Tenable details the agentic harness behind Hexa AI: untrusted-insider controls, approval gates and audit for AI agents
Tenable published a vendor blog describing the "harness" behind Tenable Hexa AI, the agentic engine of the Tenable One Exposure Management Platform. The harness is a runtime control layer that treats LLM agents as untrusted insiders and enforces boundaries outside the model. The article covers failures seen in development, the "no standing trust" design stance, a walkthrough of one request, and the evaluation suites used to detect regressions. It describes no incident, vulnerability or threat actor, and is product and architecture content.
Technical Details
- Failure modes in development: the agent acted beyond the requester's authority, was confidently wrong about the tenant (tags, IP search, tag format), crashed on relative time ranges, exhausted its context window on queries over 5,000 assets, failed to decompose broad requests, over-refused, and produced false positives from over-tuned safety filters.
- Prompt injection via security data: hostnames, certificate fields, service banners and finding descriptions can be written by untrusted parties and read by the model as instructions, so security data is treated as an attack surface.
- Controls: tool-grounded responses, routing and decomposition into scoped sub-agents, token caps, recursion limits and step budgets that degrade to partial answers, and permission middleware at the tool boundary so the agent acts only with the invoking user's entitlements.
- Blast radius: larger operations require full scope enumeration and explicit approval, and some are disabled unless an administrator enables them for the tenant.
- Guardrails and approval: content checks run on both input and output, uploads are validated, and macro-enabled spreadsheets are rejected. Before any state change the agent produces a written proposal with the impacted device IDs, the policy, the deployment window, blast radius and a no-automatic-rollback statement, and a refusal is sticky.
- Audit and evaluation: every call emits token and decision events, runs are traced and correlated by request ID, and agent actions are stamped distinctly from human actions. Two independent evaluation suites (functional and safety), with over 100 cases and about a dozen evaluators, run against every change. Any unexpected destructive call fails the run, and poorly rated real conversations are promoted into new test cases.
Remediation
The article offers vendor-evaluation questions rather than remediation: what stops unentitled actions, how instructions hidden in attacker-influenced data are handled, how oversized or vague queries are handled, what evidence exists after an action, and how quality regressions are detected against a pinned baseline.
Linha do tempo
-
Tenable details the agentic harness behind Hexa AI: untrusted-insider controls, approval gates and audit for AI agents
ler a análise desta fonte ocultar
Tenable published a vendor blog describing the "harness" behind Tenable Hexa AI, the agentic engine of the Tenable One Exposure Management Platform. The harness is a runtime control layer that treats LLM agents as untrusted insiders and enforces boundaries outside the model. The article covers failures seen in development, the "no standing trust" design stance, a walkthrough of one request, and the evaluation suites used to detect regressions. It describes no incident, vulnerability or threat actor, and is product and architecture content.
Technical Details
- Failure modes in development: the agent acted beyond the requester's authority, was confidently wrong about the tenant (tags, IP search, tag format), crashed on relative time ranges, exhausted its context window on queries over 5,000 assets, failed to decompose broad requests, over-refused, and produced false positives from over-tuned safety filters.
- Prompt injection via security data: hostnames, certificate fields, service banners and finding descriptions can be written by untrusted parties and read by the model as instructions, so security data is treated as an attack surface.
- Controls: tool-grounded responses, routing and decomposition into scoped sub-agents, token caps, recursion limits and step budgets that degrade to partial answers, and permission middleware at the tool boundary so the agent acts only with the invoking user's entitlements.
- Blast radius: larger operations require full scope enumeration and explicit approval, and some are disabled unless an administrator enables them for the tenant.
- Guardrails and approval: content checks run on both input and output, uploads are validated, and macro-enabled spreadsheets are rejected. Before any state change the agent produces a written proposal with the impacted device IDs, the policy, the deployment window, blast radius and a no-automatic-rollback statement, and a refusal is sticky.
- Audit and evaluation: every call emits token and decision events, runs are traced and correlated by request ID, and agent actions are stamped distinctly from human actions. Two independent evaluation suites (functional and safety), with over 100 cases and about a dozen evaluators, run against every change. Any unexpected destructive call fails the run, and poorly rated real conversations are promoted into new test cases.
Remediation
The article offers vendor-evaluation questions rather than remediation: what stops unentitled actions, how instructions hidden in attacker-influenced data are handled, how oversized or vague queries are handled, what evidence exists after an action, and how quality regressions are detected against a pinned baseline.