From Accessible to Controllable: Ruishu Information Launches AITM for AI Agent Lifecycle Security
As AI Agent technology becomes embedded in enterprise research, office, and business processes, organizations face a fundamental shift: the question is no longer whether AI can improve efficiency, but whether it can be managed, controlled, and audited.
A reported incident at a multinational consulting firm illustrated the new risks. An autonomous intelligent agent attack allowed an attacker to move from interface reconnaissance through vulnerability discovery to full database read-write privileges. Standard vulnerability scanners failed to detect the specialized injection points, while the agent progressively inferred query structures by analyzing database error messages.
These risks extend beyond model-generated content and arise during autonomous task execution, tool invocation, and data access. Consequently, security controls must span admission, runtime, permission management, and data circulation rather than stopping at pre-deployment testing.
Why Agent Security Cannot End at Pre-Deployment Checks
Ruishu Information notes that third-party Skill and Prompt components introduce supply-chain risks. Without rigorous source management and security inspection, components may contain backdoor instructions or prompt-injection payloads that steer agents toward unauthorized actions.
Runtime threats include malicious code execution and privilege abuse. Agents or Skills capable of running commands or reading files can expose sensitive files, environment variables, and credentials if their tool access exceeds business requirements. Unregistered internal agents further complicate governance, as enterprises lack visibility into creation, resource connections, and permissions.
Real-world examples, such as an office AI assistant that extracted sensitive data after receiving hidden email instructions without user clicks, demonstrate that autonomous tool calls can occur without explicit user action.
Ruishu AITM: Building Lifecycle Controls from Admission to Runtime
AITM delivers three core capabilities: trusted admission, runtime guardianship, and data security. At admission, four analyzers—static rule scanning, behavioral rule analysis, large-model semantic judgment, and sandbox dynamic execution—evaluate Agents and Skills. Low-risk components receive automatic approval; high-risk items enter manual review. Submission is supported via CLI, Web, Go Scanner, and CI/CD pipelines.
During runtime, AITM performs loading verification, HMAC-SHA256 directory signing to detect tampering, and tool-permission whitelisting. Revoked components are blocked on subsequent loads. Integration options include lightweight Skill Verifier, Hook-based real-time interception, and client management for large-scale endpoints.
For large-model interactions, AITM acts as a unified security proxy that validates LLM API Key status, expiration, model scope, and concurrency limits. It detects PII entities according to privacy policies, replaces them with pseudonymous tokens before model requests, and restores original values in responses. Four-stage Trace auditing records the original request, tokenized request, model response, and final restored output while restricting raw prompt and response logging to authorized roles.
Establishing Clear, Traceable Boundaries for Agent Operations
Ruishu Information positions AITM for development scanning, production runtime control, security auditing, and CI/CD integration. The central challenge is no longer whether an Agent can be used, but what it calls, which data it accesses, whether its behavior is trustworthy, and how quickly risks can be contained. By embedding detection, verification, permission constraints, and auditing into daily operations, enterprises can maintain clearer security boundaries around autonomous AI systems.
Related articles
South Korean Hacker Uses Generative AI Framework ARTEX to Breach 90 Organizations and Steal 8.2 Million Records
Seoul Metropolitan Police arrested a 32-year-old man identified only as A for conducting a series of intrusions against approximately 90 South Korean companies and institutions between September 2025 and October 2026. The attacker, who had no formal technology education and learned hacking from publicly available online materials, previously worked in penetration testing at a security firm from 2019 to 2022. Roughly 60 of the victims were compromised using the generative AI-powered pentesting framework ARTEX, which autonomously determined attack paths after receiving only the target name. The operation resulted in the theft of 8.2 million personal records and internal documents, after which the perpetrator extorted 38 organizations for a total of 360 million won in Tether, ultimately receiving 300,000 won. Police recovered part of the stolen material and are investigating possible copies on the dark web, classifying the case as the country's first large-scale incident involving generative AI. Six additional suspects remain under investigation while the main perpetrator has been referred to prosecutors on charges of violating information and communications network laws and extortion.
AI in Vulnerability Management: Assistant, Weapon, and Emerging Target
Artificial intelligence now plays three simultaneous roles in vulnerability management: it assists defenders with prioritization and analysis, arms attackers with faster discovery tools, and introduces entirely new classes of assets and vulnerabilities that must be managed. Mature applications include ML-driven risk scoring in platforms such as Tenable VPR, Qualys TruRisk and Rapid7 Active Risk, which cut priority lists by 40-50 percent, and Google’s Big Sleep project that discovered a real-world SQLite flaw (CVE-2025-6965) before exploitation occurred. On the offensive side, systems like XBOW completed 104 test scenarios in 28 minutes versus 40 hours for human testers, shrinking the average time-to-exploit window to negative seven days according to Mandiant M-Trends 2025. New AI-specific attack surfaces are documented in the OWASP Top 10 for LLM applications and the emerging MCP Top 10, covering prompt injection, tool poisoning, and command injection against Model Context Protocol servers. Real incidents already include Air Canada’s chatbot inventing a refund policy and New York City’s MyCity bot dispensing illegal advice for nearly two years. Researchers have also demonstrated sandbox escapes in coding agents from Cursor, OpenAI Codex and Claude Code through classic file-write-and-execute patterns rather than any sentient behavior.
Solar Unveils AI Firewall to Protect Against Dangerous Actions by AI Agents
At SOC Forum 2026, Russian cybersecurity firm Solar presented its new Solar AI Firewall solution designed to filter requests to external AI models and block prompt injections. The product sits between users and AI systems, applying multi-layer protection that responds in milliseconds and counters 200 types of attacks. Special emphasis is placed on autonomous AI agents capable of performing actions in corporate systems, where the firewall inspects operations and blocks potentially harmful ones. Integrations with DLP, SIEM, and IDM tools are supported, and the solution is available both as a cloud service and for on-premises deployment. Solar has been testing the product internally and observed significant shadow AI usage outside corporate controls. The company plans further development of comprehensive AI risk management capabilities.
TenetBench Benchmark Tests LLMs for Compliance with Professional Ethical Codes
Researchers from the Institute of Information Security Issues at ISP RAS and the Institute of Cybersecurity and Information Protection at RANEPA have developed TenetBench, a benchmark designed to evaluate how well large language models adhere to specific norms in professional codes of ethics. The benchmark generates realistic work-related prompts that may conflict with rules from documents such as the Code of Professional Ethics for Advocates or journalistic standards on undisclosed advertising. Each test case pairs a conflicting request with a neutral counterpart to measure whether models refuse, warn, or still provide prohibited content. Evaluation separates task completion, norm violation detection, and presence of explicit refusals using an LLM-as-a-Judge approach validated against human annotators. The full dataset contains 3,433 prompt pairs derived from 15 professional codes, with a public subset of 2,235 pairs from 10 documents. Human validation confirmed 99.5% of generated examples as fully plausible work scenarios.