From Static Skill Scans to Runtime Agent Control: How Ory Agent Security Addresses the “Story of Skills” Threat

AI skills are reshaping the concept of software trust, as highlighted by Air's experiment demonstrating how malicious content can be delivered through seemingly benign AI skills. Traditional security models, which rely on static scanning of packages, are inadequate for this new challenge, as these skills can reference external documentation that may later be altered to execute harmful actions. Ory Agent Security addresses this issue by incorporating identity, authorization, and governance controls directly into the AI agent's runtime environment, thereby moving the control point from external scanning to internal decision-making. This approach ensures that each agent action is subject to real-time policy checks, preventing unauthorized operations even if an agent is influenced by malicious external instructions. Ory’s solution emphasizes continuous audit and runtime authorization, offering a framework for understanding and controlling agent actions while maintaining a separation between agent and human user identities, thus providing a more robust defense against evolving security threats.

No tracked trend matches for this post yet.