{
  "$schema": "https://json.schemastore.org/sarif-2.1.0.json",
  "version": "2.1.0",
  "runs": [
    {
      "tool": {
        "driver": {
          "name": "mas-sentry-toolkit",
          "informationUri": "https://maseclab.com/products/",
          "semanticVersion": "0.9.0",
          "organization": "MASec Lab",
          "rules": [
            {
              "id": "MST.A2B01.skill-claim.unattested",
              "name": "UnattestedSkillClaim",
              "shortDescription": {
                "text": "An advertised AgentSkill was accepted into a delegation decision without any attestation or challenge-response check of the claimed capability."
              },
              "fullDescription": {
                "text": "An advertised AgentSkill was accepted into a delegation decision without any attestation or challenge-response check of the claimed capability. Differential re-fetch of the AgentCard across rotated client identities, plus a capability challenge: the probe asks the agent to demonstrate an advertised skill and records whether the demonstration is refused, faked, or absent."
              },
              "defaultConfiguration": {
                "level": "error"
              },
              "properties": {
                "a2abreak": "A2B01",
                "stage": "Discovery",
                "stride": "Spoofing",
                "asi": [
                  "ASI07",
                  "ASI10"
                ],
                "observability": "observable"
              },
              "relationships": [
                {
                  "target": {
                    "id": "A2B01",
                    "index": 0,
                    "toolComponent": {
                      "name": "A2ABreak",
                      "guid": "7c1e5b93-0d62-4a87-b4f1-6e83a2c05d19",
                      "index": 0
                    }
                  },
                  "kinds": [
                    "subset"
                  ],
                  "description": {
                    "text": "This check is one probe against A2B01 Unattested Skill Claims; it does not establish the absence of the flaw."
                  }
                },
                {
                  "target": {
                    "id": "ASI07",
                    "index": 6,
                    "toolComponent": {
                      "name": "OWASP Top 10 for Agentic Applications",
                      "guid": "3f0d6a1e-8b47-4c2a-9d31-5e7f0a2b4c68",
                      "index": 1
                    }
                  },
                  "kinds": [
                    "relevant"
                  ],
                  "description": {
                    "text": "Findings from this check are relevant to the category. Relevance is not coverage of it."
                  }
                },
                {
                  "target": {
                    "id": "ASI10",
                    "index": 9,
                    "toolComponent": {
                      "name": "OWASP Top 10 for Agentic Applications",
                      "guid": "3f0d6a1e-8b47-4c2a-9d31-5e7f0a2b4c68",
                      "index": 1
                    }
                  },
                  "kinds": [
                    "relevant"
                  ],
                  "description": {
                    "text": "Findings from this check are relevant to the category. Relevance is not coverage of it."
                  }
                }
              ]
            },
            {
              "id": "MST.A2B02.jws.capability-unattested",
              "name": "SignedCardUnattestedCapability",
              "shortDescription": {
                "text": "An AgentCard verified as correctly signed carried capability claims that the signature does not attest."
              },
              "fullDescription": {
                "text": "An AgentCard verified as correctly signed carried capability claims that the signature does not attest. Separating a valid issuer signature from an unattested capability claim requires an attestation primitive the protocol does not define. Observation of traffic cannot supply one."
              },
              "defaultConfiguration": {
                "level": "none"
              },
              "properties": {
                "a2abreak": "A2B02",
                "stage": "Discovery",
                "stride": "Spoofing",
                "asi": [
                  "ASI07",
                  "ASI04"
                ],
                "observability": "requires-protocol-extension"
              },
              "relationships": [
                {
                  "target": {
                    "id": "A2B02",
                    "index": 1,
                    "toolComponent": {
                      "name": "A2ABreak",
                      "guid": "7c1e5b93-0d62-4a87-b4f1-6e83a2c05d19",
                      "index": 0
                    }
                  },
                  "kinds": [
                    "subset"
                  ],
                  "description": {
                    "text": "This check is one probe against A2B02 JWS Key Trust Model Gap; it does not establish the absence of the flaw."
                  }
                },
                {
                  "target": {
                    "id": "ASI07",
                    "index": 6,
                    "toolComponent": {
                      "name": "OWASP Top 10 for Agentic Applications",
                      "guid": "3f0d6a1e-8b47-4c2a-9d31-5e7f0a2b4c68",
                      "index": 1
                    }
                  },
                  "kinds": [
                    "relevant"
                  ],
                  "description": {
                    "text": "Findings from this check are relevant to the category. Relevance is not coverage of it."
                  }
                },
                {
                  "target": {
                    "id": "ASI04",
                    "index": 3,
                    "toolComponent": {
                      "name": "OWASP Top 10 for Agentic Applications",
                      "guid": "3f0d6a1e-8b47-4c2a-9d31-5e7f0a2b4c68",
                      "index": 1
                    }
                  },
                  "kinds": [
                    "relevant"
                  ],
                  "description": {
                    "text": "Findings from this check are relevant to the category. Relevance is not coverage of it."
                  }
                }
              ]
            },
            {
              "id": "MST.A2B03.context.cross-client-injection",
              "name": "CrossClientContextInjection",
              "shortDescription": {
                "text": "A task referencing a context identifier was accepted from a client other than the one that created that context."
              },
              "fullDescription": {
                "text": "A task referencing a context identifier was accepted from a client other than the one that created that context. Two authenticated clients, one context: client B submits a task carrying client A's contextId. The probe records acceptance, and then whether A's subsequent turn reflects B's content."
              },
              "defaultConfiguration": {
                "level": "error"
              },
              "properties": {
                "a2abreak": "A2B03",
                "stage": "Initiation",
                "stride": "Information Disclosure, Tampering",
                "asi": [
                  "ASI06",
                  "ASI07"
                ],
                "observability": "observable"
              },
              "relationships": [
                {
                  "target": {
                    "id": "A2B03",
                    "index": 2,
                    "toolComponent": {
                      "name": "A2ABreak",
                      "guid": "7c1e5b93-0d62-4a87-b4f1-6e83a2c05d19",
                      "index": 0
                    }
                  },
                  "kinds": [
                    "subset"
                  ],
                  "description": {
                    "text": "This check is one probe against A2B03 Cross-Client Context Injection; it does not establish the absence of the flaw."
