State of AI Agent Security 2026
Findings from scanning 500+ open-source AI agent projects
The largest security analysis of the AI agent ecosystem. Original data from automated static analysis — not surveys or interviews.
Enter your work email. Instant PDF download + a follow-up with key takeaways.
What you'll learn
500+ repos. 11,705 findings. 10 frameworks compared. Here's what the data reveals.
Which vulnerability appears in 4 out of 5 agent repos?
The top 10 vulnerability types ranked by prevalence — and why the #1 finding isn't prompt injection.
Which framework has 3x more critical findings than average?
Head-to-head security comparison across LangChain, CrewAI, AutoGen, pydantic-ai, MCP servers, and more.
Why 25% of repos fail EU AI Act Article 14
Compliance readiness scores for every repo. Article-by-article breakdown of where the ecosystem falls short.
MCP servers: the new attack surface nobody is auditing
The first large-scale security audit of MCP server repositories. Tool poisoning, argument injection, and credential exposure.
What goes wrong in repos with 25K+ stars
Anonymized deep-dives into popular frameworks. High star counts don't mean high security — here's the proof.
The 5 fixes that eliminate 80% of findings
Actionable remediation guidance for developers, security teams, and CISOs. Mapped to OWASP Agentic Top 10 and NIST AI RMF.
Methodology
Discovery
40 GitHub search queries targeting AI agent frameworks (LangChain, CrewAI, AutoGen, MCP servers, and 35+ others). Top 100 results per query, sorted by stars. Deduplicated and filtered to repos with 20+ stars, no forks.
Scanning
Each repo shallow-cloned and scanned with Inkog v1.1.0 using the comprehensive policy (all detectors, no confidence filtering). Results parsed and stored as structured JSON.
Analysis
Inkog's Universal IR engine converts any agent framework to a framework-agnostic intermediate representation. Detection rules, DFG taint analysis, and compliance mapping run on this unified IR.
Compliance Mapping
Every finding automatically mapped to EU AI Act articles, NIST AI RMF controls, and OWASP Agentic Top 10 entries. Governance scores computed for each repository.
Based on scanning 500+ repositories across every major AI agent framework. The only report backed by automated static analysis data — not surveys or interviews.
Get the full report
Original data, framework comparisons, compliance analysis, and remediation guidance — straight to your inbox.