RSAC 2026’s dominant theme was agentic AI security — AI agents are now the target, not just the tool. Cisco answered with DefenseClaw, an open-source agent security framework that scans agent skills, sandboxes execution, and inventories MCP servers before deployment. The bigger takeaway: MCP servers are the new API endpoints, and most enterprises cannot even list the agents already running in their environment. Start with an agent inventory, treat every MCP server as a privileged API, and adopt scoped, short-lived agent identity — not reused human credentials.
April 17, 2026 — The cybersecurity industry’s annual pilgrimage to San Francisco delivered a clear message this year: the attack surface has fundamentally shifted. AI agents are no longer just tools for defenders — they’ve become the targets.
Walk the RSAC 2026 expo floor and every other booth was selling something for agents — agent firewalls, agent identity, agent sandboxing. That is not hype coincidence; it is a response to a real shift we cover in Agentic AI Security: Attack Surface in Autonomous Systems. What mattered this year was the emergence of concrete, open tooling instead of slideware.
The New Threat Landscape: When AI Agents Become the Attack Vector
At RSAC 2026, one theme dominated every keynote, expo booth, and hallway conversation: agentic AI security. In the span of 18 months, the offensive security community has produced over 70 new AI-powered attack tools. AI agents can now probe entire attack surfaces in parallel, at near-zero cost, fundamentally changing the economics of offense.
But the deeper conversation wasn’t about AI attacking systems — it was about attacking AI agents themselves.
Cisco DefenseClaw: Open-Source Agent Security Framework
Cisco made headlines with DefenseClaw, an automated open-source agent security framework built on Nvidia’s OpenShell. The framework addresses a critical gap: most AI agents deployed in enterprises today have little to no security controls.
| DefenseClaw capability | What it does | Threat it stops |
|---|---|---|
| Skill scanning | Every agent skill is scanned for malicious behavior before deployment | Tool poisoning, backdoored plugins |
| Sandboxed execution | Agents run in isolated environments with controlled access | Prompt-injection-driven command execution |
| Verified MCP servers | Model Context Protocol servers are validated and inventoried | Rogue or typo-squatted MCP endpoints |
| Feature inventory | Complete cataloging of AI agent capabilities and permissions | Scope creep and shadow AI agents |
This is significant because MCP — the Model Context Protocol that enables AI agents to interact with external tools and data sources — emerged as a major attack vector in early 2026. If you are new to the protocol, start with What Is MCP (Model Context Protocol)?
The MCP Security Problem
Model Context Protocol servers are the connective tissue between AI agents and the tools they use. When an agent needs to read a file, query a database, or execute a command, it goes through an MCP server.
The problem? MCP servers are the new API endpoints, and they’re being deployed with the same reckless speed that characterized early REST API adoption.
CVE-2026-39884, disclosed in April 2026, demonstrated an argument injection vulnerability in mcp-server-kubernetes — a server that gives AI agents direct access to Kubernetes cluster management. An attacker who compromises the MCP server effectively gains control of the entire cluster. For test cases and hardening steps, see MCP Security and Pentesting: Threats, Test Cases, and Hardening.
Real-World MCP Attack Patterns
| Pattern | Mechanism | Impact |
|---|---|---|
| Tool poisoning | Malicious MCP servers disguised as legitimate tools inject harmful instructions into agent context | Agent weaponized against its own tenant |
| Cross-agent data leakage | Agents sharing MCP servers can exfiltrate data from each other’s sessions | Tenant-to-tenant disclosure |
| Privilege escalation via MCP | A low-privilege agent leverages MCP server misconfigurations to gain elevated access | Identity-boundary bypass |
| Supply chain via MCP plugins | Third-party MCP server packages contain backdoors, similar to npm supply chain attacks | Persistent compromise of agent fleets |
The “Claws” Ecosystem
Cisco wasn’t alone in the naming convention. The industry has adopted a “claw” metaphor for AI agent security tools:
- DefenseClaw (Cisco): agent security framework
- OpenShell (Nvidia): agent execution sandbox
- Various “Claw” tools from startups focusing on agent-to-agent communication security
This naming trend reflects a broader truth: AI agent security requires fundamentally new approaches. Traditional perimeter defenses, WAFs, and endpoint protection weren’t designed for autonomous agents that make decisions at machine speed.
