Agent security · Research
AI agent skill security: the OWASP Top 10 explained.
Ten risks in the skills your agents load, with practical examples, an approval workflow and eight tests for permissions, scanning, updates and recovery.
Research
Oktsec Research
We investigate how agent systems fail, reproduce the attack paths and turn the findings into controls teams can use.
42 publications33 research9 incident analysesUpdated Sep 20, 2026RSS
Original findings, reproducible labs and product research.
Agent security · Research
Cyber hygiene for AI agents.
A practical guide for startups and security teams: inventory agent tools, limit access, monitor changes and verify fixes. With examples drawn from an incident-response workflow.
Agent security · Research
AI coding agents need more than secure code.
Follow a billing API patch from code review to tool permissions and dependency monitoring. What to check, what evidence to keep, and where Oktsec fits.
Agent security · Research
What is an AI agent harness?
The harness connects a model to tools, data and systems. We explain ASD’s guidance through one engineering task: what the agent can do, where permissions apply and how to verify the result.
Governance · Research
Amodei wants to slow the AI race. Can safety catch up?
The proposal, the responses from Altman and Musk, and the security checks companies can make before giving agents more access.
Agent security · Research
AI agent access is not authority.
An agent can solve a problem and still exceed its assignment. What OpenAI’s enterprise security guide means for tool permissions, approvals and evidence.
Agent security · Research
Defense Factory: from security findings to verified fixes.
OpenAI’s Defense Factory connects findings to verified fixes. The agents doing that work need scoped access and evidence that follows the patch into production.
Governance · Research
AI agent incidents: what can you prove?
METR asks how to investigate the behavior behind AI incidents. Oktsec examines the deployment evidence: what ran, which permissions applied and where the record ends.
Governance · Research
The agent governance gap
A review of agent governance surveys, telemetry and guidance, with sample sizes, source limitations and practical control questions.
MCP security · Protocol analysis
MCP 2026-07-28 moves the security boundary to the server.
The shipped 2026-07-28 specification removes protocol sessions and makes requests easier to scale. It also leaves state integrity, authorization and resource controls squarely in each implementation.
Agent security · Research
Autonomy is a security boundary.
Approval, supervision, bounded autonomy and recovery impose different controls. A framework for assigning authority to each consequential action.
Agent security · Research
Agent tooling CVEs: configuration, paths and client trust.
Seven CVEs illustrate distinct failures in configuration loading, path handling and client/server trust, with links to vendor advisories.
Agent security · Research
AI agent security benchmarks: how to read the scores.
AgentDojo, InjecAgent, ASB, MCPSecBench, MSB and MCPTox measure different attack classes, so their scores are not directly comparable.
Agent security · Research
Prompt injection defenses: what the research shows.
A dated review of agent defenses, benchmark results and threat models. What PromptArmor, CommandSans, CaMeL and authorization studies do and do not establish.
MCP security · Research
How exposed are MCP servers, really?
What public repository scans, internet exposure studies and attack benchmarks establish about MCP risk, with their sampling limits.
Authorization · Research
Authorization telemetry for AI agents: tracing tool call decisions.
How to instrument the authorization decision on every agent tool call and export identity, tool, arguments and policy verdict through OpenTelemetry.
MCP security · Guide
How to secure an MCP server.
A practical MCP security guide: authenticate callers, limit tool capabilities, inspect untrusted content, isolate execution and preserve useful audit records.
Supply chain · Research
How to audit a Claude skill before you run it.
Read SKILL.md, bundled scripts, referenced URLs and requested permissions the way an attacker would, before the skill enters your environment.
Authorization · Research
Detection and authorization in AI agent security.
Detection can identify and block threats. Authorization checks permissions. How to combine both with isolation and reliable evidence.
Identity · Research
The agent identity crisis, four months later.
Signed Agent Cards, MCP enterprise managed authorization and task scoped token research: what each contributes to agent identity and what deployments still need to enforce.
Identity · Protocol analysis
MCP is making request identity explicit.
MCP is moving authorization context from the connection to each request. The direction is clear; security still depends on how every server implements identity and policy.
Supply chain · Research
Skills over MCP: who checks the manual?
SEP-2640 proposes distributing skills through MCP. How manifests, provenance and host approval work, and where the deployment still needs enforceable permissions.
Supply chain · Research
The agent supply chain is bigger than your dependency tree.
The agent supply chain is every artifact an agent pulls into your environment: packages, MCP servers, skills and the trust behind them.
Governance · Research
Agent work needs evidence, not trust.
What agent records establish about identity, permissions and outcomes, and how to verify their integrity without overlooking gaps in coverage.
Identity · Research
The identity stack for AI agents: what shipped, what didn’t.
A scoped review of signed Agent Cards, enterprise-managed access, task authorization research and the integration work needed for runtime attribution.
MCP security · Guide
What an MCP server actually exposes.
A practical, audit grounded map of tool surfaces, credentials, network reach and the trust boundaries that decide your real attack surface.
Authorization · Note
Prompt injection needs content and action controls.
How content inspection, explicit permissions and isolation address different parts of prompt injection risk in tool-using agents.
Supply chain · Research
MCP as a supply chain: trust boundaries in agent tooling.
Five boundaries to review before and after connecting an MCP server: tool descriptions, permissions, authentication, dependencies and runtime changes.
Authorization · Engineering
Policy before agent execution: what security has to control.
How runtime policy checks identity, tools, parameters and destinations, alongside scanning, isolation and audit records.
Governance · Product essay
Security is a product decision, not a checklist.
The most consequential call a technical founder makes is what not to ship. Agent security cannot wait for an incident before becoming part of the product surface.
Governance · Research
CSA Agentic Trust Framework for AI agents.
What zero trust means for AI agents, and how the framework maps to authorization, signed policy and verified evidence in practice.
Identity · Research
AI agent identity: attribution, delegation and tool permissions.
How workload identity, delegated authority and per-tool records help attribute agent actions, with a review of available standards.
Supply chain · Field note
How to evaluate trust in public agent tooling.
A practical review model for public agent tooling: permissions, provenance, install paths, version pinning and change over time.