At RSAC 2026, Cisco unveiled a set of security measures aimed at autonomous AI agents, including DefenseClaw, an open-source project that hunts for vulnerabilities in the tools, extensions and resources these agents rely on. The thesis is simple: securing agents is becoming a prerequisite for enterprise deployment.
🔑 Key takeaways
- DefenseClaw, an open-source project, targets OpenClaw-type agents and can be installed in about five minutes.
- Blocking rules take effect within two seconds, without restarting the affected agents.
- Three complementary offerings accompany the release: LLM Security Leaderboard, AI Defense Explorer Edition and Agent Runtime SDK.
- In a survey, 85% of large enterprise clients said they were experimenting with AI agents, but only 5% had deployed them in production.
DefenseClaw, a security control layer for OpenClaw agents
AI agents that carry out tasks autonomously depend on external components: MCP (Model Context Protocol) servers, plug-ins and “skills” (software capabilities). Each of these can introduce a flaw. That is the attack surface DefenseClaw is designed to cover. Cisco presents it as a framework that reduces the friction between building agents and securing them.
According to Cisco, the project can be installed in about five minutes. It analyses cybersecurity issues in the MCP tools, plug-ins and other technical resources an agent uses, then tracks how those resources change so that vulnerabilities introduced later are not overlooked. Continuous monitoring of this kind differs from a one-off audit.
The project is built on top of OpenShell, an open-source security project for OpenClaw that Nvidia published the week before Cisco’s announcement. DefenseClaw is designed to integrate directly with OpenShell to provide automated security controls at runtime. It also includes a permissions management function that can block specific MCP servers.
Blocking applied without a restart
Cisco says blocking rules are enforced within two seconds, without restarting the affected agents. DJ Sampath, senior vice president of Cisco’s AI and software platforms business, described how the system behaves:
“When you block a skill, its sandbox permissions are revoked, its files are quarantined, and the agent gets an error if it tries to invoke it. When you block a MCP server, the endpoint is removed from the sandbox network allow-list and OpenShell denies all connections.”
DJ Sampath, Senior Vice President, AI and Software Platforms, Cisco
In practice, blocking a skill revokes its sandbox permissions, quarantines its files and returns an error to any agent that tries to call it. Blocking an MCP server removes its endpoint from the sandbox network allow-list, and OpenShell refuses all connections to it.
DefenseClaw also includes a control for agents used to write software. The tool can analyse the code those agents produce to detect malicious code. A connector sends telemetry on detected cyber risks to Splunk.
Three offerings to evaluate models and test agents
Alongside DefenseClaw, Cisco launched three tools or offerings in the same announcement. They cover model evaluation, adversarial testing and secure agent development.
| Offering | Access | Main function |
|---|---|---|
| LLM Security Leaderboard | Public ranking | Measures how well large language models resist malicious instructions and jailbreak attempts |
| AI Defense: Explorer Edition | Free, self-service | Multi-turn red teaming, prompt injection tests and exportable reports |
| Agent Runtime SDK | Development teams | Enforces security policies from the development phase onward |
The LLM Security Leaderboard ranks models by how they handle malicious prompts and circumvention attempts. Cisco describes it as a resource for assessing model risk and exposure to adversarial attacks, giving enterprises usable signals for their risk reviews.
The Explorer Edition of AI Defense is free and self-service. It runs on the same AI Defense Validation engine used by Global 2000 clients. After registering, developers, AppSec teams and researchers can red-team the models and applications destined for agentic workflows. The offering includes multi-turn adversarial tests, resistance checks against prompt injections, jailbreaks and other unsafe outputs, and exportable security reports for compliance reviews.
Access is API-driven and can be wired into CI/CD pipelines such as GitHub Actions, GitLab, Jenkins and custom systems. Team members can collaborate, and the offering can be extended with AI Defense Enterprise for advanced controls based on role-based access control (RBAC).
The third component, the Agent Runtime SDK, embeds security policy enforcement directly into agent workflows from development onward. It supports AWS Bedrock AgentCore, Google Vertex Agent Builder, Azure AI Foundry, LangChain and other frameworks.
