Blog | OpenA2A - AI Agent Security

#security-research#behavioral-security#ai-agents

The Attack Surface Is Widening. The Attackers Are Narrowing.

ARIA's June 2026 behavioral threat report. Exposed AI services rose to 320,506 while attacker attention concentrated onto the Model Context Protocol, which drew 97.9% of observed events. A2A traffic receded, 41% of attackers returned, and exposure relocated toward unauthenticated inference servers. Every number anchored to a 30-day window of live instrumentation.

Abdel Fane

June 15, 2026

#shadow-ai#agent-discovery#mcp-servers

Shadow IT Always Left a Trail. Shadow AI Doesn't.

Every previous class of shadow IT eventually showed up in a log. Shadow AI does not, and the agent your tools cannot see is the one holding your credentials. opena2a detect finds the unmanaged agents and MCP servers on a machine, and runs locally without sending anything back.

OpenA2A Team

June 13, 2026

#observability#opentelemetry#agent-authorization

Make Every Agent Authorization a Span

When an AI agent is allowed or denied an action, the on-call engineer asks one question: why? For most systems that answer is nowhere. AIM emits every authorization decision as an OpenTelemetry span, one child span per check, so why becomes a trace lookup in the stack you already run.

OpenA2A Team

June 11, 2026

#agent-identity#continuous-trust#ai-agents

Identity Is Not Enough: Continuous Trust for AI Agents

Ahead of my SVCC 2026 talk: agent identity tells you who an agent is once. It does not tell you whether the agent you authorized five minutes ago is still safe to act now. Here are the open OpenA2A specifications for continuous trust and authorization, and where each one honestly stands.

Abdel Fane

June 8, 2026

#ai-agents#security-research#runtime-security

System Prompts Are Not Security Boundaries

Every AI agent that ever did the wrong thing had a system prompt telling it not to. The PocketOS database wipe, the Anthropic Opus 4.6 findings, and 7,630 T1550 events in our honeypot data are versions of the same observation: the model is not the boundary.

Abdel Fane

May 15, 2026

#security-research#behavioral-security#ai-agents

45% of AI Agent Attackers Come Back. We Just Published the Data.

ARIA's first 30-day behavioral threat report. 45% of unique attackers returned across multiple sessions. 75% of events targeted MCP. 95.1% callback rate against security-vertical honeypots. Every number anchored to live instrumentation.

Abdel Fane

May 12, 2026

#oasb#adapter#benchmark

Build your own OASB adapter: benchmark any security product

Step-by-step guide to implementing the SecurityProductAdapter interface and running 222 attack scenarios against your security product. Same tests, same scorecard, transparent comparison.

OpenA2A Team

March 23, 2026

#secretless-ai#credentials#ai-coding-tools

Secretless AI: We Solved Credential Protection for AI Coding Tools

Every AI coding tool on the market reads your credentials. No tool existed to stop it. Secretless AI is the first purpose-built solution: five encrypted backends (1Password, OS Keychain, HashiCorp Vault, GCP Secret Manager, local AES-256), runtime injection, and context-window blocking. Open source.

Abdel Fane

March 12, 2026

#browserguard#chrome-extension#ai-agents

AI Browser Guard Is Now on the Chrome Web Store

AI Browser Guard is now available on the Chrome Web Store. Detect Playwright, Puppeteer, Selenium, Computer Use, and Operator in your browser. Delegation rules, emergency kill switch, session timeline. Zero network requests by default, fully local processing.

OpenA2A Team

March 11, 2026

#shield#defense-in-depth#runtime-security

From Scanning to Shielding: Defense-in-Depth for AI Agents

Scanning finds vulnerabilities. Shielding prevents exploitation. OpenA2A Shield combines credential protection, configuration integrity monitoring, runtime detection, and security posture scoring into a unified layer for AI projects.

OpenA2A Team

March 4, 2026

#credentials#ai-coding-tools#security

Your AI Coding Tools Are Leaking Your API Keys

AI coding assistants read your .env files, terminal history, and MCP server configs. Every API key in your project is one autocomplete away from a cloud log. Here is how to protect credentials without breaking your workflow.

OpenA2A Team

March 1, 2026

#cli#security-review#ai-projects

OpenA2A CLI: One-Command Security Reviews for AI Projects

Run opena2a review in any project directory and get a security posture score with credential scanning, configuration hygiene checks, and actionable fix commands. Works with any AI project.

OpenA2A Team

February 27, 2026

#soul-md#ai-governance#oasb-v2

SOUL.md and the Future of AI Governance: Why Every Agent Needs a Soul Document

In December 2025, researchers extracted Claude's internal soul document, the training-embedded values that shape its behavior. OASB v2 now formalizes behavioral governance with 72 controls across 9 new domains. Here's why every AI agent needs a soul document and how to audit yours.

