Research and development

What we build.

Research and development is a standing part of the practice, not a side project. We build methods, test suites and tooling for the problems that come up in agent security again and again. This page lists the current work. It is separate from our services, and it is where most of them come from.

Technical preview Open source · @agent-auth/x402

Agent Auth for x402

Agents are beginning to pay for API calls, data, and services through machine-to-machine protocols such as x402. Programmable wallets can protect keys and enforce transaction-level rules. They do not usually know which task authorized a payment, which tool initiated it, or how that payment affects the task’s aggregate budget.

Agent Auth for x402 is open-source authorization middleware that connects payments to trusted agent tasks. Before the configured wallet signs, it checks the actual payment against a short-lived task grant, resource scope, deterministic policy, and budget. Payments outside that authority are denied or escalated for approval, with evidence linking the task, decision, signature, and outcome.

The technical preview supports x402 exact payments using USDC on Base. It works with the official x402 client and is designed to complement—not replace—wallet-native security. If you are building agents that spend money, you can try the package, contribute, or help shape the broader agent-authorization platform.

What the package adds. Signed, short-lived task grants issued outside the model’s control; scopes for agent, tool, method, domain, path, recipient, network, asset, amount and task total; budget reservations before signing; single-use permits bound to the exact payment; an optional permit-bound remote signer so the agent never holds wallet credentials.
What stays where it is. x402 owns requirement selection, payment payloads, headers and retries. The wallet owns keys, simulation, allowlists, MFA and quorum approval. The merchant, facilitator and network own verification and settlement. Wallet-native policy stays switched on as the final loss boundary.
Where it stands. Not production-ready. In library-only mode the middleware blocks signing in the configured client but cannot stop a compromised process from using another signer; that needs the gateway deployment. The local demo runs against a fixture merchant and does not settle on-chain. x402 is the first adapter; the grant, policy, permit and evidence model is protocol-neutral.

Talk to us about it Mostly Harmless on GitHub

An AI agent is handed a narrowly scoped key for its task, while a separate, consequential machine stays behind a human approval point. — A task grant scopes what the agent may buy A person approves the exception

Open · v0.1 Methodology · CC BY 4.0

TRACE for agentic AI

A threat-modelling methodology for systems in which an AI model perceives inputs the operator does not control, decides with some latitude, and acts through tools, code, messages or other agents.

It adapts TRACE, the threat-modelling methodology Dr. Stefan Beyer, founder of Mostly Harmless, designed at Oak Security, and keeps it intact: threat actors, roles, assets, critical invariants and edges, followed by STRIDE threat identification, attack trees, collusion inspection and a mitigation roadmap, with human approval gates between phases.

On top of that it adds six optional phases for agentic systems. A short applicability screen decides which of them apply. A system that only calls a model for classification is modelled with plain TRACE.

Read it on GitHub

Agentic model objects. The agent as a role and as a threat actor, instruction and data classification of every channel, delegation chains, memory stores, provider dependencies, eight agentic invariants and nine agentic edge types.
MITRE ATLAS as the adversary vocabulary. A technique pass per edge alongside STRIDE, tagged attack trees, and a mandatory injection-to-action tree for every agent that can act.
Autonomy and multi-agent inspection. Agent combinations, whether a second-agent check is independent, cascading failure, and self-extension through new tools, accounts or deployments.
NIST AI RMF as the governance vocabulary. A crosswalk from findings to RMF functions and Generative AI Profile actions, and a one-page human-oversight design statement for the report.

Both the original TRACE and the agentic extension were designed by Dr. Stefan Beyer. The specification, the ATLAS and NIST crosswalks, and the change log against the original are public under CC BY 4.0. We use the method in every architecture and review engagement.

Ongoing Practice and tooling

Security evaluations for agents

Most agent security findings are lost once the report is delivered. The system changes, the model is swapped, a prompt is edited, and nobody re-runs the attack.

We are building the practice of turning findings into security invariants, for example "an email-reading agent cannot initiate a payment", and into automated evaluations that run when the model, the prompt, the tools or the policy change. The goal is a release gate that says whether the control still holds.

A security tester runs a hostile document through a contained AI system. A control stops the attack and the case is filed for future release testing. — A finding becomes a test The test runs on every change

Areas we follow

The questions that keep coming up

01Prompt injection that ends in an action, not a sentence
02Identity and authority for agents: who the agent is, what it may do, and for how long
03Payments and other irreversible actions taken by agents
04Tool, MCP server and model supply chains
05Runtime evidence: what to record so that an incident can be reconstructed

Commissioned research

Have a question that needs a proper answer?

We also take research on commission: a focused investigation into an attack class, a protocol, a framework or a control pattern, delivered as a technical report, a proof of concept or a reference design. It is scoped and priced like any other engagement.

Discuss a question