What is an AI agent security gateway, and what must it do?

TL;DR. An AI agent security gateway is an enforcement point between an AI agent and everything the agent can touch: tools, MCP servers, APIs, databases, file systems, other agents. It authenticates every connection, applies policy before an action executes, and records what happened under the agent's own identity. The category exists because agent attacks land at the execution layer, below the model: AutoJack (June 2026) turned a single web page into host-level RCE through an unauthenticated MCP WebSocket, and Gravitee's 2026 survey found 88% of organizations reporting confirmed or suspected agent incidents. Guardrails on model output enforce none of this.

By mid 2026, 88% of organizations reported confirmed or suspected AI agent security incidents in the previous year, rising to 92.7% in healthcare, and more than half of enterprise agents ran with no security oversight or logging at all (Gravitee, State of AI Agent Security 2026). The infrastructure answer the market converged on is the AI agent security gateway. This page defines the category: what a gateway is, the threat model that produced it, the controls a real one must enforce, how the vendor landscape organizes, and how to evaluate one.

What an AI agent security gateway is

An AI agent security gateway sits between an agent and everything the agent can reach: APIs, databases, file systems, MCP servers, other agents. It enforces policy before an action executes, not after text is generated. Concretely, it authenticates every connection an agent opens, decides whether a specific tool call is allowed for this agent acting for this user, and writes an audit record of what was requested, what was decided, and what ran. It brings agents under the same audit, revocation, and least-privilege model that network security teams have applied to human users for decades, with the agent as the policy subject.

That framing separates the category from two things it gets confused with. An API gateway governs inbound traffic to your services; the policy subject is the caller. An agent security gateway governs outbound actions by semi-autonomous software; the policy subject is the agent and the identity chain behind it. And guardrails (output filters, content classifiers, prompt injection detectors) operate on model input and output. They do nothing when an agent calls an API it should not reach, or when a local MCP endpoint accepts unauthenticated connections from a web-browsing agent.

The threat model a gateway answers

Security teams spent 2024 and 2025 hardening the model layer: prompt injection detection, content policies, output filters. Those controls matter, and the 2026 attack record shows exploitation arriving somewhere else: at the execution layer, meaning the tools, shell access, file systems, and MCP endpoints an agent can reach. Four observations define the threat model.

Localhost is not a trust boundary. Any agent that can browse the open web and talk to local services can be weaponized by any page it visits, because the page renders inside the agent's trusted context. AutoJack, below, is the public proof.

Structured channels carry implicit trust they have not earned. Data arriving through an authenticated MCP server reads to the agent as system output rather than untrusted input. The agentjacking disclosure (Tenet Threat Labs, June 2026) hijacked coding agents in 85% of controlled attempts by poisoning Sentry error events read over MCP; the attack path is broken down below.

Agent identity is the prerequisite for everything else. Only 21.9% of enterprise teams treat AI agents as independent, identity-bearing entities. Without dedicated agent identities (scoped credentials, separate audit trails, individual revocation), least-privilege enforcement and incident response are not achievable in practice.

Spend is a security signal. Agent costs are not bounded by human friction. A runaway loop or adversarial over-consumption manifests first as an anomalous spend pattern, which makes cost visibility an incident indicator, not just a budget concern.

The gap is widening on both sides: the enterprise agent fleet roughly doubled between December 2025 and April 2026 while monitoring and accountability structures barely moved (Gravitee), and Gartner's 2026 Hype Cycle for Agentic AI now lists governance, security, and cost control as defining signals alongside core agentic capabilities.

Agentjacking: a poisoned Sentry event hijacks a coding agent over MCP

Tenet Threat Labs showed that anyone holding a target's Sentry DSN can steer the coding agent that reads its errors. The DSN is, in Tenet's words, "a public, write-only credential that Sentry intentionally documents as safe to embed in frontend JavaScript," and Tenet found 2,388 organizations with valid injectable DSNs through passive reconnaissance.