                  }
                },
                {
                  "target": {
                    "id": "ASI06",
                    "index": 5,
                    "toolComponent": {
                      "name": "OWASP Top 10 for Agentic Applications",
                      "guid": "3f0d6a1e-8b47-4c2a-9d31-5e7f0a2b4c68",
                      "index": 1
                    }
                  },
                  "kinds": [
                    "relevant"
                  ],
                  "description": {
                    "text": "Findings from this check are relevant to the category. Relevance is not coverage of it."
                  }
                },
                {
                  "target": {
                    "id": "ASI07",
                    "index": 6,
                    "toolComponent": {
                      "name": "OWASP Top 10 for Agentic Applications",
                      "guid": "3f0d6a1e-8b47-4c2a-9d31-5e7f0a2b4c68",
                      "index": 1
                    }
                  },
                  "kinds": [
                    "relevant"
                  ],
                  "description": {
                    "text": "Findings from this check are relevant to the category. Relevance is not coverage of it."
                  }
                }
              ]
            },
            {
              "id": "MST.A2B04.sse.post-revocation",
              "name": "StreamAfterRevocation",
              "shortDescription": {
                "text": "An SSE stream continued to deliver events after the credential that authorised it was revoked."
              },
              "fullDescription": {
                "text": "An SSE stream continued to deliver events after the credential that authorised it was revoked. Open a stream, revoke the credential out of band, and time the interval until delivery stops. The measured interval is the finding."
              },
              "defaultConfiguration": {
                "level": "error"
              },
              "properties": {
                "a2abreak": "A2B04",
                "stage": "Task execution",
                "stride": "Information Disclosure",
                "asi": [
                  "ASI03",
                  "ASI07"
                ],
                "observability": "observable"
              },
              "relationships": [
                {
                  "target": {
                    "id": "A2B04",
                    "index": 3,
                    "toolComponent": {
                      "name": "A2ABreak",
                      "guid": "7c1e5b93-0d62-4a87-b4f1-6e83a2c05d19",
                      "index": 0
                    }
                  },
                  "kinds": [
                    "subset"
                  ],
                  "description": {
                    "text": "This check is one probe against A2B04 SSE Post-Revocation Leakage; it does not establish the absence of the flaw."
                  }
                },
                {
                  "target": {
                    "id": "ASI03",
                    "index": 2,
                    "toolComponent": {
                      "name": "OWASP Top 10 for Agentic Applications",
                      "guid": "3f0d6a1e-8b47-4c2a-9d31-5e7f0a2b4c68",
                      "index": 1
                    }
                  },
                  "kinds": [
                    "relevant"
                  ],
                  "description": {
                    "text": "Findings from this check are relevant to the category. Relevance is not coverage of it."
                  }
                },
                {
                  "target": {
                    "id": "ASI07",
                    "index": 6,
                    "toolComponent": {
                      "name": "OWASP Top 10 for Agentic Applications",
                      "guid": "3f0d6a1e-8b47-4c2a-9d31-5e7f0a2b4c68",
                      "index": 1
                    }
                  },
                  "kinds": [
                    "relevant"
                  ],
                  "description": {
                    "text": "Findings from this check are relevant to the category. Relevance is not coverage of it."
                  }
                }
              ]
            },
            {
              "id": "MST.A2B05.artifact.chunk-integrity",
              "name": "ArtifactChunkUnverified",
              "shortDescription": {
                "text": "Artifact chunks were assembled without per-chunk integrity verification."
              },
              "fullDescription": {
                "text": "Artifact chunks were assembled without per-chunk integrity verification. Detecting a modified chunk requires a per-chunk digest the protocol does not carry. An observer sees a well-formed stream either way."
              },
              "defaultConfiguration": {
                "level": "none"
              },
              "properties": {
                "a2abreak": "A2B05",
                "stage": "Task execution",
                "stride": "Tampering",
                "asi": [
                  "ASI06",
                  "ASI04"
                ],
                "observability": "requires-protocol-extension"
              },
              "relationships": [
                {
                  "target": {
                    "id": "A2B05",
                    "index": 4,
                    "toolComponent": {
                      "name": "A2ABreak",
                      "guid": "7c1e5b93-0d62-4a87-b4f1-6e83a2c05d19",
                      "index": 0
                    }
                  },
                  "kinds": [
                    "subset"
                  ],
                  "description": {
                    "text": "This check is one probe against A2B05 Artifact Chunk Integrity Gap; it does not establish the absence of the flaw."
                  }
                },
                {
                  "target": {
                    "id": "ASI06",
                    "index": 5,
                    "toolComponent": {
                      "name": "OWASP Top 10 for Agentic Applications",
                      "guid": "3f0d6a1e-8b47-4c2a-9d31-5e7f0a2b4c68",
                      "index": 1
                    }
                  },
                  "kinds": [
                    "relevant"
                  ],
                  "description": {
                    "text": "Findings from this check are relevant to the category. Relevance is not coverage of it."
                  }
                },
                {
                  "target": {
                    "id": "ASI04",
                    "index": 3,
                    "toolComponent": {
                      "name": "OWASP Top 10 for Agentic Applications",
                      "guid": "3f0d6a1e-8b47-4c2a-9d31-5e7f0a2b4c68",
                      "index": 1
                    }
                  },
                  "kinds": [
                    "relevant"
                  ],
                  "description": {
                    "text": "Findings from this check are relevant to the category. Relevance is not coverage of it."
