OWASP ASI 2026 mapping
OWASP ASI 2026 coverage: 4 of 10
10 rules map to 4 of 10 categories. The table also shows categories that static source or configuration checks cannot cover.
4 of 10 categories have compiled-in coverage
- 04 Categories coveredBacked by rules in the engine.
- 10 Rules mappedEach mapping is published and inspectable.
- ALL Unmapped categoriesEmpty categories remain visible in the table.
| Category | Reach | Rules |
|---|---|---|
| ASI01 Agent Goal Hijack | good | agent-instructions-directive, agent-instructions-hidden-text |
| ASI02 Tool Misuse and Exploitation | poor | needs the agent's run-time behaviour, not its configuration |
| ASI03 Agent Identity and Privilege Abuse | partial | agent-config-env-redirect, agent-config-secret-reachable, agent-permission-wildcard |
| ASI04 Agentic Supply Chain Compromise | good | agent-config-loader-script, agent-marketplace-untrusted, agent-mcp-unpinned-remote, install-lifecycle-script |
| ASI05 Unexpected Code Execution | good | agent-hook-autoexec, agent-hook-untrusted-command |
| ASI06 Memory and Context Poisoning | poor | needs the agent's run-time behaviour, not its configuration |
| ASI07 Insufficient Human Oversight | partial | none yet |
| ASI08 Multi-Agent and Orchestration Exploitation | poor | needs the agent's run-time behaviour, not its configuration |
| ASI09 Insufficient Agent Observability | poor | needs the agent's run-time behaviour, not its configuration |
| ASI10 Unbounded Autonomy | poor | needs the agent's run-time behaviour, not its configuration |
What a configuration scanner can and cannot see
Instruction files, hooks, permissions, and tool declarations are checked into
the repository, so they are visible. Memory poisoning, tool misuse at run
time, and multi-agent orchestration need runtime data. Parsing
.claude/settings.json cannot detect them.
Why CWE is the primary mapping
CWE ids are stable across decades. The agentic list is new and will be renumbered, so every rule in this family declares a CWE and carries the ASI reference as additional context. Existing baselines therefore continue to use the stable CWE mapping if ASI numbering changes.
What this surface is / how to check a repository you did not write / the OWASP Top 10 table.
Keep reading
- owlwarden turnWhich of these did I just do?
- RulesTrigger, confidence, and framework-specific fix.
- Agent configHooks, MCP servers, instructions, and editor tasks.
- owlwarden vetCheck a repository before you open it.
- owlwarden sealNotice when your agent's execution surface moves.
- ExposureWhich of these findings do I fix first?
- RuntimesDoes this fix run on Bun, Deno, or Workers?
- CoverageMapped rules and categories static analysis cannot cover.