AI agent security risks split across two planes. Prompt-injection tools inspect what agents say — goal hijack, tool misuse, memory poisoning. They cannot see what agents hold and touch: stolen credentials, impersonated callers, untraceable actions. Tragentics secures that second half — keys agents never hold, callers that prove identity, and calls that leave metadata-only evidence.
Why can't guardrails see half the risks?
Tragentics secures the half of AI agent security that never transits a prompt: identity, credentials, transport, and audit. A guardrail can read every token an agent emits and still miss a leaked key, an impersonated caller, or a call that vanished without a record — because none of those live in the content.
That's not a gap in any one product; it's structural. Inspection tools work on what passes through them, and possession — who holds a credential, who can prove an identity, what got recorded — never passes through anything a guardrail reads. We built for possession from the start, and we deliberately left inspection to the tools designed for it.
And the half guardrails do see, they see imperfectly. Researchers demonstrated evasion techniques that reached up to 100% success against six production guardrail systems, including Microsoft's and Meta's, and formal analysis summarized by the Cloud Security Alliance argues static guardrails cannot be made mathematically airtight. Inspection is necessary. It was never going to be sufficient.
Which OWASP agentic risks belong to which plane?
We mapped OWASP's Top 10 for Agentic Applications 2026 — the peer-reviewed risk list for autonomous agents, released in December 2025 — onto the two planes of agent security. It's the mapping most vendor pages skip, because it shows what each tool class can and cannot cover.
OWASP 2026 risk | Plane | What actually mitigates it |
|---|---|---|
ASI01 — Agent Goal Hijack | Behavior | Injection testing, input/output guardrails |
ASI02 — Tool Misuse & Exploitation | Behavior | Least-privilege tools, authorization gates |
ASI03 — Identity & Privilege Abuse | Infrastructure | Credential Vault — keys agents never hold |
ASI04 — Agentic Supply Chain | Both | Vetted tools plus verified agent identity |
ASI05 — Unexpected Code Execution | Behavior | Sandboxing, execution policy |
ASI06 — Memory & Context Poisoning | Behavior | Memory hygiene, content validation |
ASI07 — Insecure Inter-Agent Communication | Infrastructure | Authenticated content-blind relay |
ASI08 — Cascading Agent Failures | Infrastructure | Explicit topology, rate limits, fallbacks |
ASI09 — Human-Agent Trust Exploitation | Behavior | Human-in-the-loop review |
ASI10 — Rogue Agents | Infrastructure | Per-call Ed25519 identity, instant revocation |
Read the right-hand column with your current stack in mind. If everything you run inspects content, the infrastructure rows are uncovered — and those rows are where the biggest documented losses already live.
The three risks no guardrail can reach
Stolen credentials (ASI03)
No agent on Tragentics holds a raw key, so credential exfiltration has nothing to exfiltrate. Keys live in the encrypted Credential Vault and are injected server-side at call time — the agent uses the key without ever seeing it.
Inspection can't compete on this risk, because you can't filter away a key that's sitting in a config or a context window. You can only remove it — and removal is an architecture decision, not a detection rule.
OWASP's own definition of ASI03 — attackers exploiting "inherited or cached credentials" — describes exactly what we eliminated. The stakes are documented: stolen OAuth tokens from one integration reached more than 700 organizations' data, and more than 64% of credentials leaked in 2022 were still valid in January 2026. No guardrail was ever in either loop.
Impersonated callers (ASI07 and ASI10)
With per-call identity switched on, an unsigned call never reaches your agent. Every call is signed with a private key under Ed25519 agent authentication, verified pairs form on both ends, and a stolen token alone stops being enough to speak for an agent.
Identity is settled before content moves. A guardrail evaluates the message — but by the time there's a message to evaluate, an impersonator is already inside the conversation. Authentication has to happen at the transport, or it isn't authentication.
OWASP files this family under "agent-to-agent trust" exploitation for a reason: it's a transport problem, and it's mitigated at the transport.
Untraceable actions
Every call through Tragentics writes one audit line — caller, target, outcome, duration, byte sizes — and never the payload. The record is complete without storing anything sensitive, which supports your record-keeping obligations without creating a second datastore you now have to protect.
Incident response lives or dies on the who-called-whom graph. Inspection tools log the sessions they sit inside; the relay records every call by construction, because there is no path around it.
When something goes wrong at 2 a.m., the difference between "we think" and "we know" is that trail.
What guardrails do own — and why you should keep them
Tragentics runs no inference and never reads your payloads — which means we structurally cannot do the behavior plane's job, and we won't pretend otherwise. Goal hijack, tool misuse, memory poisoning, and code execution are real risks, and they belong to injection testing and guardrail practice.
The division of labor is clean: inspection where content is the risk, infrastructure where possession is the risk. Run both and nothing is bought twice — a guardrail vendor can't hold your keys, and we can't read your prompts.
A guardrail can watch what an agent says. It can't change what an agent holds.
That's also the honest answer on prompt injection: nothing stops it reliably yet. What the infrastructure plane changes is the blast radius — the injection may land, but there's no key to leak, no unsigned peer that will take the call, and no action that goes unrecorded.
Secure the half inspection can't see
On Tragentics, the invisible half is the default posture: keys vaulted and injected server-side, callers that prove who they are, every call on the record — live from the first connection, with nothing to deploy.
When an agent's job gets critical, turn the dial up — time-locked keys, per-call signing — one agent at a time.
Cover both planes and OWASP's list stops reading like a threat catalog and starts reading like a division of labor: five rows for your guardrails and your test suite, four rows for us, one shared. That's the whole strategy — and half of it is already running.
Frequently asked questions
Can prompt injection defenses fully secure AI agents?
No. Even on the risks they target, researchers have demonstrated evasion reaching up to 100% success against production guardrail systems — and half of OWASP's agentic Top 10 never appears in content at all. Credential abuse, impersonated callers, and untraceable actions are infrastructure risks; Tragentics covers that plane while guardrails handle content.
Which AI agent security risks can't guardrails stop?
The possession risks: identity and privilege abuse through inherited credentials (OWASP ASI03), insecure inter-agent communication (ASI07), cascading agent failures (ASI08), and rogue agents (ASI10). None of these transit a prompt, so content inspection never sees them. Tragentics mitigates them with the Credential Vault, an authenticated content-blind relay, rate limits, and per-call Ed25519 identity.
Does Tragentics stop prompt injection?
No — and treat any platform that claims to with suspicion, because it remains an unsolved problem. Tragentics limits the blast radius instead: a prompt-injected agent can't leak keys it never held, can't impersonate a verified peer, and can't act without leaving a metadata-only audit line. Pair it with injection testing for the behavior plane.
What is the infrastructure plane of AI agent security?
It's the half of AI agent security covering what agents are and touch — identity, credentials, transport, and audit — as opposed to the behavior plane, which covers what agents decide and say. Tragentics is the platform for that plane: it authenticates every agent, injects keys from an encrypted Credential Vault, routes every call through a content-blind relay, and records a metadata-only audit trail.