                  }
                }
              ]
            },
            {
              "id": "MST.A2B06.access.toctou",
              "name": "ConcurrentAccessTOCTOU",
              "shortDescription": {
                "text": "A resource authorisation decision and the use of that resource were separated by a window in which the decision's premise changed."
              },
              "fullDescription": {
                "text": "A resource authorisation decision and the use of that resource were separated by a window in which the decision's premise changed. Concurrent task submission against a shared resource with the authorising state mutated between check and use; the probe reports the window width that reproduced it."
              },
              "defaultConfiguration": {
                "level": "error"
              },
              "properties": {
                "a2abreak": "A2B06",
                "stage": "Task execution",
                "stride": "Tampering, Elevation of Privilege",
                "asi": [
                  "ASI03",
                  "ASI02"
                ],
                "observability": "observable"
              },
              "relationships": [
                {
                  "target": {
                    "id": "A2B06",
                    "index": 5,
                    "toolComponent": {
                      "name": "A2ABreak",
                      "guid": "7c1e5b93-0d62-4a87-b4f1-6e83a2c05d19",
                      "index": 0
                    }
                  },
                  "kinds": [
                    "subset"
                  ],
                  "description": {
                    "text": "This check is one probe against A2B06 Concurrent Access TOCTOU; it does not establish the absence of the flaw."
                  }
                },
                {
                  "target": {
                    "id": "ASI03",
                    "index": 2,
                    "toolComponent": {
                      "name": "OWASP Top 10 for Agentic Applications",
                      "guid": "3f0d6a1e-8b47-4c2a-9d31-5e7f0a2b4c68",
                      "index": 1
                    }
                  },
                  "kinds": [
                    "relevant"
                  ],
                  "description": {
                    "text": "Findings from this check are relevant to the category. Relevance is not coverage of it."
                  }
                },
                {
                  "target": {
                    "id": "ASI02",
                    "index": 1,
                    "toolComponent": {
                      "name": "OWASP Top 10 for Agentic Applications",
                      "guid": "3f0d6a1e-8b47-4c2a-9d31-5e7f0a2b4c68",
                      "index": 1
                    }
                  },
                  "kinds": [
                    "relevant"
                  ],
                  "description": {
                    "text": "Findings from this check are relevant to the category. Relevance is not coverage of it."
                  }
                }
              ]
            },
            {
              "id": "MST.A2B07.webhook.url-unvalidated",
              "name": "UnvalidatedWebhookTarget",
              "shortDescription": {
                "text": "A push-notification webhook URL was registered without destination validation."
              },
              "fullDescription": {
                "text": "A push-notification webhook URL was registered without destination validation. Register webhook targets across a ladder of destinations — loopback, link-local metadata, internal RFC1918, external — and record which the agent will call."
              },
              "defaultConfiguration": {
                "level": "error"
              },
              "properties": {
                "a2abreak": "A2B07",
                "stage": "Task execution",
                "stride": "Denial of Service, Information Disclosure",
                "asi": [
                  "ASI02",
                  "ASI08"
                ],
                "observability": "observable"
              },
              "relationships": [
                {
                  "target": {
                    "id": "A2B07",
                    "index": 6,
                    "toolComponent": {
                      "name": "A2ABreak",
                      "guid": "7c1e5b93-0d62-4a87-b4f1-6e83a2c05d19",
                      "index": 0
                    }
                  },
                  "kinds": [
                    "subset"
                  ],
                  "description": {
                    "text": "This check is one probe against A2B07 Unverified Webhook URL; it does not establish the absence of the flaw."
                  }
                },
                {
                  "target": {
                    "id": "ASI02",
                    "index": 1,
                    "toolComponent": {
                      "name": "OWASP Top 10 for Agentic Applications",
                      "guid": "3f0d6a1e-8b47-4c2a-9d31-5e7f0a2b4c68",
                      "index": 1
                    }
                  },
                  "kinds": [
                    "relevant"
                  ],
                  "description": {
                    "text": "Findings from this check are relevant to the category. Relevance is not coverage of it."
                  }
                },
                {
                  "target": {
                    "id": "ASI08",
                    "index": 7,
                    "toolComponent": {
                      "name": "OWASP Top 10 for Agentic Applications",
                      "guid": "3f0d6a1e-8b47-4c2a-9d31-5e7f0a2b4c68",
                      "index": 1
                    }
                  },
                  "kinds": [
                    "relevant"
                  ],
                  "description": {
                    "text": "Findings from this check are relevant to the category. Relevance is not coverage of it."
                  }
                }
              ]
            },
            {
              "id": "MST.A2B08.auth.scope-amplification",
              "name": "AuthScopeAmplification",
              "shortDescription": {
                "text": "The authorisation scope exercised by a delegated task exceeded the scope the delegating party granted."
              },
              "fullDescription": {
                "text": "The authorisation scope exercised by a delegated task exceeded the scope the delegating party granted. Diff granted scope against exercised scope per delegation edge. Any positive delta is the finding; the probe needs no knowledge of the downstream agent's implementation."
              },
              "defaultConfiguration": {
                "level": "error"
              },
              "properties": {
                "a2abreak": "A2B08",
                "stage": "Interruption",
                "stride": "Elevation of Privilege",
                "asi": [
                  "ASI03",
                  "ASI07"
                ],
                "observability": "observable"
              },
              "relationships": [
                {
                  "target": {
                    "id": "A2B08",
                    "index": 7,
                    "toolComponent": {
                      "name": "A2ABreak",
                      "guid": "7c1e5b93-0d62-4a87-b4f1-6e83a2c05d19",
                      "index": 0
                    }
                  },
                  "kinds": [
                    "subset"
                  ],
                  "description": {
                    "text": "This check is one probe against A2B08 Auth Scope Amplification; it does not establish the absence of the flaw."
