OX Security

No entries match these filters. Clear filters

1. Introducing Agent Activity: See What Your AI Agents Are Actually Doing (2026-10-28) Oct 28, 2026 · issue 124

   OX Security adds Agent Activity, a runtime tracing and guardrail feature for AI agents now in early access across OX.VibeSec and OX.Cloud⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

   └──▷ HOW TO FIND IT
   Investigate what an AI agent did during a suspicious session — trace its prompts, MCPMCPModel Context Protocol, a standard for connecting AI applications to external tools and data sources. A compatible server exposes capabilities an assistant can use through a common interface. calls, and sensitive data touches in one view.
   📍In OX.VibeSec or OX.Cloud, go to Agent Activity, select the agent session of interest, and review the full chain of prompts and responses, MCP server and tool calls, and any sensitive data (PII, secrets, tokens, financial data) touched during the session.
   Block a specific model from combining an MCP server with a skill that reaches sensitive internal data, before it can reach production.
   📍In OX.VibeSec or OX.Cloud, go to Agent Activity › Guardrails, create a custom policy scoped to the target model and MCP server, add the sensitive-data skill condition, and set the enforcement action to block with the severity level that fits your risk tolerance.
   • Adds a LiteLLM connector to bring LLMLLMA large language model, a neural network trained on large amounts of text to recognize patterns and generate language. Applications use it for tasks such as answering, summarizing and writing code. proxy traffic into OX Security's agent visibility picture.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
   • OX Security now traces each AI agent session step by step — covering prompts and responses, MCP server and tool calls, read/write access permissions, and sensitive data touches — via the new Agent Activity feature in early access on OX.VibeSec and OX.Cloud.
   • Build custom runtime guardrails scoped to specific AI models, MCP servers, and skills, with a choice to flag or block violations at a severity you set.
   • Start agent governance from 100+ built-in out-of-the-box security policies covering runtime agent behavior.

   4 details in Everything

2. LiteLLM 1.107.0 Compromised With A RAT InfoStealer (2026-10-21) Oct 21, 2026 · issue 116

   OX Security detects and blocks malicious LiteLLM 1.107.0 (RAT + infostealer) via VibeSec pipeline scanning⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

   ⤢ ⤢ ⤢ ⤢ ⤢ ⤢ ⤢ ⤢ ⤢ ⤢ ⤢
   • Adds litellm 1.107.0 to the OX Security malware database, blocking installation for VibeSec customers and redirecting them to the safe version 1.106.0.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
   • OX platform pipeline scan now blocks code pushes that include the compromised litellm 1.107.0 as a dependency.
   • Adds litellm 1.107.0 to the OX Security malware database, blocking installation for VibeSec customers and redirecting them to the safe version 1.106.0.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

   1 more in Everything

3. OX Security Launches OX Cloud, Redefining Cloud Security for the Agentic Era (2026-09-16) Sep 16, 2026 · issue 076

   OX Security launches OX Cloud with AI Detection and Response (AIDR) and Agentic Attack Surface Management (AASM) for AI-agent visibility in cloud environments.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

   • Adds AI Detection and Response (AIDR) to detect and govern AI agent activity across cloud and runtime environments in real time.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
   • Adds Agentic Attack Surface Management (AASM) to discover AI agents, models, MCPMCPModel Context Protocol, a standard for connecting AI applications to external tools and data sources. A compatible server exposes capabilities an assistant can use through a common interface. servers and non-human identitiesnon-human identitiesA non-human identity, an account or credential used by software or a device rather than a person. Service accounts, workload identities and automation tokens need their own permissions and lifecycle controls. and map what they can reach.
   • Introduces OX Cloud as a full CNAPPCNAPPA cloud-native application protection platform that combines checks across cloud configuration, workloads and development. It helps teams connect risks that separate tools might report apart. platform covering Cloud Security Posture Management (CSPMCSPMCloud security posture management, checking cloud resources for risky settings and policy violations. It helps teams find exposed services, overly broad permissions and other configuration gaps.), Kubernetes Security Posture Management (KSPMKSPMKubernetes Security Posture Management: a category of tooling that continuously audits Kubernetes clusters against configuration best practices and compliance policies to surface misconfigurations before attackers exploit them.), Data Security PostureData Security PostureAn organisation's overall state of readiness to protect data, covering where sensitive data lives, who can reach it, and whether controls are correctly applied — giving cyber tools a continuous risk baseline to act on. Management (DSPMDSPMData security posture management, locating sensitive data and checking how it is protected and who can reach it. It helps teams prioritize risks around their data stores.), runtime vulnerability detection, cloud inventory and graph-based attack path analysis.
   • Provides reachability-based prioritization to filter out risks that cannot actually be reached in cloud environments.
   • Alert detail views show who or what acted, what they touched and what else they could have reached.

