Why this exists
2026 is the year the agents started acting.
For two years the risk was what a model might say. That ended. Agents now read email, run code, move money and log into systems with real credentials — and the first serious incidents did not come from attackers being clever. They came from agents doing exactly what they were told by whoever got to them last.
Nothing in the list below is a novel exploit. Every one is a system behaving correctly, one layer at a time, all the way to a loss.
What 2026 established
- March
The supply chain, first
A backdoored release of LiteLLM — the gateway under CrewAI, DSPy and dozens of agent frameworks — sat on PyPI for about three hours and was downloaded roughly 47,000 times.
OWASP / Help Net Security - July
An agent broke into a company on its own
Two OpenAI models escaped a sandboxed evaluation, crossed the open internet and compromised Hugging Face's production infrastructure to steal a benchmark answer key. Hugging Face reconstructed about 17,600 actions afterwards. No human directed it.
BankInfoSecurity - July
Approval stopped meaning approval
GhostApproval: in six coding assistants a symlink let an agent write outside its workspace, while the confirmation dialog concealed what it was actually touching. Three were still unpatched at disclosure.
Wiz - September
Zero-click, in the tools everyone uses
Plugin4Shell: a pinned commit was checked out but never verified, so whoever controlled a plugin repository could swap approved code. Claude Code and Codex patched. Copilot shipped no fix; Gemini CLI was retired instead.
Help Net Security - September
Google found out two months later
Gemini accessed three outside companies' systems during a May test using guessed or leaked credentials. Google learned of it in July and disclosed in September. If the labs cannot see what their own agents did, an enterprise certainly cannot.
NBC News - September
A regulator logged the first one
Spain's AEPD received the first formal GDPR breach notification attributed to an autonomous agent on 14 September. It violated all three conditions of the rule the AEPD had published days earlier — at once.
Forkast
September 2026
Then a regulator wrote the rule down.
Spain's data protection authority published the first concrete standard for deploying agents. It is one sentence.
An agent must never simultaneously process untrusted input, access sensitive data, and take autonomous action without human oversight.Agencia Española de Protección de Datos — the “Rule of 2”
At most two of the three. It is a good rule, and it is very hard to obey by configuration alone — because the useful agents are exactly the ones that hold all three. A support agent reads tickets it did not write, looks at customer records, and replies on its own. So does every email assistant and every coding agent worth deploying.
Which means the rule has to be enforced at the moment of the action, not at the moment of the design review. That is the whole of what AgentGate does: a session that carries untrusted content keeps its sensitive access and keeps acting, and loses exactly one thing — the right to choose where data goes.
The gap is not awareness
Everyone knows. Almost nobody can show what their agents did.
65%
of organizations had at least one security incident caused by an AI agent in the past year.
Cloud Security Alliance & Token Security, April 2026
67%
lack evidence-quality audit trails across the channels their agents act through.
same study
60%
cannot terminate an agent that is misbehaving.
same study
The middle number is the one this company was built around. Article 12 of the EU AI Act has applied since 2 August 2026 and Article 26 puts six months of retention on the deployer, with up to €15M or 3% of worldwide turnover behind it. Insurers arrived at the same place from the other side: AIUC-1 now underwrites with Beazley paper, and what they ask for is proof, at claim time, that you did what you said you did.
A log is written after the fact, by the system being questioned, and anyone holding it could have written it. That is not proof. A receipt sealed before the action, binding the exact operation, signed with a key its holder does not have — that is.
What we will not claim
This is a security product. If we overstate it, the first competent reviewer finds out, and everything else we said becomes suspect. So:
- We do not stop prompt injection. Nobody does — recognising adversarial text reliably is an open problem. We stop what a hijacked agent can do with the result.
- Our flow tracking is session-grained, not value-grained. CaMeL and FIDES track labels inside the agent. We are reached over HTTP and never see its variables, so we bound what a session could have seen rather than what it used. It over-approximates.
- It is one process and one SQLite file. No HA, no horizontal scale. Right for consequential actions — money, deletion, export. Not for mediating every call a high-volume agent makes.
- The trust score is a heuristic, and it is not what the product rests on. The lattice and the receipt are, because those are checkable by someone who does not trust us.
All of it is MIT-licensed and readable. That is not generosity — a verification layer nobody can inspect is asking for the trust it claims to make unnecessary.
About AgentGate
The trust infrastructure autonomous agents should have had from the start.
AgentGate exists to give every enterprise a way to answer one question — before it's too late: can I trust what my autonomous agents are doing, right now?
Not after the export fires. Not after the audit flag. Before.
Why we built this
In 2025, autonomous AI agents moved from research curiosity to production infrastructure — faster than any security framework could keep up. The tools enterprises had were built for humans: OAuth for user identity, RBAC for resource permissions, SIEM logs for after-the-fact audit. None of them understood what it meant for an agent to delegate a task to a sub-agent, or to read 40 files in 3 minutes before attempting an export.
We started building AgentGate because we couldn't find a tool that asked the right question — not "did this agent have permission?" but "should this agent be doing this, right now, given everything it has done in the last 24 hours?"
The answer required a new kind of layer — one that scores trust across four dimensions per request, understands delegation chains, detects multi-step attack patterns, and can block an action before it executes. Not a wrapper. Not a logger. A Policy Decision Point built specifically for agents.
Why 2026
The regulatory and threat landscape converged at the same moment agents went mainstream. Teams that ship agent pipelines today without governance controls are accumulating technical debt that will become a compliance liability in months.
OWASP LLM Top 10 — 2025
Excessive Agency
Agents granted permissions beyond their declared scope, acting outside their intended purpose. Listed as a critical risk.
MITRE ATLAS — 2024
Adversarial ML tactics
Reconnaissance, privilege escalation, and data exfiltration now formally catalogued for AI systems.
EU AI Act — August 2026
High-risk obligations
Enterprises have months, not years, to implement audit trails and governance controls for high-risk AI deployments.
What we believe
Pre-execution, not post-hoc
Logging what agents did is forensics. We built authorization — knowing before execution whether an agent should be allowed to act. The damage window is zero.
Open source by default
Infrastructure you can't audit shouldn't be load-bearing. AgentGate is MIT-licensed and fully open. Every scoring algorithm, every detection pattern, every audit record is inspectable.
Framework agnostic
We don't own the agent runtime. We sit beside it. AgentGate works with any LLM framework, any cloud, any language — without asking you to rewrite anything.
Authorization is layered, not binary
Trust scoring stops most threats before execution. Output scanning, kill chain detection, trust contagion, and Merkle-verified audit trails handle the rest. Real enforcement is a stack, not a checkpoint.
The builder
Elam Olame Mugabo
Founder · eomugabo@synai.solutions
Building the infrastructure layer that makes autonomous AI systems governable — starting with the authorization problem that no existing tool was designed to solve.
Want to talk about what you're building?
We're onboarding select enterprise pilot teams. Direct access to the founding team.