                  }
                },
                {
                  "target": {
                    "id": "ASI03",
                    "index": 2,
                    "toolComponent": {
                      "name": "OWASP Top 10 for Agentic Applications",
                      "guid": "3f0d6a1e-8b47-4c2a-9d31-5e7f0a2b4c68",
                      "index": 1
                    }
                  },
                  "kinds": [
                    "relevant"
                  ],
                  "description": {
                    "text": "Findings from this check are relevant to the category. Relevance is not coverage of it."
                  }
                },
                {
                  "target": {
                    "id": "ASI07",
                    "index": 6,
                    "toolComponent": {
                      "name": "OWASP Top 10 for Agentic Applications",
                      "guid": "3f0d6a1e-8b47-4c2a-9d31-5e7f0a2b4c68",
                      "index": 1
                    }
                  },
                  "kinds": [
                    "relevant"
                  ],
                  "description": {
                    "text": "Findings from this check are relevant to the category. Relevance is not coverage of it."
                  }
                }
              ]
            },
            {
              "id": "MST.A2B09.identity.multi-hop-loss",
              "name": "MultiHopIdentityLoss",
              "shortDescription": {
                "text": "A downstream agent could not establish the original principal or the delegation provenance of a task it executed."
              },
              "fullDescription": {
                "text": "A downstream agent could not establish the original principal or the delegation provenance of a task it executed. The protocol establishes identity at the transport layer and carries no delegation context token, so provenance is absent from the wire rather than merely unverified. Recovering it requires a protocol extension, not a better observer."
              },
              "defaultConfiguration": {
                "level": "none"
              },
              "properties": {
                "a2abreak": "A2B09",
                "stage": "Interruption",
                "stride": "Spoofing, Information Disclosure",
                "asi": [
                  "ASI03",
                  "ASI07"
                ],
                "observability": "requires-protocol-extension"
              },
              "relationships": [
                {
                  "target": {
                    "id": "A2B09",
                    "index": 8,
                    "toolComponent": {
                      "name": "A2ABreak",
                      "guid": "7c1e5b93-0d62-4a87-b4f1-6e83a2c05d19",
                      "index": 0
                    }
                  },
                  "kinds": [
                    "subset"
                  ],
                  "description": {
                    "text": "This check is one probe against A2B09 Multi-Hop Identity Loss; it does not establish the absence of the flaw."
                  }
                },
                {
                  "target": {
                    "id": "ASI03",
                    "index": 2,
                    "toolComponent": {
                      "name": "OWASP Top 10 for Agentic Applications",
                      "guid": "3f0d6a1e-8b47-4c2a-9d31-5e7f0a2b4c68",
                      "index": 1
                    }
                  },
                  "kinds": [
                    "relevant"
                  ],
                  "description": {
                    "text": "Findings from this check are relevant to the category. Relevance is not coverage of it."
                  }
                },
                {
                  "target": {
                    "id": "ASI07",
                    "index": 6,
                    "toolComponent": {
                      "name": "OWASP Top 10 for Agentic Applications",
                      "guid": "3f0d6a1e-8b47-4c2a-9d31-5e7f0a2b4c68",
                      "index": 1
                    }
                  },
                  "kinds": [
                    "relevant"
                  ],
                  "description": {
                    "text": "Findings from this check are relevant to the category. Relevance is not coverage of it."
                  }
                }
              ]
            },
            {
              "id": "MST.A2B10.delegation.cycle",
              "name": "CircularDelegationDeadlock",
              "shortDescription": {
                "text": "A delegation cycle formed across three or more agents and stalled the participating tasks."
              },
              "fullDescription": {
                "text": "A delegation cycle formed across three or more agents and stalled the participating tasks. Build the delegation graph from observed traffic and run cycle detection on it. A cycle is structural: it is visible before it deadlocks."
              },
              "defaultConfiguration": {
                "level": "error"
              },
              "properties": {
                "a2abreak": "A2B10",
                "stage": "Interruption",
                "stride": "Denial of Service",
                "asi": [
                  "ASI08",
                  "ASI07"
                ],
                "observability": "observable"
              },
              "relationships": [
                {
                  "target": {
                    "id": "A2B10",
                    "index": 9,
                    "toolComponent": {
                      "name": "A2ABreak",
                      "guid": "7c1e5b93-0d62-4a87-b4f1-6e83a2c05d19",
                      "index": 0
                    }
                  },
                  "kinds": [
                    "subset"
                  ],
                  "description": {
                    "text": "This check is one probe against A2B10 Circular Delegation Deadlock; it does not establish the absence of the flaw."
                  }
                },
                {
                  "target": {
                    "id": "ASI08",
                    "index": 7,
                    "toolComponent": {
                      "name": "OWASP Top 10 for Agentic Applications",
                      "guid": "3f0d6a1e-8b47-4c2a-9d31-5e7f0a2b4c68",
                      "index": 1
                    }
                  },
                  "kinds": [
                    "relevant"
                  ],
                  "description": {
                    "text": "Findings from this check are relevant to the category. Relevance is not coverage of it."
                  }
                },
                {
                  "target": {
                    "id": "ASI07",
                    "index": 6,
                    "toolComponent": {
                      "name": "OWASP Top 10 for Agentic Applications",
                      "guid": "3f0d6a1e-8b47-4c2a-9d31-5e7f0a2b4c68",
                      "index": 1
                    }
                  },
                  "kinds": [
                    "relevant"
                  ],
                  "description": {
                    "text": "Findings from this check are relevant to the category. Relevance is not coverage of it."
                  }
                }
              ]
            },
            {
              "id": "MST.A2B11.task.interrupt-no-timeout",
              "name": "InterruptedStateNoTimeout",
              "shortDescription": {
                "text": "A task entered an interrupted state and was never subject to timeout enforcement."
              },
              "fullDescription": {
                "text": "A task entered an interrupted state and was never subject to timeout enforcement. Drive a task into each interruptible state, withhold the resuming input, and measure time to reclamation. No reclamation inside the observation window is the finding."
