Governance · Research
AI agent incidents: what can you prove?
METR asks how to investigate the behavior behind AI incidents. Oktsec examines the deployment evidence: what ran, which permissions applied and where the record ends.
Research
Oktsec Research
We investigate how agent systems fail, reproduce the attack paths and turn the findings into controls teams can use.
34 publications27 research7 incident analysesUpdated Sep 9, 2026RSS
Original findings, reproducible labs and product research.
Governance · Research
The agent governance gap, in numbers.
A review of agent governance surveys, telemetry and guidance, with sample sizes, source limitations and practical control questions.
MCP security · Protocol analysis
MCP 2026-07-28 moves the security boundary to the server.
The shipped 2026-07-28 specification removes protocol sessions and makes requests easier to scale. It also leaves state integrity, authorization and resource controls squarely in each implementation.
Agent security · Research
Autonomy is a security boundary.
Approval, supervision, bounded autonomy and recovery impose different controls. A framework for assigning authority to each consequential action.
Agent security · Research
Agent tooling CVEs: configuration, paths and client trust.
Seven CVEs illustrate distinct failures in configuration loading, path handling and client/server trust, with links to vendor advisories.
Agent security · Research
How agent security benchmarks actually score.
AgentDojo, InjecAgent, ASB, MCPSecBench, MSB and MCPTox measure different attack classes, so their scores are not directly comparable.
Agent security · Research
What the research shows about defending AI agents.
A dated review of agent defenses, benchmark results and threat models. What PromptArmor, CommandSans, CaMeL and authorization studies do and do not establish.
MCP security · Research
How exposed are MCP servers, really?
What public repository scans, internet exposure studies and attack benchmarks establish about MCP risk, with their sampling limits.
Authorization · Research
Authorization telemetry for AI agents: tracing tool call decisions.
How to instrument the authorization decision on every agent tool call and export identity, tool, arguments and policy verdict through OpenTelemetry.
MCP security · Guide
How to secure an MCP server.
A practical MCP security guide: authenticate callers, limit tool capabilities, inspect untrusted content, isolate execution and preserve useful audit records.
Supply chain · Research
How to audit a Claude skill before you run it.
Read SKILL.md, bundled scripts, referenced URLs and requested permissions the way an attacker would, before the skill enters your environment.
Authorization · Research
Detection and authorization in AI agent security.
Detection can identify and block threats. Authorization checks permissions. How to combine both with isolation and reliable evidence.
Identity · Research
The agent identity crisis, four months later.
Signed Agent Cards, MCP enterprise managed authorization and task scoped token research: what each contributes to agent identity and what deployments still need to enforce.
Identity · Protocol analysis
MCP is making request identity explicit.
MCP is moving authorization context from the connection to each request. The direction is clear; security still depends on how every server implements identity and policy.
Supply chain · Research
Skills over MCP: who checks the manual?
SEP-2640 proposes distributing skills through MCP. How manifests, provenance and host approval work, and where the deployment still needs enforceable permissions.
Supply chain · Research
The agent supply chain is bigger than your dependency tree.
The agent supply chain is every artifact an agent pulls into your environment: packages, MCP servers, skills and the trust behind them.
Governance · Research
Agent work needs evidence, not trust.
What agent records establish about identity, permissions and outcomes, and how to verify their integrity without overlooking gaps in coverage.
Identity · Research
The identity stack for AI agents: what shipped, what didn’t.
A scoped review of signed Agent Cards, enterprise-managed access, task authorization research and the integration work needed for runtime attribution.
MCP security · Guide
What an MCP server actually exposes.
A practical, audit grounded map of tool surfaces, credentials, network reach and the trust boundaries that decide your real attack surface.
Authorization · Note
Prompt injection needs content and action controls.
How content inspection, explicit permissions and isolation address different parts of prompt injection risk in tool-using agents.
Supply chain · Research
MCP as a supply chain: trust boundaries in agent tooling.
Five boundaries to review before and after connecting an MCP server: tool descriptions, permissions, authentication, dependencies and runtime changes.
Authorization · Build note
AgentPay: what we built at the Anthropic × Kaszek hackathon.
A prototype that puts deterministic security checks in front of payments an AI agent tries to execute. The same product lesson now shapes Oktsec: control the action before it runs.
Authorization · Engineering
Policy before agent execution: what security has to control.
How runtime policy checks identity, tools, parameters and destinations, alongside scanning, isolation and audit records.
Governance · Product essay
Security is a product decision, not a checklist.
The most consequential call a technical founder makes is what not to ship. Agent security cannot wait for an incident before becoming part of the product surface.
Governance · Research
The CSA Agentic Trust Framework, in plain terms.
What zero trust means for AI agents, and how the framework maps to authorization, signed policy and verified evidence in practice.
Identity · Research
AI agent identity: attribution, delegation and tool permissions.
How workload identity, delegated authority and per-tool records help attribute agent actions, with a review of available standards.
Supply chain · Field note
How to evaluate trust in public agent tooling.
A practical review model for public agent tooling: permissions, provenance, install paths, version pinning and change over time.