK-LANGCHAIN-PROMPT-LOADER-PATH-001, AAK-LITELLM-CVE-2026-30623-PIN-001, AAK-LLM-SQL-RCE-001, AAK-MCP-004, AAK-MCP-009, AAK-MCP-010, AAK-MCP-ARGV-TOCTOU-001, AAK-MCP-ATLASSIAN-CVE-2026-27825-001, AAK-MCP-ATLASSIAN-CVE-2026-27826-001, AAK-MCP-ATOMICAGENTS-CVE-2026-91988-001, AAK-MCP-CORTEX-CVE-2026-49986-001, AAK-MCP-FLOWISE-CVE-2026-91931-001, AAK-MCP-GATEWAY-REGISTRY-CVE-2026-14471-001, AAK-MCP-LETTA-CVE-2025-51482-001, AAK-MCP-STDIO-CMD-INJ-001, AAK-MCP-STDIO-CMD-INJ-002, AAK-MCP-STDIO-CMD-INJ-003, AAK-MCP-STDIO-CMD-INJ-004, AAK-MCP-STDIO-CMD-INJ-005, AAK-MCP-STDIO-LAUNCHER-INJECT-001, AAK-MCP-TOOL-UNSAFE-EVAL-001, AAK-MCP-TOOLGATE-ASYMMETRY-001, AAK-MCP-TUNNEL-001, AAK-MCPCALC-CVE-2026-44717-PIN-001, AAK-MCPWN-001, AAK-METIS-REFUSAL-REFEED-001, AAK-METIS-SCORING-SINK-001, AAK-POLICY-TRUNCATION-001, AAK-SHELL-DEFAULT-PROFILE-001, AAK-SHELL-QUOTED-INTERP-001, AAK-SK-INMEMORY-VECTORSTORE-FILTER-CVE-2026-26030-PIN-001, AAK-STDIO-001, AAK-TAINT-005, AAK-TAINT-007, AAK-TAINT-008, AAK-TOXICFLOW-001 |
| ASI03 | Memory Poisoning | Full | 74 | AAK-A2A-005, AAK-A2A-006, AAK-AGENT-COMPOSE-002, AAK-AGENT-TRUST-002, AAK-AGENT-TRUST-003, AAK-CLAUDECODE-CVE-2026-40068-PIN-001, AAK-HOOK-002, AAK-HOOK-006, AAK-INDIA-PII-001, AAK-INDIA-PII-002, AAK-INDIA-PII-003, AAK-INDIA-PII-004, AAK-INDIA-PII-005, AAK-INDIA-PII-006, AAK-IPI-WILD-CORPUS-001, AAK-MCP-001, AAK-MCP-003, AAK-MCP-011, AAK-MCP-012, AAK-MCP-013, AAK-MCP-014, AAK-MCP-017, AAK-MCP-019, AAK-MCP-020, AAK-MCP-AGENTICMAIL-CVE-2026-57495-001, AAK-MCP-ATTEST-001, AAK-MCP-AUTH-PATHTRAVERSAL-001, AAK-MCP-BETTERAUTH-CVE-2026-53512-001, AAK-MCP-CARD-002, AAK-MCP-ENV-PLACEHOLDER-EXFIL-001, AAK-MCP-GENIEACS-CVE-2026-55637-001, AAK-MCP-HTTP-NOAUTH-SERVER-001, AAK-MCP-LANGBOT-CVE-2026-54449-001, AAK-MCP-LANGGRAPH-API-CVE-2026-55235-001, AAK-MCP-N8N-CVE-2026-65594-001, AAK-MCP-NEXTCLOUD-CVE-2026-55640-001, AAK-MCP-NOAUTH-DEFAULT, AAK-MCP-OMNIGENT-CVE-2026-62674-001, AAK-MCP-OPENCLAW-CVE-2026-62195-001, AAK-MCP-ROUTING-DESYNC-001, AAK-MCP-SAMPLING-001, AAK-MCP-SDK-CVE-2026-52869-001, AAK-MCP-STATELESS-001, AAK-MCP-TRANSPORT-SESSION-UNAUTH-001, AAK-MCP-TUNNEL-002, AAK-MCP-TUNNEL-003, AAK-OAUTH-001, AAK-OAUTH-002, AAK-OAUTH-003, AAK-OAUTH-004, AAK-OAUTH-005, AAK-OAUTH-006, AAK-OAUTH-007, AAK-OAUTH-008, AAK-OPENCLAW-PRIVESC-001, AAK-PRTITLE-IPI-001, AAK-SECRET-001, AAK-SECRET-002, AAK-SECRET-003, AAK-SECRET-004, AAK-SECRET-005, AAK-SECRET-006, AAK-SECRET-007, AAK-SECRET-008, AAK-SECRET-009, AAK-TASKS-001, AAK-TASKS-002, AAK-TASKS-003, AAK-TRANSPORT-001, AAK-TRANSPORT-002, AAK-TRANSPORT-004, AAK-TRUST-003, AAK-TRUST-004, AAK-TRUST-007 |
