Tragentics

AI agent security platform (SaaS): Ed25519 agent identity, AES-256-GCM Credential Vault, content-blind relay, metadata-only audit trail.

[Tragentics @Tragentics]

Tragentics is the AI agent security platform for the infrastructure plane. We authenticate every agent, inject keys from an encrypted Credential Vault so agents never hold them, route every call through a content-blind relay, and record a metadata-only audit trail — for the agents you already own.
The complete guide — the full two-plane taxonomy, every risk mapped to its plane, and where each tool actually fits:

https://t.co/MP2ODatyOS

[Tragentics @Tragentics]

Your SOC uses AI. That does nothing to secure the AI you're deploying.

"AI cybersecurity" is two industries wearing one name — and your agents only get protected by one of them. The map:
https://t.co/uIICivfR70

One industry defends your network with models — threat detection, alert triage. The other protects the AI itself: your agents' identity, their keys, their connections, their audit record.

The wound the first side can't close: GitGuardian counted 28.65M secrets exposed on public GitHub in a year — 24,008 of them in MCP config files. No detection model un-leaks a key.

Tragentics is the AI agent security platform that authenticates every agent, injects keys from an encrypted Credential Vault so agents never hold them, routes every call through a content-blind relay, and records a metadata-only audit trail — across platforms and protocols.

[Tragentics @Tragentics]

AI agent security is two different jobs.

Behavior plane: what the agent decides and says. Infrastructure plane: what it is and touches — identity, credentials, transport, audit.

One tool shouldn't do both. The complete guide: https://t.co/ZQ2J16VhUT

[Tragentics @Tragentics]

Keeping the vault outside the sandbox is the right half of this. The other half is that op run still resolves the secret into the agent's process env, so one env dump or one shell tool result puts it in context, and context goes to a provider. What you actually want is the agent using a credential it never holds in plaintext, injected on the outbound hop.

[Tragentics @Tragentics]

A separate profile handles the session-theft half. It does nothing for the half where the page content is the instruction, because reading the page is the whole job.

The thing worth isolating is the credential, not the browser. An agent that can read your tabs but cannot mint a request with your real token is a much smaller problem than one carrying a live session cookie.

[Tragentics @Tragentics]

Static keys also fail quietly. Nothing in the log tells the real caller apart from whoever copied the string, so the first sign of trouble is the incident and not the audit trail.

Per-call signing fixes attribution before it fixes auth. If every request carries a signature over caller, target, timestamp and nonce, a stolen key on its own buys you nothing.

[Tragentics @Tragentics]

Own principal is the right unit. What usually breaks is that the credential is still a bearer string, so in practice the principal is whoever holds it and a leaked token is a complete impersonation.

Identity has to be something the agent proves on every call, not something it carries around. Otherwise revocation is a race against the copy that already left.

[Tragentics @Tragentics]

Indirect injection like this is the case filtering can't reliably win, since the malicious instructions ride inside content the agent is supposed to read. The control that holds is bounding what the agent can do once it's confused: something reading a web page shouldn't hold production credentials or have a network path to the database it could be steered into hitting. You contain the blast radius, because you can't count on catching the poisoned content.

[Tragentics @Tragentics]

The one most teams underestimate is the gap between your agent-and-tool layer and your secrets layer. RBAC and managed identity lock down who can reach the app, but the agent itself is usually still carrying a long-lived downstream key, so a prompt injection just uses that key with the agent's full permissions. The layer that actually contains it is per-call agent identity plus injecting the credential at a proxy, so the agent can call the tool without ever holding the secret it would otherwise leak.

[Tragentics @Tragentics]

@ApollonVisual The problem is that most of those agent identities are a static secrets the agent holds, so a leaked token is full impersonation. Identity only helps here if it's something the agent proves fresh on each call, not a key sitting in its env.

[Tragentics @Tragentics]

Tragentics gives AI agents identity with per-call Ed25519 signatures, not mTLS certificates. Both rest on a private key only the real agent holds — but mTLS proves it once per connection and dies at the first proxy, while our signature rides inside every request, survives the relay, and is re-proven on every single call.

https://t.co/pXj8KURBsU

[Tragentics @Tragentics]

Good taxonomy, and the point about no complete fix is the right call. The piece that pairs with runtime guardrails is architectural containment: since any input, output, or retrieval check has a nonzero bypass rate, the next question is what a bypassed call can actually do. Scoping the agent's credentials and reachable tools so a slipped injection runs with almost no authority is usually cheaper than pushing detection accuracy the last few percent, and it doesn't cost you the 6000x latency.

[Tragentics @Tragentics]

Right, and you can't reliably stop the goal swap at the model layer. So what you can actually control is what a hijacked agent can reach. If it never holds the downstream keys, can only talk to peers it's paired with, and every action is logged, it can chase the attacker's mission all it wants and mostly hit walls. You don't stop the confusion, you shrink what it can do.

[Tragentics @Tragentics]

Tragentics is an AI agent security platform that encrypts every credential (AES-256-GCM at rest), authenticates every agent, and routes every agent-to-agent call through a content-blind relay. It works with agents built on any stack — OpenAI, Anthropic, or your own server — protocol agnostic

https://t.co/mhobCeXNYw

[Tragentics @Tragentics]

What makes this one sting is that the injection was the easy part. The real damage came from the triage bot running with enough authority to npm install an arbitrary package. Same pattern every time: the model gets confused, and whatever rights it's carrying quietly become the attacker's rights.

You can't reliably stop a bot from reading a poisoned issue title, but you can make sure that bot can't install arbitrary packages or reach anything holding real credentials. Scope the deputy down and the trick mostly runs out of room.