The chain Tenet published, step by step:

1. Find the DSN in the target's frontend JavaScript or through code search.
2. Post a crafted error event to Sentry's ingest endpoint with that DSN alone.
3. Write markdown into the event's message field and context key names, dressed as Sentry resolution guidance.
4. Wait for a developer to ask their agent to fix unresolved Sentry issues. The agent queries Sentry over MCP and gets the poisoned event alongside the real ones.
5. The agent runs the suggested npx command, which downloads and runs attacker code with the developer's privileges.
6. The package reads environment variables such as AWS keys and GitHub tokens and sends them out.

Tenet reports an 85% exploitation success rate: across its controlled validation waves, more than 100 AI coding agents, including Claude Code, Cursor and Codex, acted on the injected errors. That is the vendor's own measurement, not an independent one.

It is hard to patch because no single component is broken. Sentry acknowledged the report and declined a root fix, calling it "technically not defensible," and Tenet notes there is "nothing malicious to detect. Every action in the chain is authorized." The check has to sit on the agent's side of the MCP seam, before the agent acts on what a server returned, which is the runtime inspection control below.

AutoJack: the mechanics matter beyond AutoGen

The clearest single illustration of the execution-layer threat model is AutoJack, disclosed by Microsoft's Defender Security Research team on June 18, 2026: a three-flaw chain in AutoGen Studio, Microsoft's own open-source multi-agent framework, that let one malicious web page deliver remote code execution on the host running the agent. Zero credentials, no user interaction.

The chain, weakness by weakness:

1. Origin allowlist bypass (CWE-1385). The MCP WebSocket accepted connections only from http://127.0.0.1 or http://localhost. But a web-browsing agent renders remote pages inside that trusted origin context, so the check passed for any page the agent fetched.
2. Unauthenticated MCP endpoint (CWE-306). Authentication middleware explicitly skipped /api/mcp/* paths on the assumption that the WebSocket handler enforced its own checks. It never did, so the endpoint accepted unauthenticated connections regardless of the auth mode configured elsewhere in the app.
3. Shell parameter injection (CWE-78). The endpoint accepted a server_params query parameter, base64-decoded it, and passed command + args directly to stdio_client() with no executable allowlist. Supplying bash -c '...' as the "MCP server" achieves host-level RCE.

The fix landed upstream in AutoGen Studio PR #7362 (commit b047730), which removes URL-based parameter reading entirely. The vulnerable surface never shipped in a stable PyPI release; exposure covered teams running from-source builds or the pre-release 0.4.3.dev1 and 0.4.3.dev2 packages alongside a web-browsing agent before the fix.

Treating this as a patch advisory misses the structural point. Every link in the chain is a generic pattern: an origin check that assumes browsers only render trusted content, a local endpoint that assumes only local processes will reach it, a command path with no allowlist. Any framework that couples browser access with privileged local services faces some version of this, which is why the CWE chain, not the product name, is the lasting content of the disclosure. Localhost stops being a trust boundary the moment your agent browses the open web.

What a gateway must enforce

Vendors disagree on packaging; the control set is converging. A gateway missing any of these six is a partial one, whatever the label says.

Agent discovery and inventory. A real-time map of running agents, the tools and MCP servers they can reach, and the identities they run under. Most organizations have no such inventory: only 24.4% report full visibility into which agents are communicating with each other (Gravitee).

MCP endpoint authentication and origin validation. Every MCP connection requires credentials, with no path exceptions and no trust-by-default for localhost, and connections are validated as originating from the expected agent context rather than from arbitrary web content a browsing tool rendered. This is the control that removes the AutoJack pattern.

Tool and MCP access policy. Tool calls are allowed or denied before they execute, based on agent identity, user context, request content, and org policy: the enforcement point that keeps an agent off a database it should not touch or away from an unvetted MCP server. Shell and stdio invocation paths gate on an explicit executable allowlist, and unknown commands fail closed.

Runtime content inspection. Static allowlists do not catch a permitted tool driven by a poisoned input. The gateway must inspect tool-call content in flight, the WAF equivalent for MCP traffic: never trusting what flows through a structured channel just because the channel is authenticated. This is the control aimed at trusted-path injection.

Audit trails. Every tool call, MCP interaction, and agent action logged with agent identity, the human identity it acts for, and full request context. This is the foundation for incident response, forensics, and compliance.

