Volume 343, Issue 2 · 7 articles
Akto extended Akto Atlas to show which personal AI agents employees connect and stop sensitive data leaving devices.
Akto notes that four personal AI agents, xAI's Grok Bot, Instinct, Meta's Muse and OpenAI's Dots, reached employee laptops within two months.
These agents run continuously, sign into existing apps and act without prompts, with Dots reaching more than 4,000 apps via plugins.
Akto announced it is extending Akto Atlas to cover personal AI agents, so security teams can see which agents employees have connected and what each can reach, and block sensitive data from leaving devices.
Akto reviews documented Claude Code risks including prompt injection and RCE, and enterprise mitigations.
Akto examines the security challenges of Claude Code, an LLM-driven agent with shell access to a codebase.
It describes documented issues including an RCE tied to CLI argument parsing and a prompt injection that achieved host-level code execution via instructions in a third-party library README.
The post also discusses debate over whether Auto Mode is a safety control or a convenience and offers enterprise mitigations for secure agentic coding.
Akto explains tool-call guardrails such as allowlists, dynamic authorization and budget caps for controlling agent actions.
Akto argues prompt filters and output classifiers cannot stop an agent's harmful actions because output checks happen after a tool call executes.
Tool-call guardrails have emerged as a separate layer that intercepts what agents actually do, such as sending email, deleting rows or approving refunds.
The guide covers what these guards intercept, relevant policy categories including allowlists, dynamic authorization and budget caps, and where to place them.
Akto explains rogue AI agents, documented incidents, warning signs and controls that reduce the risk in production.
Akto defines a rogue AI agent as an autonomous system that acts outside its intended scope, ignores instructions or causes harm while pursuing its goal.
Unlike a chatbot giving a bad answer, a rogue agent can delete data, access unauthorized systems or continue after being told to stop.
The guide covers the mechanics behind autonomous agent risk, documented examples and warning signs, and closes with AI agent safety controls that reduce risk in production.
Akto details how malicious MCP tool metadata hijacks AI agents, citing real research, CVEs and defenses.
Akto explains MCP tool poisoning, in which hidden instructions in a tool's metadata hijack an AI agent, citing Invariant Labs research where an innocuous add tool secretly instructed Cursor to read SSH keys and MCP configuration files and exfiltrate them.
The attack works because agents treat tool metadata as trusted instructions rather than untrusted data.
The post covers disclosed CVEs, benchmark results and defense-in-depth strategies.
Akto maps AI guardrails to EU AI Act, NIST AI RMF and ISO 42001 requirements and audit-ready evidence.
Akto argues that having guardrails and being compliant are different claims that vendors often conflate, since AI guardrail compliance means knowing exactly which regulatory obligation each control satisfies and proving it with evidence.
The guide maps guardrails for LLMs and agents to specific articles and functions in the EU AI Act, NIST AI RMF and ISO 42001.
It also explains how runtime enforcement can generate audit-ready evidence.
Akto examines how jailbreak defenses work, why they can be bypassed and practices for jailbreak-resistant AI systems.
Akto notes researchers jailbroke Grok-4 shortly after release by combining two known techniques from published papers.
Because the attack surface is language and models are optimized to interpret language charitably, every defense works against that grain.
The article examines three layers of jailbreak defense, where and why they fail, and the emergence of a commercial jailbreaking marketplace, closing with practices that distinguish robust guardrails from ineffective ones.