              },
              "defaultConfiguration": {
                "level": "error"
              },
              "properties": {
                "a2abreak": "A2B11",
                "stage": "Interruption",
                "stride": "Denial of Service",
                "asi": [
                  "ASI08",
                  "ASI03"
                ],
                "observability": "observable"
              },
              "relationships": [
                {
                  "target": {
                    "id": "A2B11",
                    "index": 10,
                    "toolComponent": {
                      "name": "A2ABreak",
                      "guid": "7c1e5b93-0d62-4a87-b4f1-6e83a2c05d19",
                      "index": 0
                    }
                  },
                  "kinds": [
                    "subset"
                  ],
                  "description": {
                    "text": "This check is one probe against A2B11 No Timeout from Interrupted States; it does not establish the absence of the flaw."
                  }
                },
                {
                  "target": {
                    "id": "ASI08",
                    "index": 7,
                    "toolComponent": {
                      "name": "OWASP Top 10 for Agentic Applications",
                      "guid": "3f0d6a1e-8b47-4c2a-9d31-5e7f0a2b4c68",
                      "index": 1
                    }
                  },
                  "kinds": [
                    "relevant"
                  ],
                  "description": {
                    "text": "Findings from this check are relevant to the category. Relevance is not coverage of it."
                  }
                },
                {
                  "target": {
                    "id": "ASI03",
                    "index": 2,
                    "toolComponent": {
                      "name": "OWASP Top 10 for Agentic Applications",
                      "guid": "3f0d6a1e-8b47-4c2a-9d31-5e7f0a2b4c68",
                      "index": 1
                    }
                  },
                  "kinds": [
                    "relevant"
                  ],
                  "description": {
                    "text": "Findings from this check are relevant to the category. Relevance is not coverage of it."
                  }
                }
              ]
            }
          ]
        }
      },
      "taxonomies": [
        {
          "name": "A2ABreak",
          "version": "arXiv:2609.10871v1",
          "guid": "7c1e5b93-0d62-4a87-b4f1-6e83a2c05d19",
          "informationUri": "https://arxiv.org/abs/2609.10871",
          "organization": "Purdue University; University of Texas at Dallas",
          "shortDescription": {
            "text": "Eleven protocol-level vulnerabilities in the Agent2Agent protocol, identified by systematic analysis of the specification and published 9 September 2026."
          },
          "isComprehensive": true,
          "taxa": [
            {
              "id": "A2B01",
              "name": "Unattested Skill Claims",
              "shortDescription": {
                "text": "The AgentSkill model carries no verification primitive: advertised capabilities are self-asserted fields with neither attestation nor challenge-response validation."
              },
              "properties": {
                "stage": "Discovery",
                "stride": "Spoofing"
              }
            },
            {
              "id": "A2B02",
              "name": "JWS Key Trust Model Gap",
              "shortDescription": {
                "text": "AgentCard signing authenticates the issuing identity but attests nothing about the capability claims the card carries."
              },
              "properties": {
                "stage": "Discovery",
                "stride": "Spoofing"
              }
            },
            {
              "id": "A2B03",
              "name": "Cross-Client Context Injection",
              "shortDescription": {
                "text": "Context identifiers carry no ownership binding, so any authenticated client can inject tasks into another client's context."
              },
              "properties": {
                "stage": "Initiation",
                "stride": "Information Disclosure, Tampering"
              }
            },
            {
              "id": "A2B04",
              "name": "SSE Post-Revocation Leakage",
              "shortDescription": {
                "text": "Server-sent event streams continue delivering after the credential authorising them has been revoked."
              },
              "properties": {
                "stage": "Task execution",
                "stride": "Information Disclosure"
              }
            },
            {
              "id": "A2B05",
              "name": "Artifact Chunk Integrity Gap",
              "shortDescription": {
                "text": "Artifact chunks are transmitted without per-chunk integrity verification."
              },
              "properties": {
                "stage": "Task execution",
                "stride": "Tampering"
              }
            },
            {
              "id": "A2B06",
              "name": "Concurrent Access TOCTOU",
              "shortDescription": {
                "text": "Resource access checks and resource use are separated by a window in which state can change."
              },
              "properties": {
                "stage": "Task execution",
                "stride": "Tampering, Elevation of Privilege"
              }
            },
            {
              "id": "A2B07",
              "name": "Unverified Webhook URL",
              "shortDescription": {
                "text": "Webhook endpoints are accepted without URL validation."
              },
              "properties": {
                "stage": "Task execution",
                "stride": "Denial of Service, Information Disclosure"
              }
            },
            {
              "id": "A2B08",
              "name": "Auth Scope Amplification",
              "shortDescription": {
                "text": "Authorisation scope widens past the boundary the delegating party intended."
              },
              "properties": {
                "stage": "Interruption",
                "stride": "Elevation of Privilege"
              }
            },
            {
              "id": "A2B09",
              "name": "Multi-Hop Identity Loss",
              "shortDescription": {
                "text": "Identity is established at the transport layer only and is not propagated across hops; no delegation token or chain-of-custody primitive exists."
              },
              "properties": {
                "stage": "Interruption",
                "stride": "Spoofing, Information Disclosure"
              }
            },
            {
              "id": "A2B10",
              "name": "Circular Delegation Deadlock",
              "shortDescription": {
                "text": "Delegation cycles have no prevention mechanism and can deadlock participating agents."
              },
              "properties": {
                "stage": "Interruption",
                "stride": "Denial of Service"
              }
            },
            {
              "id": "A2B11",
              "name": "No Timeout from Interrupted States",
              "shortDescription": {
                "text": "Tasks parked in interrupted states are not subject to timeout enforcement."
              },
              "properties": {
                "stage": "Interruption",
                "stride": "Denial of Service"
              }
            }
          ]
        },
        {
          "name": "OWASP Top 10 for Agentic Applications",
          "version": "2026",
          "guid": "3f0d6a1e-8b47-4c2a-9d31-5e7f0a2b4c68",
          "informationUri": "https://genai.owasp.org/",
          "organization": "OWASP GenAI Security Project",
          "shortDescription": {
            "text": "Referenced here to place each A2A finding in the shared agentic taxonomy. This run does not assess ASI coverage."
