Mend.io publishes practical framework for agentic AI security
Mend.io has released a practical guide titled Securing AI agents, MCP servers & LLM apps: A practical framework that aims to bridge the gap between rapid deployment of agentic systems and traditional security programmes. The guide is built on three main steps: discover what matters, fix it quickly, and protect AI in production. It includes seven reusable artifacts.
Agentic AI introduces new failure modes
Agentic AI differs from classic applications because its behaviour stems from a combination of model, system prompt, context, user input and called tools. As a result two identical deployments can respond differently and new types of failure emerge. Prompt injection can penetrate through data, an over‑privileged agent may act without an exploit, an outdated model continues to provide predictions after support ends, and a poisoned tool description on an MCP server can redirect behaviour without code changes. These scenarios do not appear in standard CVE channels.
Discovery and inventory with AI‑BOM
The methodology emphasises both shift‑left and protect‑right approaches. In the first phase organisations must identify all agents and MCP servers that often escape traditional procurement. According to Marktechpost three categories require tracking: shadow agents, unregistered MCP servers and embedded AI frameworks. Each MCP server should have a defined owner, access scope and regular review. Discovery proceeds through five methods: scanning repositories for agentic signatures, monitoring network egress to model API endpoints, auditing service accounts and API keys, lightweight registration of declarations and continuous automation to prevent information ageing. Artifact 2.1 extends the AI‑BOM with nine fields: identity, model dependency, autonomy level, tool permissions, credential scope, data reach, MCP endpoints, prompt location and last review.
Configuration checklist and prioritisation pipeline
Artifact 2.2 provides a twelve‑point checklist focused on exploitable configurations. Key items include restricting credentials to specific sources, prohibiting shared credentials between agents, requiring human approval for high‑impact tools, storing system prompts in version control and preventing production changes, authenticating clients on MCP servers, reviewing tool descriptions for injection risks and pinning model versions with end‑of‑support monitoring and an accountable owner. After identification and the checklist a pipeline of enrich, prioritise and triage follows. Prioritisation signals in order are: reach, exploitability, business context, agentic amplification and fix availability. This sequence helps focus resources on the most critical risks.
Automated vulnerability closure and runtime protection
Automated vulnerability closure is governed by artifact 3.1 which sets two rules: every automatic closure must carry evidence and if the system cannot explain that a finding is a false positive the decision escalates to a human. Errors are sampled regularly and trigger model retraining when thresholds are exceeded. Runtime protection includes guardrail mechanisms, prompt hardening, policy enforcement and monitoring. A guardrail can be deployed either as a Python SDK in online or offline mode or as a standalone API server in Docker without code changes. The minimal configuration catches input prompt injection, out‑of‑policy requests and jailbreaks. A similar runtime approach is offered by Varonis Agent IBAC which compares an agent’s instruction with its reasoning and tools and blocks or quarantines non‑compliant actions in real time. In the wider community work continues on shared standards such as the SAFE guidelines from the Open Secure AI Alliance which support incident exchange and common guardrail techniques. These initiatives confirm that securing agentic AI is becoming a distinct discipline beyond traditional vulnerability scanning.