agent-security
Safeguard articles tagged "agent-security" — guides, analysis, and best practices for software supply chain and application security.
36 articles
Securing MCP Servers for AI Agents
Five CVEs in 2025 alone trace MCP tool compromise back to one root cause: unsanitized strings piped into exec(). Here's how to expose and consume MCP safely.
Signing and provenance standards for AI agent skill registries
Shai-Hulud infected 500+ npm packages via stolen tokens in 2025. Agent skill registries are repeating the same unsigned-artifact mistake — here's the fix.
How Malicious Skills Get Distributed Through Agent Registries
CVE-2025-59536 (CVSS 8.7) let a single malicious commit auto-approve MCP servers in Claude Code, no install click required. Registries need the same controls as package managers.
Prompt injection in AI coding assistant system prompts
Copilot, Cursor, and Windsurf all read untrusted repo text into the same channel as trusted instructions — three 2025 CVEs show what happens next.
Vetting third-party agent skills before you install them
AI agent skill marketplaces run installed code with your full permissions and no sandboxing — VS Code's 2025 extension attacks show exactly how that gets abused.
Agentic AI Security FAQ: Governing Autonomous AI in 2026
Clear answers on securing agentic AI — what makes autonomy risky, how tool scope and identity work, prompt injection and confused-deputy failures, and how Safeguard governs agents that act on your systems.
MCP Server Security FAQ: Safeguarding AI Agent Tool Access in 2026
Plain answers about securing the Model Context Protocol — what an MCP server exposes, how agents authenticate, the prompt-injection and tool-poisoning risks, and how Safeguard's MCP server fits in.
What Is a Claude Code Skill, and How Do You Secure One?
A Claude Code skill is a folder of Markdown instructions and scripts that an AI agent loads on demand. Because it can carry executable code, it deserves the same review as any dependency.
MCP-Led Automation: Securing Model Context Protocol Workflows
MCP-led agent workflows hand real tools to a language model. That power is also the attack surface. Here is how tool poisoning works and how to defend against it.
Claude Code Skills: A Security Guide to SKILL.md and Agent Extensions
Claude Code skills package instructions and scripts an AI agent runs on your behalf. That power is also the risk. Here is how to vet and sandbox them.
Model Context Protocol Permissions Model Explained
MCP's permissions model is subtle. Here is a careful walkthrough of how tool scoping, sampling, and resource access actually work in production.
Securing MCP Servers Without Killing Developer Velocity
MCP servers are spreading inside engineering orgs faster than security teams can review them. Here is how to govern them without slowing teams down.
Self-healing security runs on Safeguard.
Your first fix PR is minutes away.
No sales call required, even your agent can complete the purchase over MCP.