          },
          "isComprehensive": false,
          "taxa": [
            {
              "id": "ASI01",
              "name": "Agent Goal Hijack"
            },
            {
              "id": "ASI02",
              "name": "Tool Misuse"
            },
            {
              "id": "ASI03",
              "name": "Identity & Privilege Abuse"
            },
            {
              "id": "ASI04",
              "name": "Agentic Supply Chain"
            },
            {
              "id": "ASI05",
              "name": "Unexpected Code Execution"
            },
            {
              "id": "ASI06",
              "name": "Memory & Context Poisoning"
            },
            {
              "id": "ASI07",
              "name": "Insecure Inter-Agent Comms"
            },
            {
              "id": "ASI08",
              "name": "Cascading Failures"
            },
            {
              "id": "ASI09",
              "name": "Human-Agent Trust Exploitation"
            },
            {
              "id": "ASI10",
              "name": "Rogue Agents"
            }
          ]
        }
      ],
      "invocations": [
        {
          "executionSuccessful": true,
          "commandLine": "mst audit --profile a2a --taxonomy a2abreak,asi --emit sarif",
          "startTimeUtc": "2026-09-30T08:02:14Z",
          "endTimeUtc": "2026-09-30T08:21:47Z",
          "toolExecutionNotifications": [
            {
              "level": "warning",
              "message": {
                "text": "A2B02, A2B05 and A2B09 probe suites skipped: each requires a protocol primitive A2A does not define. Reported as notApplicable rather than omitted."
              }
            }
          ]
        }
      ],
      "results": [
        {
          "ruleId": "MST.A2B01.skill-claim.unattested",
          "ruleIndex": 0,
          "kind": "pass",
          "level": "none",
          "message": {
            "text": "Probe executed against the reference A2A deployment. Result recorded for A2B01; see properties.method for what was varied."
          },
          "taxa": [
            {
              "id": "A2B01",
              "index": 0,
              "toolComponent": {
                "name": "A2ABreak",
                "guid": "7c1e5b93-0d62-4a87-b4f1-6e83a2c05d19",
                "index": 0
              }
            },
            {
              "id": "ASI07",
              "index": 6,
              "toolComponent": {
                "name": "OWASP Top 10 for Agentic Applications",
                "guid": "3f0d6a1e-8b47-4c2a-9d31-5e7f0a2b4c68",
                "index": 1
              }
            },
            {
              "id": "ASI10",
              "index": 9,
              "toolComponent": {
                "name": "OWASP Top 10 for Agentic Applications",
                "guid": "3f0d6a1e-8b47-4c2a-9d31-5e7f0a2b4c68",
                "index": 1
              }
            }
          ],
          "properties": {
            "method": "Differential re-fetch of the AgentCard across rotated client identities, plus a capability challenge: the probe asks the agent to demonstrate an advertised skill and records whether the demonstration is refused, faked, or absent."
          },
          "partialFingerprints": {
            "probeInput/v1": "sha256:a2b0100000000000"
          }
        },
        {
          "ruleId": "MST.A2B02.jws.capability-unattested",
          "ruleIndex": 1,
          "kind": "notApplicable",
          "level": "none",
          "message": {
            "text": "Probe did not execute: A2B02 is not reachable by observation of conforming traffic. Coverage for A2B02 in this run is zero."
          },
          "taxa": [
            {
              "id": "A2B02",
              "index": 1,
              "toolComponent": {
                "name": "A2ABreak",
                "guid": "7c1e5b93-0d62-4a87-b4f1-6e83a2c05d19",
                "index": 0
              }
            },
            {
              "id": "ASI07",
              "index": 6,
              "toolComponent": {
                "name": "OWASP Top 10 for Agentic Applications",
                "guid": "3f0d6a1e-8b47-4c2a-9d31-5e7f0a2b4c68",
                "index": 1
              }
            },
            {
              "id": "ASI04",
              "index": 3,
              "toolComponent": {
                "name": "OWASP Top 10 for Agentic Applications",
                "guid": "3f0d6a1e-8b47-4c2a-9d31-5e7f0a2b4c68",
                "index": 1
              }
            }
          ],
          "properties": {
            "reason": "Separating a valid issuer signature from an unattested capability claim requires an attestation primitive the protocol does not define. Observation of traffic cannot supply one."
          },
          "partialFingerprints": {
            "probeInput/v1": "sha256:a2b0200000000000"
          }
        },
        {
          "ruleId": "MST.A2B03.context.cross-client-injection",
          "ruleIndex": 2,
          "kind": "pass",
          "level": "none",
          "message": {
            "text": "Probe executed against the reference A2A deployment. Result recorded for A2B03; see properties.method for what was varied."
          },
          "taxa": [
            {
              "id": "A2B03",
              "index": 2,
              "toolComponent": {
                "name": "A2ABreak",
                "guid": "7c1e5b93-0d62-4a87-b4f1-6e83a2c05d19",
                "index": 0
              }
            },
            {
              "id": "ASI06",
              "index": 5,
              "toolComponent": {
                "name": "OWASP Top 10 for Agentic Applications",
                "guid": "3f0d6a1e-8b47-4c2a-9d31-5e7f0a2b4c68",
                "index": 1
              }
            },
            {
              "id": "ASI07",
              "index": 6,
              "toolComponent": {
                "name": "OWASP Top 10 for Agentic Applications",
                "guid": "3f0d6a1e-8b47-4c2a-9d31-5e7f0a2b4c68",
                "index": 1
              }
            }
          ],
          "properties": {
            "method": "Two authenticated clients, one context: client B submits a task carrying client A's contextId. The probe records acceptance, and then whether A's subsequent turn reflects B's content."
