// mcp attack surface

The OWASP Agentic Top 10 — attack, detection, control

Give a model tools and autonomy, and you get a new attack surface. The OWASP Top 10 for Agentic Applications (2026) shows what goes wrong.

I think the model itself will be jailbroken. So prevention lives in the server, not the prompt. A control can be misscoped or misbuilt. So each risk also answers the question defenders really have: how do I know?

Each card is a prism. Click the right half to turn it forward, the left half back. Enter or ← → also work: attack → detection → control.

ASI01 : 2026

Agent Goal Hijack

Attack Injected text in a tool result or document rewrites the agent's objective.

ASI02 : 2026

Tool Misuse & Exploitation

Attack An attacker bends legitimate tools into destructive or over-scoped actions.

ASI03 : 2026

Identity & Privilege Abuse

Attack Over-broad or leaked credentials let the agent do more than its scope allows.

ASI04 : 2026

Agentic Supply Chain

Attack A poisoned tool, registry, or dependency subverts the agent.

ASI05 : 2026

Unexpected Code Execution

Attack Untrusted input reaches eval or exec: remote code execution.

ASI06 : 2026

Memory & Context Poisoning

Attack Adversarial data written into memory poisons future decisions.

ASI07 : 2026

Insecure Inter-Agent Comms

Attack An attacker spoofs, tampers, replays, or injects agent-to-agent and MCP messages.

ASI08 : 2026

Cascading Agent Failures

Attack One compromised or failing agent cascades across the system.

ASI09 : 2026

Human-Agent Trust Exploitation

Attack An attacker uses the agent to influence the human in the loop.

ASI10 : 2026

Rogue Agents

Attack An agent that ignores policy and runs undetected.

Categories from the OWASP Gen AI Security Project. More depth in the case for server-side controls. Attack these controls yourself. break this server runs the ladder in your browser. The wildcard that spans a slash sets a glob allowlist against an anchored regex. Both sit in the lab.