Abdel Fane

February 25, 2026

#secretless-ai#credentials#ai-coding-tools

How to Protect API Keys from AI Coding Tools (Without Breaking Your Workflow)

Block API keys, .env files, and MCP server secrets from entering AI context windows. Encrypted storage with OS keychain and 1Password backends. Runtime injection without exposing values. Works with Claude Code, Cursor, Copilot, Windsurf, Cline, and Aider.

OpenA2A Team

February 23, 2026

#oasb#benchmark#ai-agents

OASB: Why AI Agents Need CIS-Style Security Benchmarks

AI agents are deploying faster than security teams can assess them. OASB brings the CIS Benchmark model to agentic AI -- 46 controls, 10 categories, 3 maturity levels. Machine-readable, automatable, and open source.

OpenA2A Team

February 21, 2026

#arp#runtime-security#ai-agents

Introducing ARP: Runtime Security for AI Agents

ARP (Agent Runtime Protection) monitors OS-level activity and AI-layer traffic with 20 built-in threat patterns. Process, network, filesystem monitoring plus prompt injection, MCP exploitation, and A2A attack detection. EDR for AI agents.

OpenA2A Team

February 19, 2026

#openclaw#security#open-source

Securing OpenClaw: 6 Security Fixes Landed in Main

We contributed 6 security fixes to OpenClaw (205K+ stars). 4 PRs merged directly, 2 adopted by maintainers. Fixes cover credential redaction, code safety scanning, path traversal, file permissions, timing side-channels, and npm lifecycle attacks.

OpenA2A Team

February 17, 2026

#dvaa#security-training#ctf

Introducing DVAA: The AI Agent You're Supposed to Break

DVAA (Damn Vulnerable AI Agent) is an intentionally vulnerable platform for learning AI agent security. 17 agents, 12 vulnerability categories, 22 CTF challenges across 3 protocols. The DVWA of AI agents.

OpenA2A Team

February 13, 2026

#agent-identity#cryptography#ai-agents

How Do You Give an AI Agent a Verifiable, Auditable, Enforceable Identity?

AI agents are making decisions, calling APIs, and accessing sensitive data autonomously. But most have no real identity, just shared API keys and bearer tokens. Here's how to give every agent a cryptographic identity that's verifiable, auditable, and enforceable at runtime.

Abdel Fane

February 11, 2026

#oauth#oidc#ai-agents

OAuth and OIDC Were Never Designed for AI Agents: Here's What We Built Instead

OAuth 2.0 and OpenID Connect power human authentication across the web. But AI agents aren't humans. They don't click consent screens, bearer tokens can't prove which agent acted, and scopes can't enforce capabilities at runtime. Here's the identity gap the industry is ignoring and how AIM solves it.

Abdel Fane

February 10, 2026

#oasb#security#benchmark

Introducing OASB: The Security Benchmark for AI Agents

OASB (Open Agent Security Benchmark) is an open security benchmark for AI agents. 46 controls across 10 categories with L1/L2/L3 maturity levels. The CIS Benchmark for agentic AI.

OpenA2A Team

February 9, 2026

#openclaw#security#supply-chain

OpenClaw Merges Built-In Skill Security Scanner

PR #9806 merged 1,721 lines of code into OpenClaw (205K+ GitHub stars), adding a built-in skill security scanner that detects malicious patterns across 6 check categories before skills can execute. The scanner runs automatically at install and update time.

OpenA2A Team

February 6, 2026

#cve-2026-25253#openclaw#clawhavoc

CVE-2026-25253 Now Has a Scanner: Detecting the OpenClaw WebSocket RCE

HackMyAgent v0.4.0 ships the first automated detection for CVE-2026-25253 (CVSS 8.8), expanded ClawHavoc campaign IOCs, and 11 new security checks for OpenClaw installations.

OpenA2A Team

February 5, 2026

#hackmyagent#security#ai-agents

I Broke My AI Agent in 5 Minutes (And You Should Too)

HackMyAgent is an open-source security toolkit for AI agents. 115 attack payloads, 204 security checks, OASB-1 compliance benchmarks. The missing OWASP ZAP for agentic AI.

OpenA2A Team

February 4, 2026

#security-research#ai-agents#mcp

The State of AI Agent Security: 97,000 Hosts, 1,190 Exposed Configs, and What We Did About It

We scanned 97,013 internet-facing hosts for AI agent vulnerabilities. 14.4% had confirmed security issues. 1,190 had system instructions publicly readable. 645 had MCP tool definitions exposed. Here's what we found and what we're doing about it.

