Research
Methodology, in the open.
The point of a lab is the framework, not the demo. These are the foundations MASec Lab builds tooling on — open enough to be used, cited, and challenged.
Specified, Not Enforced — the MCP authorization requirements
The authorization specification says MUST, repeatedly and precisely, and roughly forty percent of internet-reachable MCP servers carry no authentication at all. The gap is not an observability problem: seven of ten expectations are decidable by a prober holding nothing but a client position, which makes the compliance figure a nobody-looked problem rather than a hard one. The tenth is the title stated literally — a restriction announced at discovery and not applied at execution, specified by the operator and enforced nowhere. Two need the implementation's configuration, a vantage-point limit rather than a property of the requirement. The last is decidable by nothing — a token obtained after a user read every scope and one obtained after a user clicked through are byte-identical — and that residue is the confused deputy stated as a measurement problem rather than an attack. Ships as SARIF, with three probes naming the module that runs them and the rest saying so by omission.
Read the methodology →Shared State Crosstalk — tenant boundaries in agent runtimes
Two ChatGPT code-execution containers under unrelated accounts had no network path to each other and no public Internet — and still passed data through the vetted package mirror both needed to install dependencies. The reader credential issued to them also carried Annotate, and item properties were not partitioned per account. Separates the two failures the incident is usually filed as one: shared mutable state without tenant scoping, and instructions executed with authority they were never delegated. Seven probe axes for the first, five for the second, and the behavioural signatures that catch a hidden second task stream without reading the injection at all.
Read the methodology →Delegated, Not Attributed — eleven protocol flaws in A2A
A2ABreak, the first systematic security analysis of Agent2Agent, reports eleven protocol-level vulnerabilities across discovery, initiation, execution and interruption -- then leaves mitigation to future work. This page asks the operational question the paper does not: which of the eleven are reachable by observing conforming traffic, without modifying the protocol or the agents. Eight are. Three are not, because the information -- a delegation token, a capability attestation, a per-chunk digest -- was never on the wire. The mapping to the OWASP Agentic Top 10 ships as SARIF with the three gaps present as notApplicable rather than omitted.
Read the methodology →Three Calls to Compromise — runtime-gated rug pulls
Deadbugz shipped a malicious MCP server that behaves perfectly for three tool calls, then rewrites its own tool descriptions into credential-hunting instructions. The counter is the simplest possible trigger; this page generalises it into six gate classes and gives the differential re-listing procedure that covers five of them. The durable result: if a server holds state, tools/list is a function of session history, and sampling it once tells you about the one point the attacker already priced in.
Read the methodology →ASI × EU AI Act — the crosswalk as an artifact
Prose mappings from the OWASP Agentic Top 10 to the AI Act exist, and several still quote a deadline the Digital Omnibus moved. This one ships as a validated SARIF 2.1.0 file: the mapping lives in taxonomies and relationships, so it is filterable rather than readable. Separates the four obligations that need an execution record from the ones a document satisfies — and emits probes that could not run as notApplicable with a reason, because a coverage claim you cannot check is not a coverage claim.
Read the methodology →Agent Behavioural Fingerprinting
Agents are non-deterministic, so signature-based checks miss them. ABFP profiles an agent by the shape of its behaviour — tool-call sequences, reasoning patterns, timing — and builds a baseline. Hijacked, impersonated, or drifting agents then show up as deviations from that baseline rather than as known-bad payloads.
Read the methodology →Hierarchical Capability & Attestation Protocol
When agent A delegates to agent B, what is B actually allowed to do, and who said so? HCAP makes capability and its provenance explicit and verifiable down a delegation chain, so over-privilege and confused-deputy attacks are detectable rather than implicit.
Read the methodology →OWASP Agentic Top 10 coverage
Detection mapped to the agentic threat classes — memory poisoning, tool misuse, privilege compromise, intent breaking, cascading hallucination, and the rest — so an assessment produces findings against a shared, recognised taxonomy instead of ad-hoc notes.
Read the methodology →Signed, Not Safe — A2A v1.0 signed Agent Cards
A2A v1.0 shipped cryptographically signed Agent Cards — closing card spoofing and in-transit tampering. But a legitimately signed card with adversarial description fields is still a working prompt-injection vector at the agent-selection layer. Signature verification and content trust are two separate gates; this piece shows why, and where ABFP-style behavioural baselining closes the second.
Read the methodology →Checked, Then Changed — TOCTOU in agentic systems
Four July 2026 findings the industry filed as separate bugs are one vulnerability class: agentic systems verify an artifact at one moment and act on it at another, across windows measured in days rather than microseconds. UI redress, skill-registry poisoning, MCP rug-pulls and cached catalogue drift share a single shape — and in three of four cases the attacker chooses when the window closes. Defines the window as a measurable quantity and shows where HCAP and ABFP meet.
Read the methodology →Stateless, Not Traceless — the 2026-07-28 MCP threat model
The largest MCP revision since launch removes a primitive rather than adding a feature. Every behavioural rule built on the protocol grouped by session ID, and that key is gone — while the anchor replacing it is supplied by the client rather than issued by the server. Covers what statelessness costs detection, plus resumable state round-tripped through an untrusted client, header-body desync no intermediary verifies, and catalogue caching that hands tool poisoning a persistence window.
Read the methodology →Approved, Not Shown — the consent surface nobody verifies
Six mid-2026 coding-agent findings were filed as six vendor UI bugs. They are one class: the screen a human approves is rendered from attacker-controlled input, and nothing binds what was displayed to what was authorized. Defines the consent delta — actions authorized minus actions displayed — separates truncation, substitution and pre-emption, and proposes an attested render digest as the primitive the stack is missing.
Read the methodology →$ mst scan a2a://target.local --suite asi [ASI06] memory & context ......... 0 findings [ASI02] tool misuse .............. 2 findings [ASI03] privilege abuse .......... 1 finding report → out/target.sarif