Spend control. Gateway-level caps and routing bound runaway loops and adversarial over-consumption, as a budget and availability control alongside security.

The vendor landscape in five layers

The market has structured itself into five distinct layers (identity security, runtime security, AI gateways, MCP gateways, and red teaming), with no single vendor covering the full stack, so enterprises layer deliberately. Three entries show the range as of mid 2026.

WitnessAI shipped Agentic Control GA on June 17, 2026: network-layer enforcement with no agent-side code changes, auto-discovery of agents across IDEs, chat apps, and custom frameworks, and a single org-wide approved-tool policy applied at runtime. Total funding at GA: $85 million.

Databricks announced Unity AI Gateway at Data + AI Summit 2026: Lakehouse-native governance where contextual policies allow, deny, or require human approval for specific agent actions based on user identity, agent identity, model, MCP service, or request content, with managed MCP services for Google Drive, Jira, Confluence, Slack, GitHub, and SharePoint out of the box. A Tier-1 data platform entering the category was the clearest signal that the gateway had moved from early-adopter pilot to standard infrastructure.

The security platforms absorbed the category too: Palo Alto Networks folded its May 2026 Portkey acquisition into its AI security portfolio, and Cisco AI Defense added execution-layer runtime protections in early 2026. Teams on those platforms get gateway capabilities inside an existing SASE or firewall stack.

How to evaluate one

Start with discovery. You cannot secure what you cannot see, and building the inventory of running agents, their tool access, and the identities they run under is the prerequisite for every other control. Then fit the architecture to your estate. If your agents span heterogeneous environments (IDE plugins, third-party frameworks, CI pipelines, developer machines), a network-layer approach that can govern agents you did not build is the right frame. If you are on a Lakehouse, native governance integrates with the catalog's identity and lineage model, and you still need an explicit plan for agents running outside that perimeter.

Then run the concrete test: take a documented attack and ask whether the gateway stops it.

• Would it have blocked AutoJack? That requires MCP endpoint authentication and command allow-listing.
• Would it catch agentjacking? That requires inspecting MCP response content before the agent acts on it, treating an authenticated channel as untrusted input.
• Does it pre-authorize the action itself? An injected payload does not have to look malicious; it only has to get the agent to run a harmful command, so the gateway must decide on the action at execution time, not on the intent of the text.
• Could you reconstruct the attack afterwards? With no fix at the source, the evidence of agentjacking lives in the agent's tool call history: the MCP queries, the content returned and the actions taken. Without conversation-level logs, incident response is guesswork from fragments.

A product that only rate-limits LLM API calls, monitors token spend, or enforces system-prompt policy fails every one of these tests, whatever its category label says.

One caution as you evaluate: a gateway governs the channel, and the channel is only half the problem. A gateway does not know what a table means, which columns are sensitive by business definition, or which schema change is safe to approve. Policy needs context to bind to, or every decision escalates to a human who has to reconstruct that context by hand.

Datapace maps what your platform holds, what it costs, and what it’s used for, so you can cut waste without compromising performance or reliability. Each saving becomes a business case your team approves, then ships as a pull request your team merges, or as a statement of work for a bigger change. See the data cost map or book a call.

Sources

1. Microsoft Security Blog, "AutoJack: single page RCE on the host running an AI agent", June 18, 2026.
2. The Hacker News, "AutoJack attack lets one web page hijack AI agent hosts", June 2026.
3. WitnessAI, "WitnessAI introduces Agentic Control to secure and govern AI agents and MCP servers", June 17, 2026.
4. Databricks, "AI governance at Data + AI Summit 2026: what's new with Unity AI Gateway", June 2026.
5. Gravitee, "State of AI Agent Security 2026: when adoption outpaces control", 2026.
6. Gartner, "Hype Cycle for Agentic AI", 2026.
7. TrueFoundry, "Enterprise AI agent security solutions", 2026.
8. Palo Alto Networks, "Securing and governing AI agents at scale through a unified AI gateway", April 2026.
9. Tenet Security, "One fake bug report hijacked a $250 billion company's AI agent, then 100+ more", June 17, 2026.
10. Cloud Security Alliance, "Agentjacking: MCP injection hijacks AI coding agents", June 12, 2026.