Request a review
Edition 1 · out now

ARI-42, the Agent Risk Index

42 security requirements a product built on AI agents should meet, and how far 85 widely used agent frameworks, SDKs, harnesses and MCP tools actually take you toward each one. Every requirement is tied to the 2025-26 CVE and incident record that motivates it.

Get your agent stack reviewed Request the full 42 questions

Edition 1.0
Published 8 Nov 2026
Assessed 6-8 Nov 2026
Scope products that embed AI agents: tool use, memory, code execution, MCP, delegated access
Maintainer Akash Munshi

3%of tool × requirement pairs are met by a tool's defaults
42verifiable requirements in 10 domains
85agent tools rated, across 8 categories
2,099ratings, each tied to a cited source
129,058CVEs published in 2025-26, screened
7,257of them in AI or agent software
759AI incidents from 2025-26 reviewed
420ratings corrected after all 2,099 were re-checked in a disposable sandbox
Key findings

Counts of documented behaviour and published records, not measurements of any deployed system.

01 · coverage34%

The builder carries the requirement alone

Of 2,099 applicable pairs, only 55 (3%) are met by a built-in feature. 1,032 (49%) get partial help, usually a setting that is off by default, in preview or on a paid tier. In 704 (34%) it is entirely on you, and 308 (15%) are Risks.

02 · code execution1,302

CVEs a code sandbox would have prevented

Sandboxing agent-generated code is the most-violated requirement. 37 of 70 tools still run agent code on the host by default or rest on a recent sandbox escape. Only 2 meet it by default.

03 · supply chain53 of 70

Tools had a relevant 2025-26 vulnerability

The agent stack is now critical supply chain. 68 of the 85 tools had at least one security incident: 221 in total, 166 of them in 2026.

04 · growth3.0 → 7.0%

AI software's share of all CVEs more than doubled

From 2025 to 2026 to date. About half are flaws in AI-specific features; the rest are ordinary web flaws shipped inside AI products.

05 · MCP and memory21%

Of MCP ratings are Risks

MCP and agent-memory tooling carry the most risk (21% and 18%, against 11-17% elsewhere). 28 of the 47 tools that expose an MCP or agent endpoint ship it without authentication by default.

06 · incidents89 of 759

Incidents the builder's own controls would have changed

39 involved an agent taking a harmful action, most often deleting production data or acting without approval.

8 of the 42

Questions every agent product should be able to answer

  1. OUT-4

    Does code your agent generates run in a disposable sandbox, with no host files, secrets or open network?

    Per session, not as root, no customer data beyond the task, no eval() of model output. Proof: a test showing generated code can't read host files or environment.

    1,302related CVEs
  2. OUT-1

    Is model output validated before it reaches SQL, a shell, HTML, an API or another agent?

    Model-written SQL runs only through parameterised templates or under the user's own database identity. Proof: output schemas and the database role used by AI-generated queries.

    1,131related CVEs
  3. AUTH-2

    Can an agent ever do more than the user it is acting for?

    The user's token is never passed to third-party tools, and each delegation hop gets scopes no wider than the one before. Proof: on-behalf-of token design and authorisation tests.

    1,108related CVEs
  4. MCP-3

    Is every MCP server or agent API you expose authenticated, tenant-scoped, rate-limited and logged?

    OAuth per the current MCP spec. Proof: auth configuration and a pen test of the endpoint.

    750related CVEs
  5. INJ-4

    Can your agents reach any domain on the internet, or only the ones you allow?

    Deny-by-default egress for agent runtimes, CI runners and AI gateways, DNS included. Proof: a test showing an arbitrary domain is unreachable.

    636related CVEs
  6. GW-2

    Is your agent stack treated as critical supply chain?

    Gateways, frameworks and inference servers hash-pinned, authenticated and patched against known exploited vulnerabilities within days. Proof: lockfile hashes, image digests, patch tickets.

    208related CVEs
  7. AUTH-3

    Do sends, payments, deletes and deploys need human approval tied to the exact action?

    The approval screen is built from the real tool-call arguments, not the model's summary, and enforced outside the model. Proof: approval matrix and approval event logs.

    39harmful-action incidents
  8. INJ-2

    Does any agent hold private data, read untrusted content and have a way to send data out, all at once?

    That combination is the lethal trifecta for prompt injection. Name the control that breaks the chain for each agent. Proof: a per-agent capability matrix.

    45 of 68tools leave it to you
GOV inventory and governanceDATA data sent to modelsAUTH agent identity and permissionsINJ untrusted content and injectionOUT output and behaviourMCP servers, tools and skillsGW providers and gatewaysLOG logging and incidentsEVAL testing and red-teamingSDLC coding agents in engineering

The other 34 requirements, with the evidence a reviewer should ask for and their mappings to OWASP, MITRE ATLAS, CoSAI and ISO, are in the full list. Request it here.

How a review works

For teams shipping a product built on AI agents.

  1. 01

    You list your stack

    The frameworks, SDKs, MCP servers, memory, sandboxes and gateways your agents run on, using the form below.

  2. 02

    I map it to the index

    Each tool against all 42 requirements, from the Edition 1 ratings and its current version.

  3. 03

    We agree access, safely

    Read-only, scoped and time-boxed: a repo invite, a staging account or a walkthrough. Never through this form.

  4. 04

    You get the report

    Every requirement marked built in, partial, gap or risk for your stack, with the evidence and fixes ordered by real-world impact.

Built inA documented feature meets most of the requirement.
PartialThe tool helps, but the feature is off by default or incomplete.
GapThe requirement applies; you must build it yourself.
RiskThe default works against you, or a 2025-26 vulnerability broke it.
Request

Get your stack reviewed, or the full list

I reply by email, usually within two working days.

What would you like?
Tools your agents run on
Access you could give for the review (we set it up later, together)
Timeline
Please don't paste passwords, API keys or tokens here. If the review needs access, I'll reply with a scoped, time-boxed way to grant it, such as a read-only invite or a one-time secret link. Secrets pasted into forms end up in places they shouldn't: that is one of the 42 requirements.

Thanks, it's in.

I'll reply by email. Your reference is .