Weekly signal

This week’s human–agent trust story centers on four linked realities: (1) attackers are exploiting implicit trust relationships between agents and the tools they call; (2) vendors and standards groups are racing to add identity, attestation, and legal provenance at machine-speed; (3) enterprise security products are adding runtime enforcement and discovery for agents; and (4) open standards for verifying who authorized an agent and what legal terms govern agent transactions were launched. These moves show the market shifting from model safety to system-level trust: identity + attestation + governance + legal context.

What changed

• A security research disclosure (Tenet Threat Labs) documented “agentjacking”: attackers can inject malicious remediation instructions into unauthenticated telemetry (Sentry) and cause AI coding agents to execute attacker-controlled commands with developer privileges; the attack and corroborating Cloud Security Alliance analysis show high success in controlled tests and that platform-level fixes are non-trivial. This is an immediate trust breakdown at the agent/tool boundary.

• Industry launches this week advanced countermeasures at complementary layers: Proof published x401 (an open protocol to cryptographically prove who authorized an agent’s action); the AAA and partners published the Legal Context Protocol (LCP) to attach verifiable legal terms and recourse to agentic transactions; and OPAQUE released Agent Manifest / Confidential MCP capabilities to bind policy, attestation, and signed runtime evidence to agents. These address identity, legal provenance, and verifiable runtime integrity respectively.

• Infrastructure and security vendors rolled out operational controls: Teleport added delegated agent identities and an LLM proxy to contain agents in production infrastructure; WitnessAI and similar vendors released runtime “agentic control” planes to discover agents, enforce approved-tool allowlists, and audit tool/MCP calls. These are short-term operational defenses enterprises can adopt.

What to do with it

1. Patch behavior, not just models: treat any external tool response (MCP output, telemetry, issue trackers) as untrusted by default and require explicit human authorization for high‑impact actions (code install, credentials access, infra writes).

2. Short-term operational controls: deploy allowlists for MCP servers/tools, instrument agent sessions in your SIEM, add runtime enforcement (agent discovery + approved-tool policies), and limit agent privileges (ephemeral creds, least privilege). Vendors cited below offer product paths.

3. Medium-term architecture: adopt verifiable agent identity (x401 or equivalent), sign and attestate agent manifests (Agent Manifest / cMCP), and capture signed decision receipts so actions are independently verifiable. These reduce repudiation and help incident response.

4. Legal & procurement: for agentic commerce, require machine-verifiable legal context and recourse (LCP) so disputes and jurisdiction are provable when agents transact. Start mapping contracts to machine-readable clauses.

Sources: Tenet Threat Labs (Agentjacking), Cloud Security Alliance lab note, Proof x401 release, AAA Legal Context Protocol, OPAQUE 3.0 / Agent Manifest, Teleport Beams delegated identity, WitnessAI Agentic Control.