| ASI04 | Identity & Privilege Abuse | Full | 82 | AAK-AGENT-HARNESS-SHARED-STATE-001, AAK-AGENT-SHARED-RES-AUTHZ-001, AAK-AST02-001, AAK-AST10-001, AAK-AZURE-MCP-001, AAK-AZURE-MCP-NOAUTH-001, AAK-CREWAI-CVE-2026-2286-001, AAK-DNS-REBIND-001, AAK-EXCEL-MCP-001, AAK-LANGCHAIN-003, AAK-LANGCHAIN-SSRF-REDIR-001, AAK-LEGAL-001, AAK-LEGAL-002, AAK-LEGAL-003, AAK-LMDEPLOY-VL-SSRF-001, AAK-MARKETPLACE-001, AAK-MARKETPLACE-002, AAK-MARKETPLACE-003, AAK-MARKETPLACE-004, AAK-MCP-005, AAK-MCP-007, AAK-MCP-9ROUTER-CVE-2026-46339-001, AAK-MCP-AGENTICFLOW-CVE-2026-58195-001, AAK-MCP-AMAZONMQ-CVE-2026-18655-001, AAK-MCP-APPIUM-CVE-2026-58500-001, AAK-MCP-ATTEST-001, AAK-MCP-AWSAPIMCP-CVE-2026-16584-001, AAK-MCP-AWSPOSTGRES-CVE-2026-85787-001, AAK-MCP-AWSSECAGENT-CVE-2026-87913-001, AAK-MCP-CARD-004, AAK-MCP-CCTEMPLATES-CVE-2026-73222-001, AAK-MCP-CLINE-CVE-2026-59723-001, AAK-MCP-CONFIG-MALFORMED-001, AAK-MCP-CONTENTFUL-CVE-2026-53957-001, AAK-MCP-DEEPSEEK-CVE-2026-55604-001, AAK-MCP-DOCUMENTDB-CVE-2026-18954-001, AAK-MCP-FHI-001, AAK-MCP-FLYTO-CVE-2026-67425-001, AAK-MCP-FROMOPENAPI-CVE-2026-59973-001, AAK-MCP-FRONTMCP-CVE-2026-67531-001, AAK-MCP-GITLAB-ZEREIGHT-CVE-2026-61560-001, AAK-MCP-KNOWNS-CVE-2026-86439-001, AAK-MCP-LANGFLOW-CVE-2026-12940-001, AAK-MCP-LANGGRAPH-CHECKPOINT-CVE-2026-71433-001, AAK-MCP-LANGGRAPH-MONGO-CVE-2026-48121-001, AAK-MCP-LITELLM-CVE-2026-59822-001, AAK-MCP-MCPHUB-CVE-2026-79748-001, AAK-MCP-MEMSERVICE-CVE-2026-50027-001, AAK-MCP-MYSQLMCP-CVE-2026-59971-001, AAK-MCP-N8NMCP-CVE-2026-54052-001, AAK-MCP-NETLICENSING-CVE-2026-54446-001, AAK-MCP-PENPOT-CVE-2026-45805-001, AAK-MCP-POSTGRESMCP-CVE-2026-85620-001, AAK-MCP-PRAISONAI-CVE-2026-61427-001, AAK-MCP-PRAISONAI-TS-CVE-2026-57139-001, AAK-MCP-REPOMIX-CVE-2026-49988-001, AAK-MCP-RUFLO-CVE-2026-59726-001, AAK-MCP-SANDBOX-SELFDISABLE-001, AAK-MCP-SEARXNG-CVE-2026-58483-001, AAK-MCP-SEQTHINKING-CVE-2026-81845-001, AAK-MCP-SERENA-CVE-2026-49471-001, AAK-MCP-STATA-CVE-2026-47708-001, AAK-MCP-TOOLGATE-ASYMMETRY-001, AAK-MCP-TOOLUNIVERSE-CVE-2026-81096-001, AAK-MCP-UFO-CVE-2026-73296-001, AAK-MCP-WHATSAPP-CVE-2026-46555-001, AAK-METAADS-CVE-2026-48039-001, AAK-NEO4J-001, AAK-OAUTH-3P-001, AAK-OAUTH-SCOPE-001, AAK-SANDBOX-DENYLIST-001, AAK-SEC-MD-001, AAK-SKILL-LIFECYCLE-ATTRIBUTION-001, AAK-SPLUNK-MCP-TOKEN-LEAK-001, AAK-SPLUNK-TOKLOG-001, AAK-SSRF-TOCTOU-001, AAK-SUPPLY-001, AAK-SUPPLY-002, AAK-SUPPLY-003, AAK-SUPPLY-004, AAK-SUPPLY-005, AAK-SUPPLY-006 |
