Governance · Research
NCSC Annual Review 2026: lessons for AI agent security
What the UK’s incident evidence and defensive AI plans mean for agent permissions, tool access, patching and verifiable controls.
Research
Oktsec Research
We investigate how agent systems fail, reproduce the attack paths and turn the findings into controls teams can use.
60 publications51 research9 incident analysesUpdated Nov 5, 2026RSS
Research, practical guides and incident analyses.
Governance · Research
AI risk after Black October: from Davos to the runtime
WEF’s risk outlook, October’s agent tooling incidents, and the permissions, deployment tests and evidence teams should review now.
Identity · Research
NIST’s agent identity tenets, read from the runtime
Ten proposed identity principles, the controls to test on a real tool call, and an implementation mapping of Oktsec with its deployment requirements and gaps.
AI threats · Infrastructure · Research
VAPOR PANDA and ARTEX: AI agents inside an espionage campaign
A technical review of the reported campaign, with checks for SAML validation, cloud roles, directory delegation, credential revocation and endpoint visibility.
AI threats · Latin America · Research
AI agents breached Argentine healthcare. What should your team check?
CrowdStrike reports at least 15 healthcare entities compromised and medical records stolen from at least one. We examine the attack workflow, two documented episodes and the controls teams should verify.
Infrastructure security · Research
Security recap, October 22–23: critical patches, exposed secrets and AI attacks
Critical PHP, GitLab and VeloCloud updates. LiteLLM, Railway and TiDB Cloud credential response. The eMudhra deadline, data disclosures and AI-assisted campaigns.
Infrastructure security · Research
PHP2Shell, Node.js and eMudhra: what broke this week and what to do now
AWS traces PHP2Shell attempts to October 17. Updated patch guidance, investigation checks and WAF limits, alongside Node.js fixes and the eMudhra certificate response.
Resilience and incident response · Guide
When a cyber attack stops your business: a recovery guide for teams and AI agents
Seven steps to keep operating and recover from a disruptive cyber attack. With an interactive diagnosis, recovery flows, an AI agent containment runbook and tabletop exercises.
Standards and compliance · Research
ISO/IEC 27090: What the new AI security standard means for your business
ISO/IEC 27090:2026 covers AI threats and extends zero trust to agent operations. What the guidance contains, how it fits with 27001 and 42001, and what to check in your systems.
Threat intelligence · Research
The malware explained every step to its operator. Is an AI agent behind it?
Unit 42 found conversational comments in scripts used against government Linux servers. What the evidence says about AI assistance, how the attack worked and what defenders can check.
Social engineering · Research
AI made targeted phishing cheaper. What stops it now?
AI-generated messages achieved a 54% click rate in one study, matching human experts. What cheaper personalization means for employee training, payment controls and AI assistants.
Agent authorization · Research
The deployment was authorized. Was the account?
An OpenAI research model completed a deployment using a wallet the task never supplied. What this case teaches teams about accounts, credentials and deployment permissions.
Insider threat · Research
Who is really behind your remote hire?
A verified identity and a company laptop do not always identify the person doing the work. Microsoft’s findings on AI personas, the FBI’s alert and practical checks for hiring, access and offboarding.
OT and IoT security · Research
Cold chain under attack: refrigeration controls and operational safety
CISA and four US agencies warn of attacks on refrigeration and cold chain monitoring. What is known, how far exposure extends and eight controls to verify with operations.
Application security · Research
What happens when AI reverse engineers your app?
Six security disclosures from 2026 show what exposed credentials and missing permissions can allow. Five checks to run before someone builds a different client for your API.
Threat intelligence · Research
How attackers steal company email: what to fix first.
An old server, a stolen password or an overprivileged app can put company email within reach. Lessons from the FBI, CISA and NSA advisory, with a practical plan for startups and security teams.
Agent security · Research
AI agent evaluation: test the workflow before you deploy.
MITRE’s AI Mission Testing Gap applied to enterprise agents: a supplier-payment example, six security tests and evidence for deciding when a pilot is ready.