Zero Trust, agent identity and monitoring
Cisco is extending its Zero Trust Access approach to AI agents. Agents can be registered in Duo IAM and linked to a human sponsor, giving them a verified identity and making their actions traceable. Permissions can be limited to the tasks and resources required, with a defined time window. All tool-related traffic must pass through an MCP gateway to avoid blind spots.
“AI agents aren’t just making existing work faster; they’re a new workforce of co-workers that dramatically expand what organizations can accomplish.”
Jeetu Patel, President and Chief Product Officer, Cisco
Cisco is also strengthening Splunk, which it acquired in 2024. The exposure inventory is now built into Splunk Enterprise Security by default, providing a continuously refreshed inventory of assets and users, real-time risk scoring and relationship mapping. A unified detection studio lets teams design, test, deploy and monitor rules, with automatic mapping of coverage to MITRE ATT&CK.
Six specialised agents are announced for Splunk, meant to go beyond data aggregation by evaluating and executing security workflows:
- Detection Builder Agent
- Standard Operating Procedures Agent
- Triage Agent
- Malware Threat Reversing Agent
- Guided Response Agent
- Automation Builder Agent
The survey Cisco cites highlights the gap to close: 85% of respondents are experimenting with AI agents, against only 5% in production, a gap of 80 percentage points. The sources provided do not detail the survey’s methodology or sample size.
A2A Scanner and AI Registry: securing agent-to-agent traffic
Cisco has also open-sourced its A2A Scanner, built to monitor communications between autonomous agents. The Agent-to-Agent protocol, adopted in April 2025 after the Model Context Protocol was introduced in November 2024, lets agents built on different models or platforms communicate directly without human intervention. Enterprises and agents now run dozens to hundreds of MCP servers.
The scanner combines five complementary engines:
- signature-based detection;
- protocol compliance validation;
- behavioural heuristic analysis;
- dynamic testing with an endpoint analyser;
- semantic interpretation by an LLM-powered analyser.
It pairs static analysis of agent definitions, including metadata, manifests and Agent Cards, with dynamic monitoring of communications. Targeted threats include impersonation of trusted agents, indirect prompt injection through live streams such as Server-Sent Events, capability inflation, privilege escalation between agents, artefact tampering, task replay, infinite loops and resource exhaustion. Findings are classified from LOW to CRITICAL.
In its collaboration with AWS, Cisco AI Defense offers analysis of every MCP server, A2A agent and Agent Skill before it goes into operation. AI Registry, an open-source project backed by AWS, provides a centralised control plane for registering and discovering these components. Three analysis methods are used: YARA Analyzer for fast detection of known threats, LLM Analyzer based on Amazon Bedrock models for semantic analysis, and Cisco AI Defense’s proprietary scanners. When a problem is detected, the asset is automatically disabled and tagged “security-pending” until an administrative review.
AWS notes that manual security reviews can delay each AI application deployment by several weeks. The checks can run at registration or on demand, including across the whole registry through a Cron job, and can feed ServiceNow ticket creation, real-time Slack alerts, and results sent to Splunk or Datadog.
“Security is a foundational requirement for enterprise AI adoption.”
Akshay Bhargava, Vice President of AI, Cisco
Conclusion: security as a precondition for adoption
Cisco’s announcements signal a shift in priorities: securing agents now comes before large-scale deployment. The sources provided, however, contain no stock market reaction, no change in Cisco’s share price and no measurable commercial adoption data that would allow the financial impact of these launches to be quantified. The Register excerpt supplied contains only the headline, so further details could not be verified from it.
Three scenarios stand out. In the first, controls are quickly embedded in CI/CD pipelines and shorten time to production. In the second, the proliferation of open-source and commercial tools creates fragmentation that enterprises struggle to manage. In the third, compliance requirements, notably SOX and GDPR, accelerate the adoption of formalised controls. The outcome will depend on whether these solutions can work together.
Sources
- The Register, October 28, 2026
- Cisco AI Defense, product page
- AWS Machine Learning Blog, securing AI agents with Cisco AI Defense
- Help Net Security, March 24, 2026
- Cisco AI Blog, A2A Scanner
- SiliconANGLE, March 23, 2026
Cet article est publié à titre informatif et éducatif. Il ne constitue en aucun cas un conseil en investissement. Faites vos propres recherches (DYOR) avant toute décision.