| ASI05 | Cascading Failures | Full | 56 | AAK-AGENT-TRUST-001, AAK-AGENT-TRUST-002, AAK-AST04-001, AAK-COMPOSE-003, AAK-CREWAI-CHAIN-2026-04-001, AAK-CREWAI-CVE-2026-2275-001, AAK-HEALTHCARE-AI-001, AAK-HEALTHCARE-AI-002, AAK-HEALTHCARE-AI-003, AAK-HEALTHCARE-AI-004, AAK-HEALTHCARE-AI-005, AAK-HOOK-001, AAK-HOOK-003, AAK-HOOK-004, AAK-HOOK-005, AAK-HOOK-008, AAK-HOOK-009, AAK-IDE-TASK-001, AAK-IDE-TASK-002, AAK-IDE-TASK-003, AAK-LLM-SQL-RCE-001, AAK-LOGINJ-001, AAK-MCP-002, AAK-MCP-006, AAK-MCP-008, AAK-MCP-016, AAK-MCP-018, AAK-MCP-APPS-001, AAK-MCP-APPS-002, AAK-MCP-ATLASSIAN-CVE-2026-73498-001, AAK-MCP-BROWSEMCP-CVE-2026-55557-001, AAK-MCP-CONTEXTFORGE-CVE-2026-77822-001, AAK-MCP-DEST-UNVALIDATED-001, AAK-MCP-FRONTMCP-CVE-2026-67531-001, AAK-MCP-MARIMO-CVE-2026-75149-001, AAK-MCP-N8N-CVE-2026-72768-001, AAK-MCP-NEOMJS-CVE-2026-18482-001, AAK-MCP-QWED-CVE-2026-55546-001, AAK-MCP-SIDECAR-NOAUTH-001, AAK-MCP-SIDECAR-REBIND-001, AAK-MCP-STDIO-LAUNCHER-INJECT-001, AAK-MCP-SUBLINEAR-CVE-2026-55609-001, AAK-MCP-TOOL-ARG-OSCMD-001, AAK-MCP-TOOL-UNSAFE-EVAL-001, AAK-MCP-TOOLS-LIST-UNBOUNDED-001, AAK-MCP-TUNNEL-001, AAK-MCPCALC-CVE-2026-44717-PIN-001, AAK-ROUTINE-001, AAK-ROUTINE-002, AAK-ROUTINE-003, AAK-SK-INMEMORY-VECTORSTORE-FILTER-CVE-2026-26030-PIN-001, AAK-TAINT-001, AAK-TAINT-002, AAK-TAINT-003, AAK-TAINT-004, AAK-TAINT-006 |
| ASI06 | Unauthorized Capability Acquisition | Full | 48 | AAK-AGENT-COMPOSE-001, AAK-AGENT-COMPOSE-002, AAK-AGENT-HARNESS-SHARED-STATE-001, AAK-AGENT-TRUST-004, AAK-CLAUDE-WIN-001, AAK-LANGCHAIN-001, AAK-LANGCHAIN-002, AAK-MCP-015, AAK-MCP-APIFY-CVE-2026-46341-001, AAK-MCP-ASTRBOT-CVE-2026-15501-001, AAK-MCP-AUTHFETCH-CVE-2026-49857-001, AAK-MCP-CARD-001, AAK-MCP-CARD-003, AAK-MCP-CKAN-CVE-2026-73846-001, AAK-MCP-FLORENCE2-CVE-2026-19984-001, AAK-MCP-GOOGLESEARCH-CVE-2026-19337-001, AAK-MCP-GRAFANA-CVE-2026-19516-001, AAK-MCP-HEALTHLAKE-CVE-2026-15643-001, AAK-MCP-JSHOOK-CVE-2026-49856-001, AAK-MCP-MCPHUB-CVE-2026-79748-001, AAK-MCP-N8N-CVE-2026-59207-001, AAK-MCP-N8N-CVE-2026-72768-001, AAK-MCP-SANDBOX-SELFDISABLE-001, AAK-MCP-SSRF-001, AAK-MCP-STDIO-UNBOUNDED-BUFFER-001, AAK-MCP-TUNNEL-003, AAK-POISON-001, AAK-POISON-002, AAK-POISON-003, AAK-POISON-004, AAK-POISON-005, AAK-POISON-006, AAK-PROJECT-DEAL-DRIFT-001, AAK-RUGPULL-001, AAK-RUGPULL-002, AAK-RUGPULL-003, AAK-SKILL-001, AAK-SKILL-002, AAK-SKILL-003, AAK-SKILL-004, AAK-SKILL-UNTRUSTED-EXEC-PATH, AAK-SSRF-001, AAK-SSRF-002, AAK-SSRF-003, AAK-SSRF-004, AAK-SSRF-005, AAK-SSRF-BRACKETED-HOST-001, AAK-WINDSURF-001 |