Agent security · Research
AI agents in your startup: what to check this October.
Practical examples for founders and small teams: customer refunds, supplier invoices and sales data. Decide what AI can do, test the limits and prepare for mistakes.
Agent security · Research
AI agent skill security: the OWASP Top 10 explained.
Ten risks in the skills your agents load, with practical examples, an approval workflow and eight tests for permissions, scanning, updates and recovery.
Agent security · Research
Cyber hygiene for AI agents.
A practical guide for startups and security teams: inventory agent tools, limit access, monitor changes and verify fixes. With examples drawn from an incident-response workflow.
Agent security · Research
AI coding agents need more than secure code.
Follow a billing API patch from code review to tool permissions and dependency monitoring. What to check, what evidence to keep, and where Oktsec fits.
Agent security · Research
What is an AI agent harness?
The harness connects a model to tools, data and systems. We explain ASD’s guidance through one engineering task: what the agent can do, where permissions apply and how to verify the result.
Governance · Research
Amodei wants to slow the AI race. Can safety catch up?
The proposal, the responses from Altman and Musk, and the security checks companies can make before giving agents more access.
Agent security · Research
AI agent access is not authority.
An agent can solve a problem and still exceed its assignment. What OpenAI’s enterprise security guide means for tool permissions, approvals and evidence.
Agent security · Research
Defense Factory: from security findings to verified fixes.
OpenAI’s Defense Factory connects findings to verified fixes. The agents doing that work need scoped access and evidence that follows the patch into production.
Agent security · Threat analysis
How attackers use AI to keep operations running.
Anthropic’s September 2026 threat report maps how AI supports an attack from stolen credentials to data theft. We examine the lifecycle, four observed workflows and the checks defenders can apply.
Governance · Research
AI agent incidents: what can you prove?
METR asks how to investigate the behavior behind AI incidents. Oktsec examines the deployment evidence: what ran, which permissions applied and where the record ends.
Agent security · Incident analysis
Anthropic’s cyber incidents: when access becomes permission.
An AI agent can stay focused on its task and still act outside its authority. What Anthropic’s latest assessment means for permissions, monitoring and deployment tests.
Agent security · Threat analysis
Model distillation and the limits of API access.
What the NSA, CISA and FBI advisory means for model providers, and what agent teams should test about identity, approved destinations and fallback routes.
Agent security · Incident analysis
Six reports on agent security: failures and controls that held.
Five incident and test reports, plus Microsoft guidance: distinct failure paths, controls that held and practical tests for agent deployments.
Governance · Research
The agent governance gap
A review of agent governance surveys, telemetry and guidance, with sample sizes, source limitations and practical control questions.
Critical infrastructure · Threat analysis
When AI generated tooling reaches industrial control systems.
What advisory AA26-231A reports about AI-assisted industrial attack tooling, and which access and execution controls defenders should review.
Agent security · Incident analysis
AISI incident report: AI agents acting outside scope.
AISI’s cyber evaluation shows why internet access, tool permissions and task scope need to be tested together. What the report establishes and what it does not.
MCP security · Protocol analysis
MCP 2026-07-28 moves the security boundary to the server.
The shipped 2026-07-28 specification removes protocol sessions and makes requests easier to scale. It also leaves state integrity, authorization and resource controls squarely in each implementation.
Agent security · Incident analysis
OpenAI models reached Hugging Face production.
How OpenAI evaluation agents reached Hugging Face production, what METR’s later investigation changed, and what deployment teams can learn from the incident.
Agent security · Threat research
JadePuffer and the shift toward agentic ransomware.
Sysdig documented what it assesses as the first agentic ransomware operation. The exploit chain was familiar; the adaptive loop and compressed response window were not.
Agent security · Research
Autonomy is a security boundary.
Approval, supervision, bounded autonomy and recovery impose different controls. A framework for assigning authority to each consequential action.
Agent security · Research
Agent tooling CVEs: configuration, paths and client trust.