What Defenders Should Do Now
Based on the RSAC 2026 discussions and emerging best practices:
1. Inventory Your AI Agents
You can’t secure what you don’t know exists. Audit every AI agent, copilot, and automated tool in your environment.
2. Secure MCP Endpoints
Treat MCP servers like you would any API endpoint: authentication and authorization, input validation and sanitization, rate limiting, audit logging, and regular vulnerability scanning.
3. Implement Agent Sandboxing
Use frameworks like DefenseClaw to ensure agents operate in controlled environments with explicit permission boundaries.
4. Monitor Agent-to-Agent Communication
Agents talking to other agents create lateral movement paths. Monitor these communications just as you would network traffic.
5. Adopt Agent Identity Frameworks
The Three-Layer Model for AI Agent Identity — proposed in early 2026 — provides a framework for least-privilege access control for autonomous agents. We break it down in AI Agent Identity and Least Privilege: The Three-Layer Model.
Looking Ahead
The AI agent security market is projected to grow from $2.1B in 2025 to $15.7B by 2029. Every major security vendor is building agent-specific controls. The organizations that move fastest to secure their AI agent infrastructure will have a significant advantage — and the ones that wait will find their agents catalogued in an attacker’s inventory first. For a structured starting point, the OWASP Top 10 for Agentic Applications 2026 maps the full risk set.
RSAC 2026 made one thing clear: the question isn’t whether AI agents will be attacked — it’s whether you’ll be ready when they are.
Key Takeaways
- Agents flipped from tool to target — the RSAC 2026 crowd consensus was that agentic AI is now its own attack surface class.
- DefenseClaw is the reference open-source blueprint — skill scanning, sandboxing, verified MCP servers, feature inventory.
- MCP servers are the new API endpoints — CVE-2026-39884 (Kubernetes MCP argument injection) proved one server can equal one cluster.
- Inventory before tooling — roadmap discussions kept circling back to the same step one: know which agents exist and what authority they hold.
- Agent identity ≠ reused human identity — scoped, short-lived, per-agent credentials win.
FAQ
What is DefenseClaw?
DefenseClaw is Cisco’s open-source AI agent security framework introduced around RSAC 2026. Built on Nvidia’s OpenShell sandbox, it scans agent skills for malicious behavior, verifies and inventories MCP servers, sandboxes agent execution, and maintains a full inventory of agent capabilities and permissions.
Is DefenseClaw production-ready?
It is an early-stage open-source framework — treat it as a reference implementation and a source of controls to adapt, not a turnkey product. The durable value is its checklist: scan skills, sandbox execution, verify MCP servers, inventory capabilities.
Why are MCP servers a security risk?
MCP servers mediate everything an AI agent can do — file reads, database queries, command execution. A compromised or malicious MCP server turns the agent into a pivot: CVE-2026-39884 in mcp-server-kubernetes showed one argument-injection flaw mapping to full cluster control.
Where should a security team start with agent security?
Inventory: list every agent, copilot, and automation with the credentials it holds. Then treat each MCP server as a privileged API — authentication, authorization, rate limits, audit logs — and move agents onto scoped, short-lived identities instead of reused human or service credentials.
References
- RSAC 2026 Conference
- Cisco Security Blog — DefenseClaw announcements
- OWASP GenAI Security Project
- What Is MCP (Model Context Protocol)? — Hmmnm
- MCP Security and Pentesting — Hmmnm
Related Reading
Part of our AI Agent Security: The Complete Guide (2026) series.
n
