# OWASP Top 10 for Agentic Applications — 2026 coverage

Auto-generated by `scripts/gen_owasp_coverage.py`. Every AAK rule that claims an `ASI<nn>` reference lands in the corresponding row. `tests/test_owasp_agentic_coverage.py` is the regression fence — it fails CI if any row has zero rules.

Source: <https://genai.owasp.org/resource/owasp-top-10-for-agentic-applications-for-2026/>

| ASI | Title | # rules | Rule IDs |
| --- | --- | --- | --- |
| **ASI01** | Goal Hijack | 7 | `AAK-AGENT-001`, `AAK-AGENT-002`, `AAK-AGENT-003`, `AAK-AGENT-004`, `AAK-AGENT-005`, `AAK-MCPWN-001`, `AAK-SKILL-005` |
| **ASI02** | Tool Misuse | 13 | `AAK-ANTHROPIC-SDK-001`, `AAK-DORIS-001`, `AAK-EXCEL-MCP-001`, `AAK-FLOWISE-001`, `AAK-HOOK-007`, `AAK-MCP-004`, `AAK-MCP-009`, `AAK-MCP-010`, `AAK-MCPWN-001`, `AAK-STDIO-001`, `AAK-TAINT-005`, `AAK-TAINT-007`, `AAK-TAINT-008` |
| **ASI03** | Memory Poisoning | 42 | `AAK-A2A-005`, `AAK-A2A-006`, `AAK-HOOK-002`, `AAK-HOOK-006`, `AAK-INDIA-PII-001`, `AAK-INDIA-PII-002`, `AAK-INDIA-PII-003`, `AAK-INDIA-PII-004`, `AAK-INDIA-PII-005`, `AAK-INDIA-PII-006`, `AAK-MCP-001`, `AAK-MCP-003`, `AAK-MCP-011`, `AAK-MCP-012`, `AAK-MCP-013`, `AAK-MCP-014`, `AAK-MCP-017`, `AAK-MCP-019`, `AAK-MCP-020`, `AAK-OAUTH-001`, `AAK-OAUTH-002`, `AAK-OAUTH-003`, `AAK-OAUTH-004`, `AAK-OAUTH-005`, `AAK-SECRET-001`, `AAK-SECRET-002`, `AAK-SECRET-003`, `AAK-SECRET-004`, `AAK-SECRET-005`, `AAK-SECRET-006`, `AAK-SECRET-007`, `AAK-SECRET-008`, `AAK-SECRET-009`, `AAK-TASKS-001`, `AAK-TASKS-002`, `AAK-TASKS-003`, `AAK-TRANSPORT-001`, `AAK-TRANSPORT-002`, `AAK-TRANSPORT-004`, `AAK-TRUST-003`, `AAK-TRUST-004`, `AAK-TRUST-007` |
| **ASI04** | Identity & Privilege Abuse | 23 | `AAK-DNS-REBIND-001`, `AAK-EXCEL-MCP-001`, `AAK-LANGCHAIN-003`, `AAK-LEGAL-001`, `AAK-LEGAL-002`, `AAK-LEGAL-003`, `AAK-MARKETPLACE-001`, `AAK-MARKETPLACE-002`, `AAK-MARKETPLACE-003`, `AAK-MARKETPLACE-004`, `AAK-MCP-005`, `AAK-MCP-007`, `AAK-NEO4J-001`, `AAK-OAUTH-3P-001`, `AAK-OAUTH-SCOPE-001`, `AAK-SEC-MD-001`, `AAK-SPLUNK-TOKLOG-001`, `AAK-SUPPLY-001`, `AAK-SUPPLY-002`, `AAK-SUPPLY-003`, `AAK-SUPPLY-004`, `AAK-SUPPLY-005`, `AAK-SUPPLY-006` |
| **ASI05** | Cascading Failures | 25 | `AAK-HEALTHCARE-AI-001`, `AAK-HEALTHCARE-AI-002`, `AAK-HEALTHCARE-AI-003`, `AAK-HEALTHCARE-AI-004`, `AAK-HEALTHCARE-AI-005`, `AAK-HOOK-001`, `AAK-HOOK-003`, `AAK-HOOK-004`, `AAK-HOOK-005`, `AAK-HOOK-008`, `AAK-HOOK-009`, `AAK-LOGINJ-001`, `AAK-MCP-002`, `AAK-MCP-006`, `AAK-MCP-008`, `AAK-MCP-016`, `AAK-MCP-018`, `AAK-ROUTINE-001`, `AAK-ROUTINE-002`, `AAK-ROUTINE-003`, `AAK-TAINT-001`, `AAK-TAINT-002`, `AAK-TAINT-003`, `AAK-TAINT-004`, `AAK-TAINT-006` |
| **ASI06** | Unauthorized Capability Acquisition | 23 | `AAK-CLAUDE-WIN-001`, `AAK-LANGCHAIN-001`, `AAK-LANGCHAIN-002`, `AAK-MCP-015`, `AAK-POISON-001`, `AAK-POISON-002`, `AAK-POISON-003`, `AAK-POISON-004`, `AAK-POISON-005`, `AAK-POISON-006`, `AAK-RUGPULL-001`, `AAK-RUGPULL-002`, `AAK-RUGPULL-003`, `AAK-SKILL-001`, `AAK-SKILL-002`, `AAK-SKILL-003`, `AAK-SKILL-004`, `AAK-SSRF-001`, `AAK-SSRF-002`, `AAK-SSRF-003`, `AAK-SSRF-004`, `AAK-SSRF-005`, `AAK-WINDSURF-001` |
| **ASI07** | Plan Injection | 9 | `AAK-A2A-001`, `AAK-A2A-002`, `AAK-A2A-003`, `AAK-A2A-004`, `AAK-A2A-008`, `AAK-A2A-009`, `AAK-A2A-010`, `AAK-A2A-011`, `AAK-A2A-012` |
| **ASI08** | Agent Communication Poisoning | 4 | `AAK-A2A-003`, `AAK-A2A-011`, `AAK-A2A-012`, `AAK-TRANSPORT-003` |
| **ASI09** | Resource Abuse | 6 | `AAK-HOOK-RCE-001`, `AAK-HOOK-RCE-002`, `AAK-HOOK-RCE-003`, `AAK-MCPFRAME-001`, `AAK-NEXT-AI-DRAW-001`, `AAK-TRUST-006` |
| **ASI10** | Supply-Chain | 7 | `AAK-A2A-007`, `AAK-ANTHROPIC-SDK-001`, `AAK-DNS-REBIND-002`, `AAK-GHA-IMMUTABLE-001`, `AAK-TRUST-001`, `AAK-TRUST-002`, `AAK-TRUST-005` |