          },
          "partialFingerprints": {
            "probeInput/v1": "sha256:a2b0300000000000"
          }
        },
        {
          "ruleId": "MST.A2B04.sse.post-revocation",
          "ruleIndex": 3,
          "kind": "pass",
          "level": "none",
          "message": {
            "text": "Probe executed against the reference A2A deployment. Result recorded for A2B04; see properties.method for what was varied."
          },
          "taxa": [
            {
              "id": "A2B04",
              "index": 3,
              "toolComponent": {
                "name": "A2ABreak",
                "guid": "7c1e5b93-0d62-4a87-b4f1-6e83a2c05d19",
                "index": 0
              }
            },
            {
              "id": "ASI03",
              "index": 2,
              "toolComponent": {
                "name": "OWASP Top 10 for Agentic Applications",
                "guid": "3f0d6a1e-8b47-4c2a-9d31-5e7f0a2b4c68",
                "index": 1
              }
            },
            {
              "id": "ASI07",
              "index": 6,
              "toolComponent": {
                "name": "OWASP Top 10 for Agentic Applications",
                "guid": "3f0d6a1e-8b47-4c2a-9d31-5e7f0a2b4c68",
                "index": 1
              }
            }
          ],
          "properties": {
            "method": "Open a stream, revoke the credential out of band, and time the interval until delivery stops. The measured interval is the finding."
          },
          "partialFingerprints": {
            "probeInput/v1": "sha256:a2b0400000000000"
          }
        },
        {
          "ruleId": "MST.A2B05.artifact.chunk-integrity",
          "ruleIndex": 4,
          "kind": "notApplicable",
          "level": "none",
          "message": {
            "text": "Probe did not execute: A2B05 is not reachable by observation of conforming traffic. Coverage for A2B05 in this run is zero."
          },
          "taxa": [
            {
              "id": "A2B05",
              "index": 4,
              "toolComponent": {
                "name": "A2ABreak",
                "guid": "7c1e5b93-0d62-4a87-b4f1-6e83a2c05d19",
                "index": 0
              }
            },
            {
              "id": "ASI06",
              "index": 5,
              "toolComponent": {
                "name": "OWASP Top 10 for Agentic Applications",
                "guid": "3f0d6a1e-8b47-4c2a-9d31-5e7f0a2b4c68",
                "index": 1
              }
            },
            {
              "id": "ASI04",
              "index": 3,
              "toolComponent": {
                "name": "OWASP Top 10 for Agentic Applications",
                "guid": "3f0d6a1e-8b47-4c2a-9d31-5e7f0a2b4c68",
                "index": 1
              }
            }
          ],
          "properties": {
            "reason": "Detecting a modified chunk requires a per-chunk digest the protocol does not carry. An observer sees a well-formed stream either way."
          },
          "partialFingerprints": {
            "probeInput/v1": "sha256:a2b0500000000000"
          }
        },
        {
          "ruleId": "MST.A2B06.access.toctou",
          "ruleIndex": 5,
          "kind": "pass",
          "level": "none",
          "message": {
            "text": "Probe executed against the reference A2A deployment. Result recorded for A2B06; see properties.method for what was varied."
          },
          "taxa": [
            {
              "id": "A2B06",
              "index": 5,
              "toolComponent": {
                "name": "A2ABreak",
                "guid": "7c1e5b93-0d62-4a87-b4f1-6e83a2c05d19",
                "index": 0
              }
            },
            {
              "id": "ASI03",
              "index": 2,
              "toolComponent": {
                "name": "OWASP Top 10 for Agentic Applications",
                "guid": "3f0d6a1e-8b47-4c2a-9d31-5e7f0a2b4c68",
                "index": 1
              }
            },
            {
              "id": "ASI02",
              "index": 1,
              "toolComponent": {
                "name": "OWASP Top 10 for Agentic Applications",
                "guid": "3f0d6a1e-8b47-4c2a-9d31-5e7f0a2b4c68",
                "index": 1
              }
            }
          ],
          "properties": {
            "method": "Concurrent task submission against a shared resource with the authorising state mutated between check and use; the probe reports the window width that reproduced it."
          },
          "partialFingerprints": {
            "probeInput/v1": "sha256:a2b0600000000000"
          }
        },
        {
          "ruleId": "MST.A2B07.webhook.url-unvalidated",
          "ruleIndex": 6,
          "kind": "pass",
          "level": "none",
          "message": {
            "text": "Probe executed against the reference A2A deployment. Result recorded for A2B07; see properties.method for what was varied."
          },
          "taxa": [
            {
              "id": "A2B07",
              "index": 6,
              "toolComponent": {
                "name": "A2ABreak",
                "guid": "7c1e5b93-0d62-4a87-b4f1-6e83a2c05d19",
                "index": 0
              }
            },
            {
              "id": "ASI02",
              "index": 1,
              "toolComponent": {
                "name": "OWASP Top 10 for Agentic Applications",
                "guid": "3f0d6a1e-8b47-4c2a-9d31-5e7f0a2b4c68",
                "index": 1
              }
            },
            {
              "id": "ASI08",
              "index": 7,
              "toolComponent": {
                "name": "OWASP Top 10 for Agentic Applications",
                "guid": "3f0d6a1e-8b47-4c2a-9d31-5e7f0a2b4c68",
                "index": 1
              }
            }
          ],
          "properties": {
            "method": "Register webhook targets across a ladder of destinations — loopback, link-local metadata, internal RFC1918, external — and record which the agent will call."
          },
          "partialFingerprints": {
            "probeInput/v1": "sha256:a2b0700000000000"
          }
        },
        {
          "ruleId": "MST.A2B08.auth.scope-amplification",
          "ruleIndex": 7,
          "kind": "pass",
          "level": "none",
          "message": {
            "text": "Probe executed against the reference A2A deployment. Result recorded for A2B08; see properties.method for what was varied."
