Manifest supply-chain scan
Screen MCP and tool manifests for tool poisoning, over-broad permissions, shadowed names, and unexpected changes between versions.
Agentic & MCP security
An agent is only as safe as its next tool call.
ZNYX governs agents and the tools they call: it evaluates plans, individual steps, retrieved context, and memory writes, and screens the MCP supply chain before a manifest is ever trusted.
Agent run · 4 steps · 1 deniedbudget 12,400 / 40,000 tokens
- 01
search.queryretrieval evaluated · 12 docs · 0 poisonedALLOW - 02
db.readscope within grant · read-onlyALLOW - 03
mail.sendmanifest requests scopes beyond policy grant · excessive agencyDENY - 04
memory.writetool output sanitised before persistREDACT
Definition
What is agentic AI security?
Agentic AI security is the practice of securing autonomous AI agents across their entire action loop: the plans they generate, the tools they call, the context they retrieve, and the memory they write, not just a single prompt. ZNYX adds dedicated evaluation stages and hard budgets so agents cannot be hijacked, over-empowered, or driven into runaway, costly tool loops.
The action loop/v1/evaluate/…
01
Retrieval
retrieval
02
Agent plan
agent-plan
03
Agent step
agent-step
04
Memory write
memory-write
fail-closed gateevery stage, budgets enforced
The attack surface
The agentic attack surface
Autonomous agents expand the threat model far beyond input and output. Every place an agent reads, decides, or acts is a place an attacker can intervene.
01
Plans
A poisoned instruction or retrieved document can rewrite the agent plan, redirecting it toward exfiltration or destructive actions before any tool runs.
02
Tool calls
Agents invoke APIs, code, and MCP tools. Unchecked arguments and tool selection can trigger SSRF, data exfiltration, or actions far beyond the task scope.
03
Retrieved context
RAG and tool responses pull in untrusted text. Hidden instructions in that content can hijack the model: indirect prompt injection through the retrieval path.
04
Memory
Long-lived agent memory persists across turns and sessions. A malicious write can plant standing instructions that compromise future runs.
05
Excessive agency
Over-broad permissions and autonomy let a single misstep cascade. Capability beyond the task widens the blast radius of any compromise.
06
Denial of wallet
Loops and fan-out can run an agent until it burns excessive tokens and API cost: a reliability and financial failure mode unique to autonomous agents.
Evaluation stages
Four places an agent run gets checked
ZNYX exposes a dedicated endpoint for each point in the loop. Every stage runs the deterministic → ML → LLM-judge ladder behind a fail-closed scorecard gate, so policy is enforced where the risk actually lives.
01pre-prompt
Retrieval
Inspect retrieved documents and RAG context for indirect prompt injection and unsafe content before they enter the model.
02pre-execution
Agent plan
Evaluate the proposed plan for hijack, excessive agency, and disallowed objectives before any tool is invoked.
03per-step
Agent step
Check each tool call and its output in the loop, applying the tool-output guard and remediation actions per step.
04post-step
Memory write
Screen what an agent persists to memory so injected or sensitive content is not stored for future turns.
MCP supply chain
Treat every tool manifest as untrusted code
MCP made tools composable and, in doing so, made them a supply chain. ZNYX screens manifests on registration and on change, and guards what comes back out of them.
Tool-output guard
Treat every tool response as untrusted input and scan it for indirect injection before it returns to the model loop.
Excessive-agency checks
Compare requested scopes against the policy grant and deny per-call rather than per-session.
Denial-of-wallet budgets
Cap token, cost, and loop usage across a run so a compromised agent cannot spend without bound.
Escalation
LLM-judge consensus
For ambiguous, high-stakes decisions, ZNYX escalates to an LLM-judge layer with K-member consensus and audited verdicts. Judges run inside your boundary on the in-VPC inference sidecar, are bounded by denial-of-wallet budgets, and feed the same fail-closed gate as the deterministic and ML tiers.
Tool-use governance
Agents call tools, secure the tools too
The tools and MCP servers an agent connects to are a supply chain of their own. ZNYX scans MCP and tool manifests for supply-chain risk and validates trust before an agent is allowed to use them.
- Inspect retrieved context and tool outputs for injection before the model reads them.
- Gate each plan and tool call against policy with remediation up to ask-human.
- Cap tokens, cost, and loops so autonomy never becomes a denial-of-wallet event.
FAQ
Agentic AI security FAQ
What agentic AI security covers, where ZNYX evaluates an agent run, and how excessive agency and denial-of-wallet are bounded.
Agentic AI security is the discipline of securing AI agents across the full action loop - the plans they generate, the tools they call, the context they retrieve, and the memory they write - rather than only filtering a single prompt. ZNYX adds dedicated evaluation stages and budgets so an agent cannot be hijacked, over-empowered, or driven into runaway tool loops.
ZNYX exposes evaluation stages for retrieval, agent-plan, agent-step, and memory-write through dedicated /v1/evaluate/* endpoints. Each stage runs the deterministic to ML to LLM-judge ladder behind a fail-closed scorecard gate, so prompts, tool outputs, retrieved context, and memory writes are inspected and policy is enforced inside your own boundary.
Tool-output injection happens when the response from a tool, API, or retrieved document contains hidden instructions that hijack the agent. ZNYX runs the tool-output guard and prompt-injection detectors over every payload an agent reads before it re-enters the model context, so untrusted content cannot silently rewrite the agent plan.
Denial of wallet is an attack or failure mode where an agent loops or fans out until it burns excessive tokens and API cost. ZNYX enforces denial-of-wallet budgets with token, cost, and loop caps, and applies the same caps to its own LLM-judge layer, so a runaway agent or judge is stopped before it drains your spend.
Excessive agency is when an agent has more capability, permissions, or autonomy than a task requires. ZNYX includes excessive-agency checks that flag risky tool selection and over-broad actions, and pairs them with remediation actions such as block, refrain, or ask-human so high-impact steps require confirmation.