Insights, updates, and best practices for AI agent security and identity management
Sam asked an AI agent to do two boring things last week: book a flight to San Jose and pay the electric bill. Delta turned the agent away. The bank blocked it. The agent hadn't done anything wrong. It just couldn't prove it.
Issue 6 of the Behavioral Threat Report is out. Connections to our decoy MCP servers fell this window, and the tool calls behind them went from 9 to 420. Here is what that means, what it doesn't, and what to do about it this month.
The first commit of AIM was made on October 24, 2025. What you can run today, the SDK versions on PyPI and npm, and where the roadmap lists what comes next.
In May 2026 hackmyagent, opena2a and ai-trust changed how the telemetry install ID is made, without the notice our privacy policy promised. How to opt out.
What Issue 5 of our Behavioral Threat Report found, and what to change on your own systems this month.
ARIA's June 2026 behavioral threat report. Exposed AI services rose to 320,506 while attacker attention concentrated onto the Model Context Protocol, which drew 97.9% of observed events. A2A traffic receded, 41% of distinct fingerprints recurred, and exposure relocated toward unauthenticated inference servers. Every number anchored to a 30-day window of live instrumentation.
An EDR sensor records an agent's processes and connections, and a CASB or proxy records the AI services it calls. None of their event logs holds the contents of the MCP config that says what the agent may do. A table of what each tool observes, with a source for every row, and how opena2a detect reads the rest locally.
When an AI agent is allowed or denied an action, the on-call engineer asks one question: why? For most systems that answer is nowhere. AIM emits every authorization decision as an OpenTelemetry span, one child span per check, so why becomes a trace lookup in the stack you already run.
Ahead of my SVCC 2026 talk: agent identity tells you who an agent is once. It does not tell you whether the agent you authorized five minutes ago is still safe to act now. Here are the open OpenA2A specifications for continuous trust and authorization, and where each one honestly stands.
Every AI agent that ever did the wrong thing had a system prompt telling it not to. The PocketOS database wipe and the Anthropic Opus 4.6 findings are versions of the same observation: the model is not the boundary.
ARIA's first 30-day behavioral threat report. 45% of distinct fingerprints appeared in more than one session. 75% of events targeted MCP. Every number anchored to live instrumentation.
Step-by-step guide to implementing the SecurityProductAdapter interface and running 223 attack scenarios against your security product. Same tests, same scorecard, transparent comparison.
Secretless AI stores credentials in five encrypted backends (1Password, OS Keychain, HashiCorp Vault, GCP Secret Manager, local AES-256) and injects them at runtime. In Claude Code a PreToolUse hook blocks credential file reads. Cursor, Copilot, Windsurf, and Cline get an instruction file that nothing enforces. Open source.
AI Browser Guard is now available on the Chrome Web Store. Detect Playwright, Puppeteer, Selenium, Computer Use, and Operator in your browser. Delegation rules, emergency kill switch, session timeline. Zero network requests by default, fully local processing.
Scanning finds vulnerabilities. Shielding prevents exploitation. OpenA2A Shield combines credential protection, configuration integrity monitoring, runtime detection, and security posture scoring into a unified layer for AI projects.
AI coding assistants read your .env files, terminal history, and MCP server configs. Every API key in your project is one autocomplete away from a cloud log. Here is how to protect credentials without breaking your workflow.
Run opena2a review in any project directory and get a security posture score with credential scanning, configuration hygiene checks, and actionable fix commands. Works with any AI project.
In December 2025, researchers extracted Claude's internal soul document, the training-embedded values that shape its behavior. OASB v2 now formalizes behavioral governance with 72 controls across 9 new domains. Here's why every AI agent needs a soul document and how to audit yours.
Store API keys and MCP server secrets in encrypted backends such as the OS keychain or 1Password, and inject them at runtime without exposing values. In Claude Code a PreToolUse hook blocks credential file reads. Cursor, Copilot, Windsurf, and Cline get an instruction file that nothing enforces, and Aider gets ignore patterns.
AI agents are deploying faster than security teams can assess them. OASB brings the CIS Benchmark model to agentic AI: 46 controls, 10 categories, 3 maturity levels. Machine-readable, automatable, and open source.
ARP (Agent Runtime Protection) monitors OS-level activity and AI-layer traffic with 20 built-in threat patterns. Process, network, filesystem monitoring plus prompt injection, MCP exploitation, and A2A attack detection. EDR for AI agents.
We contributed 6 security fixes to OpenClaw (390,000+ stars). 4 PRs merged directly, 2 adopted by maintainers. Fixes cover credential redaction, code safety scanning, path traversal, file permissions, timing side-channels, and npm lifecycle attacks.
DVAA (Damn Vulnerable AI Agent) is an intentionally vulnerable platform for learning AI agent security. 17 agents, 12 vulnerability categories, 22 CTF challenges across 3 protocols. The DVWA of AI agents.
AI agents are making decisions, calling APIs, and accessing sensitive data autonomously. But most have no real identity, just shared API keys and bearer tokens. Here's how to give every agent a cryptographic identity that's verifiable, auditable, and enforceable at runtime.
OAuth 2.0 and OpenID Connect power human authentication across the web. But AI agents aren't humans. They don't click consent screens, bearer tokens can't prove which agent acted, and scopes can't enforce capabilities at runtime. Here's the identity gap the industry is ignoring and how AIM solves it.
OASB (Open Agent Security Benchmark) is an open security benchmark for AI agents. 46 controls across 10 categories with L1/L2/L3 maturity levels. The CIS Benchmark for agentic AI.
PR #9806 merged 1,721 lines of code into OpenClaw (390,000+ GitHub stars), adding a built-in skill security scanner that detects malicious patterns across 6 check categories before skills can execute. The scanner runs automatically at install and update time.
HackMyAgent v0.4.0 ships the first automated detection for CVE-2026-25253 (CVSS 8.8), expanded ClawHavoc campaign IOCs, and 11 new security checks for OpenClaw installations.
HackMyAgent is an open-source security toolkit for AI agents: adversarial attack payloads, static security checks and OASB-1 compliance benchmarks, shown against DVAA's intentionally vulnerable LegacyBot.
We scanned 97,013 internet-facing hosts for AI agent vulnerabilities. 14.4% had confirmed security issues. 1,190 had system instructions publicly readable. 645 had MCP tool definitions exposed. Here's what we found and what we're doing about it.
Traditional NHI platforms manage service accounts and API keys. But AI agents represent a fundamentally different class of non-human identity that requires purpose-built governance. Here's the gap in your NHI strategy.
The ClawHavoc campaign planted 341 malicious skills on ClawHub. Combined with GHSA-g8p2's 1-click RCE vulnerability, OpenClaw users face credential theft, reverse shells, and persistent backdoors. We built a scanner to detect it.
OWASP released their Top 10 for Agentic Applications in December 2025. Here's how each risk maps to NHI governance capabilities, and what you can do about it.
January 2026 marked a turning point in AI security. ServiceNow disclosed what researchers called 'the most severe AI-driven vulnerability uncovered to date', exposing 85% of Fortune 500 companies to potential takeover through improperly secured AI agents.
AIM (Agent Identity Management) is now available. Secure your AI agents with one line of code. Cryptographic identity, MCP attestation, trust scoring, and comprehensive audit logging for production AI deployments.
This article discusses critical vulnerabilities in AI agent systems, particularly focusing on CVE-2025-32711 (EchoLeak) affecting Microsoft Copilot and CVE-2025-49596 in MCP servers. Learn how to secure your AI agents with Agent Identity Management (AIM).
Get started with AIM and protect your AI infrastructure with one line of code against a running AIM server