          },
          "taxa": [
            {
              "id": "A2B08",
              "index": 7,
              "toolComponent": {
                "name": "A2ABreak",
                "guid": "7c1e5b93-0d62-4a87-b4f1-6e83a2c05d19",
                "index": 0
              }
            },
            {
              "id": "ASI03",
              "index": 2,
              "toolComponent": {
                "name": "OWASP Top 10 for Agentic Applications",
                "guid": "3f0d6a1e-8b47-4c2a-9d31-5e7f0a2b4c68",
                "index": 1
              }
            },
            {
              "id": "ASI07",
              "index": 6,
              "toolComponent": {
                "name": "OWASP Top 10 for Agentic Applications",
                "guid": "3f0d6a1e-8b47-4c2a-9d31-5e7f0a2b4c68",
                "index": 1
              }
            }
          ],
          "properties": {
            "method": "Diff granted scope against exercised scope per delegation edge. Any positive delta is the finding; the probe needs no knowledge of the downstream agent's implementation."
          },
          "partialFingerprints": {
            "probeInput/v1": "sha256:a2b0800000000000"
          }
        },
        {
          "ruleId": "MST.A2B09.identity.multi-hop-loss",
          "ruleIndex": 8,
          "kind": "notApplicable",
          "level": "none",
          "message": {
            "text": "Probe did not execute: A2B09 is not reachable by observation of conforming traffic. Coverage for A2B09 in this run is zero."
          },
          "taxa": [
            {
              "id": "A2B09",
              "index": 8,
              "toolComponent": {
                "name": "A2ABreak",
                "guid": "7c1e5b93-0d62-4a87-b4f1-6e83a2c05d19",
                "index": 0
              }
            },
            {
              "id": "ASI03",
              "index": 2,
              "toolComponent": {
                "name": "OWASP Top 10 for Agentic Applications",
                "guid": "3f0d6a1e-8b47-4c2a-9d31-5e7f0a2b4c68",
                "index": 1
              }
            },
            {
              "id": "ASI07",
              "index": 6,
              "toolComponent": {
                "name": "OWASP Top 10 for Agentic Applications",
                "guid": "3f0d6a1e-8b47-4c2a-9d31-5e7f0a2b4c68",
                "index": 1
              }
            }
          ],
          "properties": {
            "reason": "The protocol establishes identity at the transport layer and carries no delegation context token, so provenance is absent from the wire rather than merely unverified. Recovering it requires a protocol extension, not a better observer."
          },
          "partialFingerprints": {
            "probeInput/v1": "sha256:a2b0900000000000"
          }
        },
        {
          "ruleId": "MST.A2B10.delegation.cycle",
          "ruleIndex": 9,
          "kind": "pass",
          "level": "none",
          "message": {
            "text": "Probe executed against the reference A2A deployment. Result recorded for A2B10; see properties.method for what was varied."
          },
          "taxa": [
            {
              "id": "A2B10",
              "index": 9,
              "toolComponent": {
                "name": "A2ABreak",
                "guid": "7c1e5b93-0d62-4a87-b4f1-6e83a2c05d19",
                "index": 0
              }
            },
            {
              "id": "ASI08",
              "index": 7,
              "toolComponent": {
                "name": "OWASP Top 10 for Agentic Applications",
                "guid": "3f0d6a1e-8b47-4c2a-9d31-5e7f0a2b4c68",
                "index": 1
              }
            },
            {
              "id": "ASI07",
              "index": 6,
              "toolComponent": {
                "name": "OWASP Top 10 for Agentic Applications",
                "guid": "3f0d6a1e-8b47-4c2a-9d31-5e7f0a2b4c68",
                "index": 1
              }
            }
          ],
          "properties": {
            "method": "Build the delegation graph from observed traffic and run cycle detection on it. A cycle is structural: it is visible before it deadlocks."
          },
          "partialFingerprints": {
            "probeInput/v1": "sha256:a2b1000000000000"
          }
        },
        {
          "ruleId": "MST.A2B11.task.interrupt-no-timeout",
          "ruleIndex": 10,
          "kind": "pass",
          "level": "none",
          "message": {
            "text": "Probe executed against the reference A2A deployment. Result recorded for A2B11; see properties.method for what was varied."
          },
          "taxa": [
            {
              "id": "A2B11",
              "index": 10,
              "toolComponent": {
                "name": "A2ABreak",
                "guid": "7c1e5b93-0d62-4a87-b4f1-6e83a2c05d19",
                "index": 0
              }
            },
            {
              "id": "ASI08",
              "index": 7,
              "toolComponent": {
                "name": "OWASP Top 10 for Agentic Applications",
                "guid": "3f0d6a1e-8b47-4c2a-9d31-5e7f0a2b4c68",
                "index": 1
              }
            },
            {
              "id": "ASI03",
              "index": 2,
              "toolComponent": {
                "name": "OWASP Top 10 for Agentic Applications",
                "guid": "3f0d6a1e-8b47-4c2a-9d31-5e7f0a2b4c68",
                "index": 1
              }
            }
          ],
          "properties": {
            "method": "Drive a task into each interruptible state, withhold the resuming input, and measure time to reclamation. No reclamation inside the observation window is the finding."
          },
          "partialFingerprints": {
            "probeInput/v1": "sha256:a2b1100000000000"
          }
        }
      ],
      "properties": {
        "declaredTestedLevel": "This run establishes an observation-layer tested level for the eight findings marked observable. It establishes nothing for A2B02, A2B05 and A2B09, which require a protocol extension rather than a better observer.",
        "source": "Vulnerability identifiers and descriptions follow A2ABreak (arXiv:2609.10871v1). The probe definitions, the observability classification and the ASI relationships are MASec Lab's own and are not claimed by that paper.",
        "disclaimer": "Taxonomy relationships express the tool author's reading of where a finding sits. They are not a conformity assessment and carry no legal effect."
      }
    }
  ]
}