WeAreDevelopers World Congress North America. September 24, 2026, Stage 5.
Securing AI agent infrastructure
Identity, attestation, and behavioral trust at scale
Abdel Fane, Founder and CEO, OpenA2A
Slides from the September 24, 2026 session (PDF, 15 slides)
Three commands
The commands from the last slide. No account needed. Each tool works on its own.
- Find what is running. Lists the AI assistants, MCP servers and credential references in a repository and the machine-wide configs it reads.Read the docs
- Wrap one agent. Gives the agent an Ed25519 keypair, a capability grant, and an audit trail. Calls outside the grant are refused before they run.Read the docs
- Break it on purpose. Damn Vulnerable AI Agent: deliberately vulnerable agents to attack locally.Read the docs
The demo from the talk
Same code, run twice. The second run has an identity: the agent is registered, granted logs:read and tickets:create, runs its job, and then tries http:post. In strict enforcement mode the SDK raises ActionDeniedError before the side effect, and the refusal is recorded on the audit trail.
from aim_sdk import secure
agent = secure("soc-triage-agent")The demo project from the stage is not published; the SDK calls it makes are. The AIM docs cover registering an agent, granting capabilities, and reading the audit trail.
Resources from the talk
Tools
- AIM on GitHub, opens in a new tab Source for the AIM server, dashboard and SDKs.
- AIM Cloud, opens in a new tab Hosted AIM, if you would rather not run the server yourself.
- aim-sdk on PyPI, opens in a new tab The Python SDK used in the demo.
- HackMyAgent on GitHub, opens in a new tab The scanner behind npx hackmyagent detect.
- DVAA on GitHub, opens in a new tab Damn Vulnerable AI Agent: source and attack scenarios.
- DVAA on Docker Hub, opens in a new tab The image in the docker run command above.
Specs
- ATX: Agent Trust eXtension, opens in a new tab The agent credential format, with hybrid Ed25519 and ML-DSA-65 signatures.
- A2A: agent identity verification and trust framework, opens in a new tab Proposal to the A2A specification, pull request #1496 (open).
- OpenTelemetry: agentic authorization semantic conventions, opens in a new tab agent.trust_score, agent.drift_score and fga.* attributes, issue #180 (open).
- AIM trust score: nine factors and their weights, opens in a new tab Verification is 25% of the score. The source of the reference implementation used in the talk.
Sources cited in the slides
- OpenA2A Behavioral Threat Report, Issue 5, opens in a new tab The MCP connection, resource read and tool call counts in the talk.
- The lethal trifecta for AI agents, opens in a new tab Simon Willison, June 2025. The frame the talk opens with.
Research
- Research, opens in a new tab Security research on AI agent infrastructure
- Agent Threat Matrix, opens in a new tab Tactics and techniques for AI agents
Questions about the talk: info@opena2a.org