Tenable and OpenAI launch CyberAgents Exchange AI Inspector to vet community-built AI agents, MCP servers and skills
Tenable and OpenAI announced the CyberAgents Exchange AI Inspector (Exchange Inspector), a security review process for submissions to the open-source CyberAgents Exchange registry of AI agents, skills, MCP servers and multi-agent playbooks. The Inspector combines Tenable One AI Exposure scanning, OpenAI frontier models (Daybreak Blue and Daybreak Red) and human review. It targets select high-risk submissions that go beyond the baseline review every listing already receives. The registry launched in August and hosts more than 100 listings. The Inspector is expected to be available in September. This is vendor product news with no reported compromise or exploitation.
Technical Details
- The AI agent attack surface includes LLM instructions, tool-chaining permissions, data access and egress, and prompt injection. Tool chaining can amplify risk across trust boundaries.
- Reviews are anchored to a specific Git commit, and any material change requires a new review. Repository owner and author trustworthiness is assessed, including sockpuppet and throwaway-account signals.
- Tenable One AI Exposure performs a first-pass scan for PII exposure, sensitive data access, and prompt injection or jailbreak risks. In a sample, it detected a SKILL.md with a line of invisible Unicode tag characters carrying a hidden instruction to the LLM (a benign canary: "[SECURITY-SKILL-CANARY]").
- Submissions are installed and exercised in a clean, isolated environment using only documented setup steps. Observed behavior is compared with the documentation, and discrepancies are logged as findings.
- Model tier is matched to risk class:
- Prose-only submissions go to a standard model, with the submission passed as delimited data and a dedicated hidden-content pass.
- Benign code goes to Daybreak Blue, covering supply chain, secret handling, over-broad permissions and undisclosed egress.
- Dual-use code goes to Daybreak Blue, with escalation to Daybreak Red on refusal.
- Offensive or weaponized artifacts go through a policy gate and then Daybreak Red.
- A model refusal is treated as a review signal, not a clean bill of health.
Remediation
- Hard security failures must be resolved before a submission is promoted. Other findings can be accepted with a documented rationale and a follow-up commitment.
- Teams adopting community AI agents should pin dependencies and commits, scan skill files for hidden Unicode and encoded content, and review tool permissions and egress before deployment.
Linha do tempo
-
Tenable and OpenAI launch CyberAgents Exchange AI Inspector to vet community-built AI agents, MCP servers and skills
ler a análise desta fonte ocultar
Tenable and OpenAI announced the CyberAgents Exchange AI Inspector (Exchange Inspector), a security review process for submissions to the open-source CyberAgents Exchange registry of AI agents, skills, MCP servers and multi-agent playbooks. The Inspector combines Tenable One AI Exposure scanning, OpenAI frontier models (Daybreak Blue and Daybreak Red) and human review. It targets select high-risk submissions that go beyond the baseline review every listing already receives. The registry launched in August and hosts more than 100 listings. The Inspector is expected to be available in September. This is vendor product news with no reported compromise or exploitation.
Technical Details
- The AI agent attack surface includes LLM instructions, tool-chaining permissions, data access and egress, and prompt injection. Tool chaining can amplify risk across trust boundaries.
- Reviews are anchored to a specific Git commit, and any material change requires a new review. Repository owner and author trustworthiness is assessed, including sockpuppet and throwaway-account signals.
- Tenable One AI Exposure performs a first-pass scan for PII exposure, sensitive data access, and prompt injection or jailbreak risks. In a sample, it detected a SKILL.md with a line of invisible Unicode tag characters carrying a hidden instruction to the LLM (a benign canary: "[SECURITY-SKILL-CANARY]").
- Submissions are installed and exercised in a clean, isolated environment using only documented setup steps. Observed behavior is compared with the documentation, and discrepancies are logged as findings.
- Model tier is matched to risk class:
- Prose-only submissions go to a standard model, with the submission passed as delimited data and a dedicated hidden-content pass.
- Benign code goes to Daybreak Blue, covering supply chain, secret handling, over-broad permissions and undisclosed egress.
- Dual-use code goes to Daybreak Blue, with escalation to Daybreak Red on refusal.
- Offensive or weaponized artifacts go through a policy gate and then Daybreak Red.
- A model refusal is treated as a review signal, not a clean bill of health.
Remediation
- Hard security failures must be resolved before a submission is promoted. Other findings can be accepted with a documented rationale and a follow-up commitment.
- Teams adopting community AI agents should pin dependencies and commits, scan skill files for hidden Unicode and encoded content, and review tool permissions and egress before deployment.