Seven CVEs illustrate distinct failures in configuration loading, path handling and client/server trust, with links to vendor advisories.
Agent security · Research
AI agent security benchmarks: how to read the scores.
AgentDojo, InjecAgent, ASB, MCPSecBench, MSB and MCPTox measure different attack classes, so their scores are not directly comparable.
Agent security · Research
Prompt injection defenses: what the research shows.
A dated review of agent defenses, benchmark results and threat models. What PromptArmor, CommandSans, CaMeL and authorization studies do and do not establish.
MCP security · Research
How exposed are MCP servers, really?
What public repository scans, internet exposure studies and attack benchmarks establish about MCP risk, with their sampling limits.
Authorization · Research
Authorization telemetry for AI agents: tracing tool call decisions.
How to instrument the authorization decision on every agent tool call and export identity, tool, arguments and policy verdict through OpenTelemetry.
MCP security · Guide
How to secure an MCP server.
A practical MCP security guide: authenticate callers, limit tool capabilities, inspect untrusted content, isolate execution and preserve useful audit records.
Supply chain · Research
How to audit a Claude skill before you run it.
Read SKILL.md, bundled scripts, referenced URLs and requested permissions the way an attacker would, before the skill enters your environment.
Authorization · Research
Detection and authorization in AI agent security.
Detection can identify and block threats. Authorization checks permissions. How to combine both with isolation and reliable evidence.
Identity · Research
The agent identity crisis, four months later.
Signed Agent Cards, MCP enterprise managed authorization and task scoped token research: what each contributes to agent identity and what deployments still need to enforce.
Identity · Protocol analysis
MCP is making request identity explicit.
MCP is moving authorization context from the connection to each request. The direction is clear; security still depends on how every server implements identity and policy.
Supply chain · Research
Skills over MCP: who checks the manual?
SEP-2640 proposes distributing skills through MCP. How manifests, provenance and host approval work, and where the deployment still needs enforceable permissions.
Supply chain · Research
The agent supply chain is bigger than your dependency tree.
The agent supply chain is every artifact an agent pulls into your environment: packages, MCP servers, skills and the trust behind them.
Governance · Research
Agent work needs evidence, not trust.
What agent records establish about identity, permissions and outcomes, and how to verify their integrity without overlooking gaps in coverage.
Identity · Research
The identity stack for AI agents: what shipped, what didn’t.
A scoped review of signed Agent Cards, enterprise-managed access, task authorization research and the integration work needed for runtime attribution.
MCP security · Guide
What an MCP server actually exposes.
A practical, audit grounded map of tool surfaces, credentials, network reach and the trust boundaries that decide your real attack surface.
Authorization · Note
Prompt injection needs content and action controls.
How content inspection, explicit permissions and isolation address different parts of prompt injection risk in tool-using agents.
Supply chain · Research
MCP as a supply chain: trust boundaries in agent tooling.
Five boundaries to review before and after connecting an MCP server: tool descriptions, permissions, authentication, dependencies and runtime changes.
Authorization · Engineering
Policy before agent execution: what security has to control.
How runtime policy checks identity, tools, parameters and destinations, alongside scanning, isolation and audit records.
Supply chain · Incident analysis
The LiteLLM supply chain attack: what matters now.
The poisoned packages are gone. The credential risk can persist. What later FBI and CloudSEK reporting, release changes and MCP fixes mean for agent deployments.
Governance · Product essay
Security is a product decision, not a checklist.
The most consequential call a technical founder makes is what not to ship. Agent security cannot wait for an incident before becoming part of the product surface.
Governance · Research
CSA Agentic Trust Framework for AI agents.
What zero trust means for AI agents, and how the framework maps to authorization, signed policy and verified evidence in practice.
Identity · Research
AI agent identity: attribution, delegation and tool permissions.
How workload identity, delegated authority and per-tool records help attribute agent actions, with a review of available standards.
Supply chain · Field note
How to evaluate trust in public agent tooling.
A practical review model for public agent tooling: permissions, provenance, install paths, version pinning and change over time.