OpenA2A Team

February 3, 2026

#nhi#ai-agents#governance

Why Your NHI Strategy Doesn't Cover AI Agents

Traditional NHI platforms manage service accounts and API keys. But AI agents represent a fundamentally different class of non-human identity that requires purpose-built governance. Here's the gap in your NHI strategy.

Abdel Fane

February 2, 2026

#openclaw#security-scanner#supply-chain

341 Malicious Skills and a 1-Click RCE: Scanning OpenClaw Installations for ClawHavoc

The ClawHavoc campaign planted 341 malicious skills on ClawHub. Combined with GHSA-g8p2's 1-click RCE vulnerability, OpenClaw users face credential theft, reverse shells, and persistent backdoors. We built a scanner to detect it.

OpenA2A Team

January 31, 2026

#owasp#agentic-ai#nhi

The OWASP Agentic Top 10 and What It Means for NHI Governance

OWASP released their Top 10 for Agentic Applications in December 2025. Here's how each risk maps to NHI governance capabilities, and what you can do about it.

Abdel Fane

January 26, 2026

#vulnerability-analysis#ai-security#ai-agents

The ServiceNow AI Vulnerability: What Went Wrong and How to Secure Your AI Agents

January 2026 marked a turning point in AI security. ServiceNow disclosed what researchers called 'the most severe AI-driven vulnerability uncovered to date', exposing 85% of Fortune 500 companies to potential takeover through improperly secured AI agents.

Abdel Fane

January 15, 2026

#launch#security#ai-agents

Introducing AIM: Open Source Security for AI Agents and MCP Servers

AIM (Agent Identity Management) is now available. Secure your AI agents with one line of code. Cryptographic identity, MCP attestation, trust scoring, and comprehensive audit logging for production AI deployments.

OpenA2A Team

December 16, 2025

#ai#security#llm

One Line of Code to Secure Your AI Agents (and Your Shadow MCP Servers)

This article discusses critical vulnerabilities in AI agent systems, particularly focusing on CVE-2025-32711 (EchoLeak) affecting Microsoft Copilot and CVE-2025-49596 in MCP servers. Learn how to secure your AI agents with Agent Identity Management (AIM).

Abdel Fane

November 7, 2025

Originally published on DEV.to

OpenA2A Blog

The Attack Surface Is Widening. The Attackers Are Narrowing.

Shadow IT Always Left a Trail. Shadow AI Doesn't.

Make Every Agent Authorization a Span

Identity Is Not Enough: Continuous Trust for AI Agents

System Prompts Are Not Security Boundaries

45% of AI Agent Attackers Come Back. We Just Published the Data.

Build your own OASB adapter: benchmark any security product

Secretless AI: We Solved Credential Protection for AI Coding Tools

AI Browser Guard Is Now on the Chrome Web Store

From Scanning to Shielding: Defense-in-Depth for AI Agents

Your AI Coding Tools Are Leaking Your API Keys

OpenA2A CLI: One-Command Security Reviews for AI Projects

SOUL.md and the Future of AI Governance: Why Every Agent Needs a Soul Document

How to Protect API Keys from AI Coding Tools (Without Breaking Your Workflow)

OASB: Why AI Agents Need CIS-Style Security Benchmarks

Introducing ARP: Runtime Security for AI Agents

Securing OpenClaw: 6 Security Fixes Landed in Main

Introducing DVAA: The AI Agent You're Supposed to Break

How Do You Give an AI Agent a Verifiable, Auditable, Enforceable Identity?

OAuth and OIDC Were Never Designed for AI Agents: Here's What We Built Instead

Introducing OASB: The Security Benchmark for AI Agents

OpenClaw Merges Built-In Skill Security Scanner

CVE-2026-25253 Now Has a Scanner: Detecting the OpenClaw WebSocket RCE

I Broke My AI Agent in 5 Minutes (And You Should Too)

The State of AI Agent Security: 97,000 Hosts, 1,190 Exposed Configs, and What We Did About It

Why Your NHI Strategy Doesn't Cover AI Agents

341 Malicious Skills and a 1-Click RCE: Scanning OpenClaw Installations for ClawHavoc

The OWASP Agentic Top 10 and What It Means for NHI Governance

The ServiceNow AI Vulnerability: What Went Wrong and How to Secure Your AI Agents

Introducing AIM: Open Source Security for AI Agents and MCP Servers

One Line of Code to Secure Your AI Agents (and Your Shadow MCP Servers)

Stay Updated on AI Agent Security

Ready to Secure Your AI Agents?