250+
real vulnerabilities found in open source projects, each one proven with an executable proof of concept
Vulnerabilities accepted by security programs at
Google Microsoft Stripe AWS 
Mercury
Mercury AI agents now read code, call tools, use credentials, install packages and operate across infrastructure. Oktsec gives companies a control loop for that work: define policy, let environments apply it locally, and verify the evidence that comes back.
Detection tools alert after something already looks wrong. The durable fix is deciding what an agent is allowed to do before it acts, and verifying what it did after. That is what Oktsec is built for.
Read the full argument Mercury The risk is not bad text. The risk is software chaining actions across tools, credentials, code and infrastructure before companies can prove what was allowed, what happened and what evidence exists.
Agents can modify data, trigger workflows and affect real operations.
Agents install packages, run CLIs and operate inside repositories.
Agents call authenticated tools, MCP servers and internal APIs.
Human approval cannot keep up with agent work at machine speed.
When agent work scales faster than review, policy and evidence need to be built into the path.
Regulators are catching up. The EU AI Act obligations for high risk systems take effect in August 2026. When auditors ask what your agents were allowed to do and what they actually did, evidence needs to exist.
Oktsec gives companies a repeatable loop for approved agent environments: publish signed policy, let the environment apply it locally, and review the evidence it reports back.
The company defines what an agent environment is allowed to do.
The node pulls signed policy, verifies it and applies it inside the customer environment.
The environment reports which policy ran and what evidence was produced.
Oktsec compares expected against reported and routes stale, missing, different or unverified evidence for review.
Oktsec is one product system with multiple entry points: Control for recurring governance of approved agent work, Signal for ecosystem visibility, Assessment for deep security review and open source for developer adoption.
Approved environments, company rules, verified evidence, exception review and reporting ready for buyers.
Map the repositories, packages, MCP servers, CLIs and automation surfaces that agents load, call and depend on.
We review real software systems across application security, architecture, dependencies, CI/CD, automation, cloud integrations and AI agent workflows. Each assessment produces reviewed findings, executable evidence, scoring and clear next steps.
Security controls for MCP servers, CLIs, package installs, local tools and automation intensive environments.
Oktsec Assessment reviews real software systems across application security, architecture, dependencies, CI/CD, automation, cloud integrations and AI agent workflows. Each assessment produces reviewed findings, executable evidence, scoring and a practical plan for what to fix, monitor or bring under control.
Oktsec Control produces verifiable records of which signed policy each environment ran and what evidence came back, ready for the frameworks your company already answers to: EU AI Act, SOC 2 and internal audit.
How the evidence worksPatterns and findings from 250+ real vulnerabilities found across agent systems, written up so your team can use them.
Filtering malicious input will keep failing. The durable fix is deciding what an agent is allowed to do before it acts, and verifying what it did after.
A practical map of the tool surfaces, credentials and trust boundaries behind the Model Context Protocol, drawn from real audits.
How signed bundles and pull initiated by the node keep policy verifiable from authoring to apply, even in isolated environments.
The same checklist we run on client code, distilled from 250+ real vulnerabilities. Vendor-neutral, no product required.
If agents are starting to touch code, tools, credentials or infrastructure inside your company, Oktsec gives your company a way to assign policy, review evidence and approve more agent work with fewer blind spots.