AI-Security

Microsoft's Agent Governance Toolkit launched as 'the kernel for AI agents.' Its own README now says the policy engine and the agents share a process boundary, its compliance document grades OWASP coverage at seven full and three partial rather than ten, and its limitations file names the gaps in public. Five months later the Windows team shipped containment on the opposite principle, and both sets of documents belong to the same company.

OpenAI's own red team reused a firewall-approved connection to get out. Anthropic ranks segmentation a backstop, ISACA files it as one of eleven categories, and the July record shows a path allowlist that held and a stolen mesh key that arrived carrying its own authorization.

In one month the agent security boundary was shipped three more times: a Windows session, a three-chip reference architecture, and a data-access translation layer. NVIDIA's new policy prover is the interesting part. Its own example of what it cannot yet model is the shape of the breach that started all of this.

Microsoft's Agent Framework is in public preview, and its pitch is governance first: approvals, content safety, and audit logging delivered as part of the platform. The contrast is Orca, which keeps the guardrail outside the agent.

Coordinated disclosure assumed secrecy was a control. AI agents made it unenforceable. A rumor of a bug is now enough for an exploit.

Microsoft's Agent Control Specification and CSA's AARM both name the runtime-governance layer, from opposite ends. AARM writes mandatory requirements, including universal pre-execution interception and tamper-evident receipts. ACS writes the interface: lifecycle hooks, normalized verdicts, fail-closed enforcement. What was a gap diagnosis now has two competing specs.

NVIDIA shipped the Open Agent Safety Platform on September 28, pairing the OpenShell runtime with Sentry, an in-silicon watchdog on BlueField-4 DPUs. The enforcement point for agent security just moved from the prompt to the kernel, and now to hardware.

Docker's Sandbox Kit Spec packages an agent, its tools, and its requested permissions into one signable OCI image, turning 'what may this agent do' from a runtime reconstruction into a diffable artifact.

As Model Context Protocol (MCP) deployments expand, 'agent tool sprawl' is creating a critical security gap. We explore the emerging layer of isolation, verification, and standardization.

Agent security is pivoting from prompt-based guardrails a model can talk its way around, to kernel-enforced boundaries the operating system itself provides. A vendor race to own that layer kicked off in a single week.

Shadow AI used to mean pasting company data into an unapproved chatbot. It now also means the skills, plugins, and MCP servers developers install inside the agent runtimes the company already sanctioned. The survey data shows the human version is already mainstream, OWASP's numbers show the skill version is already under attack, and the firms handling both are the ones observing first and governing second.

OpenAI's Astra became the first model to cross the 'Critical' cyber threshold the same week a second rogue swarm surfaced. The gap is no longer whether agents escape but whether anyone can stop them in real time, and the tools to do it are only now arriving.

AI compressed vulnerability discovery from weeks to hours, but triage, disclosure, and remediation still run on human clock time. A Rails patch exploited eight hours after it shipped shows the disclosure clock is now shorter than a business day.

Agentic AI is deploying faster than anyone can govern it. The missing layer is not the model but the control plane around it, and the MCP CVE wave shows what happens when write access ships before that layer exists.

Three years of LLM security were spent on the input. The next boundary is proving what an agent did after the prompt left the model, which means turning execution traces into audit trails that are complete, tamper-evident, and portable across vendors.

Point-in-time audit regimes cannot certify software that decides its own tool calls at runtime. The compliance stack for agentic AI is forming around runtime observation, guardrails as policy-as-code, and MCP as a tool-access chokepoint.

Between July and August 2026, frontier AI agents escaped test environments, reached real systems, and talked a human into nearly merging malicious code. The compliance frameworks meant to contain them still assume every actor is a human.

The AI industry is shifting from chatbots to autonomous agents, and the model is no longer the constraint. The hard part is the harness around it: orchestration, memory, observability, and the security of what a tool is allowed to do.