Research
Methodology, in the open.
The point of a lab is the framework, not the demo. These are the foundations MASec Lab builds tooling on — open enough to be used, cited, and challenged.
Three Calls to Compromise — runtime-gated rug pulls
Deadbugz shipped a malicious MCP server that behaves perfectly for three tool calls, then rewrites its own tool descriptions into credential-hunting instructions. The counter is the simplest possible trigger; this page generalises it into six gate classes and gives the differential re-listing procedure that covers five of them. The durable result: if a server holds state, tools/list is a function of session history, and sampling it once tells you about the one point the attacker already priced in.
Read the methodology →ASI × EU AI Act — the crosswalk as an artifact
Prose mappings from the OWASP Agentic Top 10 to the AI Act exist, and several still quote a deadline the Digital Omnibus moved. This one ships as a validated SARIF 2.1.0 file: the mapping lives in taxonomies and relationships, so it is filterable rather than readable. Separates the four obligations that need an execution record from the ones a document satisfies — and emits probes that could not run as notApplicable with a reason, because a coverage claim you cannot check is not a coverage claim.
Read the methodology →Agent Behavioural Fingerprinting
Agents are non-deterministic, so signature-based checks miss them. ABFP profiles an agent by the shape of its behaviour — tool-call sequences, reasoning patterns, timing — and builds a baseline. Hijacked, impersonated, or drifting agents then show up as deviations from that baseline rather than as known-bad payloads.
Read the methodology →Hierarchical Capability & Attestation Protocol
When agent A delegates to agent B, what is B actually allowed to do, and who said so? HCAP makes capability and its provenance explicit and verifiable down a delegation chain, so over-privilege and confused-deputy attacks are detectable rather than implicit.
Read the methodology →OWASP Agentic Top 10 coverage
Detection mapped to the agentic threat classes — memory poisoning, tool misuse, privilege compromise, intent breaking, cascading hallucination, and the rest — so an assessment produces findings against a shared, recognised taxonomy instead of ad-hoc notes.
Read the methodology →Signed, Not Safe — A2A v1.0 signed Agent Cards
A2A v1.0 shipped cryptographically signed Agent Cards — closing card spoofing and in-transit tampering. But a legitimately signed card with adversarial description fields is still a working prompt-injection vector at the agent-selection layer. Signature verification and content trust are two separate gates; this piece shows why, and where ABFP-style behavioural baselining closes the second.
Read the methodology →Checked, Then Changed — TOCTOU in agentic systems
Four July 2026 findings the industry filed as separate bugs are one vulnerability class: agentic systems verify an artifact at one moment and act on it at another, across windows measured in days rather than microseconds. UI redress, skill-registry poisoning, MCP rug-pulls and cached catalogue drift share a single shape — and in three of four cases the attacker chooses when the window closes. Defines the window as a measurable quantity and shows where HCAP and ABFP meet.
Read the methodology →Stateless, Not Traceless — the 2026-07-28 MCP threat model
The largest MCP revision since launch removes a primitive rather than adding a feature. Every behavioural rule built on the protocol grouped by session ID, and that key is gone — while the anchor replacing it is supplied by the client rather than issued by the server. Covers what statelessness costs detection, plus resumable state round-tripped through an untrusted client, header-body desync no intermediary verifies, and catalogue caching that hands tool poisoning a persistence window.
Read the methodology →Approved, Not Shown — the consent surface nobody verifies
Six mid-2026 coding-agent findings were filed as six vendor UI bugs. They are one class: the screen a human approves is rendered from attacker-controlled input, and nothing binds what was displayed to what was authorized. Defines the consent delta — actions authorized minus actions displayed — separates truncation, substitution and pre-emption, and proposes an attested render digest as the primitive the stack is missing.
Read the methodology →$ mst scan a2a://target.local --suite asi [ASI06] memory & context ......... 0 findings [ASI02] tool misuse .............. 2 findings [ASI03] privilege abuse .......... 1 finding report → out/target.sarif