blog

Insights & Research

Product news, threat research, and best practices for teams securing AI agent workflows.

[15/ 15]

MARKETMay 24, 2026

What Is AI Agent Runtime Security? The Complete Definition

AI agent runtime security is the discipline of monitoring, scoring, and controlling what AI agents actually do at execution time — at the operating system, network, and tool-call layers — independent of what they were configured or prompted to do. Here's the full definition, the layers it covers, and why it's the security category that didn't exist two years ago.

Quint Security Team

MARKETMay 1, 2026

Quint vs Protect AI: When to Use Each

Protect AI (now Palo Alto) secures the model supply chain. We watch what the agent does after the model ships. Two different problems, both worth solving. Here's how to figure out which you have.

Quint Security Team

MARKETApr 30, 2026

Behavioral Security for AI Agents: What It Is, Why It's Different, and Why Static Controls Fail

Behavioral security for AI agents is the practice of building a baseline of normal agent behavior, scoring every action against that baseline, and flagging divergence the moment it happens. Here's how it differs from every other AI security category — and why it's the only approach that catches what the agent actually does vs. what it claims to do.

Quint Security Team

THREAT REPORTApr 30, 2026

Claude Code Security Risks: A Pragmatic Guide for Security Teams

Claude Code is the most powerful AI coding agent in production. That also makes it the most dangerous. Here's an honest look at the risks and what security teams should actually do.

Quint Security Team

THREAT REPORTApr 30, 2026

Cursor Security Risks: What Every Enterprise Should Know Before Deploying the AI Code Editor

Cursor ships with autonomous file access, shell execution, MCP tool use, and auto-apply edits enabled by default. Here are the specific risks that matter and what to actually do about them.

Quint Security Team

THREAT REPORTApr 30, 2026

The MCP Security Checklist: 12 Things to Do Before You Trust Any MCP Server

MCP servers are running with your shell access, your API keys, and your data. Here are the 12 specific checks to run before connecting one to any AI agent in your org. Includes a print-friendly version.

Quint Security Team

MARKETApr 30, 2026

What Is Behavioral Security? Definition, Examples, and Why It Matters for AI Agents

Behavioral security is the practice of establishing a baseline of normal activity for a system, then scoring every new action against that baseline. When applied to AI agents, it catches the attacks that static rules and prompt filters miss.

Quint Security Team

MARKETApr 26, 2026

Quint vs Prompt Security: When to Use Each

Prompt Security watches employees pasting things into ChatGPT. We watch autonomous agents doing things on machines. Both are real problems. Only one of them is probably yours — or you've got both, which is more common than you'd think.

Quint Security Team

MARKETApr 17, 2026

Quint vs Lakera: When to Use Each for AI Agent Security

Lakera reads what goes in and out of your LLM. We watch what the agent does after. Different layers, different jobs. Here's how to tell which one you actually need — and why a lot of teams end up running both.

Quint Security Team

RESEARCHApr 9, 2026

The AI Agent Threat Model: A Complete Map of the Attack Surface in 2026

Every AI agent is a distributed system with a language-shaped attack surface. Here's the complete threat model — seven attack classes, with real incidents for each — and what it means for how you secure production AI agent deployments.

Quint Security Team

THREAT REPORTMar 30, 2026

One Click. Full Compromise. How OpenClaw's Marketplace Became AI's First Supply Chain Crisis.

40,000 exposed instances, 820+ malicious skills, and a patch nobody installed. I've been tracking OpenClaw since the first disclosure — here's what actually happened, and the part nobody's writing about.

Hamza

THREAT REPORTMar 28, 2026

Meta's Rogue AI Agent Passed Every Identity Check. Then It Triggered a Sev-1.

An autonomous AI agent inside Meta posted flawed technical advice without human approval, exposing proprietary code and user data for two hours. Every identity check said the request was legitimate. Here's what the incident reveals about the four post-authentication gaps enterprise security hasn't closed.

Hamza

COMPLIANCEMar 27, 2026

EU AI Act Article 9: What It Actually Requires from Your AI Agents

The EU AI Act high-risk enforcement deadline is August 2, 2026. Here's a plain-language breakdown of Article 9 and what it means for teams deploying AI agents.

Hamza

MARKETMar 27, 2026

Shadow AI in Your Dev Environment

Most AI tools in the enterprise operate without IT approval. For AI agents with tool access, that's not just a governance gap — it's a breach waiting to happen.

Amer

THREAT REPORTMar 27, 2026

MCP Tool Poisoning: The AI Agent Supply Chain Threat You're Not Watching

I spent a weekend auditing MCP servers from the top three marketplaces. A quarter of them carried instructions no user ever sees. Here's what I found, what I missed, and how we caught it.

Hamza