Part 4 of the Intellyx Agentic SecOps Series for Straiker, by Eric Newcomer
In this series, we started at the beginning point of agentic security, where attacking agents exploit production agents, explored how red, blue, and purple security teams are adopting agents, and stepped into an Agentic SecOps Command Center to align teams and better cover this rapidly expanding attack surface.
But the most security important challenge to meet is the world in which agents generate a seemingly infinite variety of attack patterns, making it impossible to create a static defensive shield that will magically repel all of these attacks.
And when you notice dangerous and destructive agentic behavior, it’s good to have a way to completely shut things down and prevent further damage.
Evolving Agentic Security
As with any disruptive technologies, IT departments struggle to find the right balance between new AI agent capabilities and the appropriate level of security for them.
They want to prevent an agent from deleting a database or corrupting a codebase because it incorrectly decides that’s the right thing to do. Or especially escaping its guardrails and working with other agents – how do we present a recurrence of the Hugging Face incident?
Security issues with disruptive technologies tend to reveal themselves over time, because it’s often difficult to predict in advance what the issues will be. For example, organizations deployed perimeter defense mechanisms after public network access exposed risks and threats of intrusions, fraud, and theft.
Now as AI agent security incidents start to make the new cycle, solutions must evolve to meet the requirements for agentic security.
Building a Perimeter Defense
Initially the web did not require much security because it was designed to exchange documents, not to transport sensitive data or host commercial applications.
And at the time,IT systems typically were designed for internal use within a private network limited to access within an enterprise.
The rapid proliferation of web servers at the edge of organizational IT systems led cybercriminals to develop exploits such as SQL injection and cross site scripting that would exploit vulnerabilities in the web server to attack IT systems, resulting in incidents, outages, theft, and fraud.
Web application firewalls (WAF) emerged to secure the perimeter, as did anti-bot detection, threat detection, and monitoring alerts detecting exploits, incidents, and fraud.
AI Agents that Track AI Agents
Generative AI systems changed the world yet again, in particular the way in which people and computers interact.
Instead of using a complex and hard to learn computer language, gen AI chatbots and AI agents allow us to use the natural languages we already know.
Unlike computer language, though, natural language such as English or Chinese is imprecise and ambiguous, and the LLMs processing human language often produce errors and return incorrect results.
AI agents are quickly becoming the favorite way to harness the productivity and automation benefits of generative AI.
And now agents are building agents, which are building agents, and agents are working together to overcome obstacles to completing the tasks they are given, even when those tasks are impossible to complete or involve breaching security guardrails and perimeters.
METR and Redwood’s independent analysis of the Hugging Face incident shows that when an agent is given an impossible task, it starts exploring ways in which it can “cheat” to complete the task anyway.
One particular agent discovered an unsanctioned message board where more than a thousand other agents were already collaborating on finding ways to cheat on their tasks.
Agentic reasoning led other agents to join in the attack despite recognizing that it was out of scope for their assigned tasks. Agents tampered with their own transcripts, and successfully spoofed tool calls.
Few organizations are likely to run such sophisticated agentic test scenarios as OpenAI, but this incident clearly illustrates the need for a different approach to agentic security than what was designed for perimeter and cloud native security.
Straiker Agentic Security
In the wake of the Hugging Face incident, OpenAI recommends “better discovery of misaligned behavior” to prevent similar incidents. Similarly, Anthropic’s August Risk Report acknowledges that agents may take “misaligned actions in service of completing difficult tasks.”
Both the OpenAI and Anthropic reports recommend agentic AI users continuously assess applications for potential “misalignment” and implement robust safeguards that detect and prevent such behavior.
In this context, let’s look at what Straiker offers for agentic security controls, including their:
- Ascend AI product, which tests agents during development to identify and fix security and safety flaws before deployment, disabling potentially malicious behavior before production
Ascend AI also prevents sensitive data leakage and exfiltration, and helps teams fix vulnerabilities before production impact. - Defend AI product, which provides runtime security for AI agents. Defend inspects every prompt, reasoning step, and tool call to prevent production agents from cheating in real time.
Defend AI traces every interaction across the user, model, tool chain, and agent-to-agent calls for root cause analysis, anomaly detection, and audit readiness.
Defend AI includes a Kill Switch function that allows you to immediately shut down all agent traffic when something goes wrong and prevent any further destructive activity.
Because AI agents are dynamic, unpredictable, and capable of cheating, accurately detecting threats is difficult. Defend AI is trained on millions of real-world agent traces to reduce false positives and improve threat detection in text, code, images, audio, and file uploads.
Straiker’s “kill switch” can shut down rogue and risky agents and connections in real time, should an agent decide it’s going to go off script. .
The Intellyx Take
The main motivation for introducing new technology is to accomplish something you couldn’t do before, or to meet a business requirement you couldn’t meet before.
But doing something new, such as deploying a web server or using cloud native services, can also often expose you to new security vulnerabilities, as we have seen in the past.
But what is the right approach for agentic AI? In some ways, existing security controls apply to AI because AI is just doing something we did before, only now we’re using human language.
The more responsibility we delegate to AI agents, though, the more likely we are to run into new security issues, as in the example of the Hugging Face attack.
What you want is an agentic security posture that’s agile enough to deal with unknown threats and reduce risk.
In that context, it makes sense to go with a security company such as Straiker that is creating solutions from the ground up, rather than trying to see how far we can get with existing solutions.
Copyright ©2026 Intellyx B.V. At the time of writing, Straiker is an Intellyx customer. Intellyx retains final editorial control of this content. A human wrote every word of this article. Image credit (illustration) Straiker. (infographic): Google Gemini.