| ASI07 | Plan Injection | Full | 9 | AAK-A2A-001, AAK-A2A-002, AAK-A2A-003, AAK-A2A-004, AAK-A2A-008, AAK-A2A-009, AAK-A2A-010, AAK-A2A-011, AAK-A2A-012 |
| ASI08 | Agent Communication Poisoning | Full | 5 | AAK-A2A-003, AAK-A2A-011, AAK-A2A-012, AAK-TASKS-004, AAK-TRANSPORT-003 |
| ASI09 | Resource Abuse | Full | 18 | AAK-CREWAI-CHAIN-2026-04-001, AAK-CREWAI-CVE-2026-2287-001, AAK-HOOK-RCE-001, AAK-HOOK-RCE-002, AAK-HOOK-RCE-003, AAK-LANGCHAIN-SSRF-REDIR-001, AAK-LANGGRAPH-TOOLNODE-LIST-REGRESSION-001, AAK-LMDEPLOY-VL-SSRF-001, AAK-MCP-DBTMCP-CVE-2026-44968-001, AAK-MCP-GEMINIBRIDGE-CVE-2026-54785-001, AAK-MCP-HEALTHOMICS-CVE-2026-15415-001, AAK-MCP-TEXTEDITOR-CVE-2026-15138-001, AAK-MCPFRAME-001, AAK-NEXT-AI-DRAW-001, AAK-SKILL-LIFECYCLE-ATTRIBUTION-001, AAK-TIKTOK-AGENT-HIJACK-001, AAK-TOXICFLOW-001, AAK-TRUST-006 |
| ASI10 | Supply-Chain | Full | 22 | AAK-A2A-007, AAK-AGENT-ZERO-CVE-2026-30624-PIN-001, AAK-ANTHROPIC-SDK-001, AAK-ASTROMCP-SQLI-CVE-2026-7591-001, AAK-CHATGPT-MCP-CVE-2026-7061-PIN-001, AAK-CLAUDECODE-CVE-2026-40068-PIN-001, AAK-DNS-REBIND-002, AAK-DOCSGPT-MCP-STDIO-MITM-001, AAK-GHA-IMMUTABLE-001, AAK-GPTRESEARCHER-MCP-STDIO-MITM-001, AAK-LITELLM-CVE-2026-30623-PIN-001, AAK-MCP-INSPECTOR-CVE-2026-23744-001, AAK-MCP-MARKETPLACE-CONFIG-FETCH-001, AAK-MCP-STDIO-CMD-INJ-001, AAK-MCP-STDIO-CMD-INJ-002, AAK-MCP-STDIO-CMD-INJ-003, AAK-MCP-STDIO-CMD-INJ-004, AAK-MCP-STDIO-CMD-INJ-005, AAK-SK-INMEMORY-VECTORSTORE-FILTER-CVE-2026-26030-PIN-001, AAK-TRUST-001, AAK-TRUST-002, AAK-TRUST-005 |
Coverage vs. named toolkits
The Microsoft Agent Governance Toolkit (blog · repo, open-sourced 2026-04-02, MIT) states 10/10 OWASP Agentic coverage. AgentAuditKit does not claim a headline number here — it reports the per-category rule counts above, which are reproducible from the registry (10/10 categories carry ≥ 1 rule, each with named, clickable rule IDs). No account, no cloud call, no self-scored grade: the table is the evidence. Note the two are different layers — the Microsoft toolkit is runtime policy enforcement; AAK is a static, offline scanner that flags the same risk classes before deploy — so this is a coverage cross-reference, not a head-to-head benchmark. Source OWASP projects: Agentic Top 10 · MCP Top 10.