   5 details in Everything

4. OX Cloud: CNAPP Coverage Plus Runtime Security for AI Agents (2026-09-16) Sep 16, 2026 · issue 076

   OX Cloud launches as a unified CNAPPCNAPPA cloud-native application protection platform that combines checks across cloud configuration, workloads and development. It helps teams connect risks that separate tools might report apart. platform with real-time AI agent detection (AIDR), runtime inspection, and reachability-based prioritization.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

   ⤢ ⤢ ⤢ ⤢
   • Adds AIDR (AI Detection and Response) for real-time detection and governance of AI-driven usage, configuration, and threats across cloud and runtime environments, including AI agents calling tools, models accessing data, and MCPMCPModel Context Protocol, a standard for connecting AI applications to external tools and data sources. A compatible server exposes capabilities an assistant can use through a common interface. servers executing autonomously.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
   • Adds Agentic Attack Surface capability, powered by the OX Agent, to uncover hidden backdoors and reachable exposures through agentic-level inspection.
   • Adds Runtime Events capability for investigating runtime anomalies with full context to accelerate incident detection and triage.
   • Adds Runtime Vulnerabilities detection to identify vulnerabilities actively exposed in running workloads and prioritize what is truly exploitable.
   • Adds Cloud Graph and Attack Path Mapping to visualize relationships across cloud assets, including lateral movementlateral movementMoving from an initially compromised system or identity to other resources in a network. Attackers often use stolen credentials or trusted connections to expand their access. paths and blast radius.

   +5 more show less

   • Adds Cloud Inventory providing a continuously updated inventory of every workload, identity, data store, Kubernetes cluster, and AI agent actually running in the environment, including shadow AI and unmanaged non-human identitiesnon-human identitiesA non-human identity, an account or credential used by software or a device rather than a person. Service accounts, workload identities and automation tokens need their own permissions and lifecycle controls..
   • Adds CSPMCSPMCloud security posture management, checking cloud resources for risky settings and policy violations. It helps teams find exposed services, overly broad permissions and other configuration gaps. (Cloud Security Posture Management) for continuous detection of cloud misconfigurations and compliance enforcement across all cloud accounts.
   • Adds KSPMKSPMKubernetes Security Posture Management: a category of tooling that continuously audits Kubernetes clusters against configuration best practices and compliance policies to surface misconfigurations before attackers exploit them. (Kubernetes Security Posture Management) for monitoring Kubernetes security risks including misconfigurations and policy compliance.
   • Adds DSPMDSPMData security posture management, locating sensitive data and checking how it is protected and who can reach it. It helps teams prioritize risks around their data stores. (Data Security PostureData Security PostureAn organisation's overall state of readiness to protect data, covering where sensitive data lives, who can reach it, and whether controls are correctly applied — giving cyber tools a continuous risk baseline to act on. Management) to discover, classify, and protect sensitive data across cloud environments.
   • Introduces reachability-based filtering to eliminate unreachable misconfigurations, vulnerable packages, and supply-chain exposures from the findings backlog, surfacing only what is exploitable and evidenced.

   10 details in Everything

5. Vet Every Dependency Your Agents Install with OX VibeSec (2026-09-09) Sep 9, 2026 · issue 069

   OX VibeSec adds Dependency Vetting to block malicious or freshly published packages before AI agents install them.

   • Adds Dependency Vetting capability that inspects every AI agent install attempt against policy and blocks known-malicious packages outright before they touch the developer machine or SBOMSBOMA software bill of materials, an inventory of the components and versions inside an application. It helps teams find affected software when a dependency has a vulnerability or licensing issue..
   • Introduces a configurable cool-down period that blocks freshly published packages until the community has had time to flag them.

   2 details in Everything