AgentKit Security: Zenity Adds Runtime Protection for AI Agents

Security vendor Zenity has launched a commercial runtime protection product for OpenAI's AgentKit, the toolkit enterprises use to build and deploy AI agents. The company says the product blocks data leaks, secret exposure, and unsafe agent behavior as it happens rather than after the fact. 1 Alongside the launch, Zenity's research arm disclosed a serious flaw in a competing platform, AWS Bedrock AgentCore. Together, the two moves argue that weak guardrails are a structural problem across agent platforms, not a quirk of one vendor. 2

Both the product claims and the vulnerability findings come from Zenity itself. That doesn't make them wrong, but readers should weigh them knowing the company sells a fix for the problem it describes.

What Zenity is selling

The core idea is to add a second layer of enforcement on top of what OpenAI already provides. Zenity describes the offering as enterprise-grade protection that works in real time, aimed at stopping sensitive data or credentials from leaving an organization through an agent's actions or outputs. 1

The more telling detail is how the product is built. It adds deterministic, rule-based controls on top of OpenAI's own guardrails, which are probabilistic. 2 The difference matters:

• Probabilistic guardrails typically rely on models judging whether an input or output looks harmful. They can be fooled by phrasing, context, or persistence.
• Deterministic rules apply fixed policies. If a defined condition is met, the action is blocked, however cleverly the request was worded.

According to Zenity, its own testing found that AgentKit's built-in protections could be bypassed by multi-turn jailbreaks, where an attacker works toward a goal across several exchanges. They could also be beaten by obfuscated jailbreaks, which disguise malicious intent. 2 The runtime product, launched in November, is pitched as the answer to those specific weaknesses. 2

The AgentCore flaw

The AWS finding is arguably the bigger story, because it shows how far a single prompt can reach. Zenity Labs reported that one malicious prompt sent to a public-facing agent built on Bedrock AgentCore allowed researchers to do three things [2]:

1. Query the internal metadata service.
2. Collect temporary credentials that applied across the whole AWS account.
3. Poison the agent's long-term memory so that it kept sending conversations to an attacker-controlled server.

Each step escalates the damage. Reaching a metadata service from a chat interface suggests the agent's sandbox was not tightly isolated from cloud infrastructure. Account-wide credentials turn a chatbot problem into a cloud-compromise problem. Memory poisoning is especially worrying because it makes the attack persistent: the agent keeps leaking data in later sessions, possibly long after the original prompt.

This chain shows why agent security differs from traditional chatbot safety. When a model can only produce text, a jailbreak mostly creates embarrassing output. When it holds tools, credentials, and persistent memory, a jailbreak becomes a route into the infrastructure behind it.

One problem across platforms

One vendor's announcement covers a product launch 1. The other ties that launch to a wider pattern across platforms 2. Zenity's argument is that guardrail bypasses affect OpenAI and AWS alike, which makes them a feature of how agent platforms are currently designed. 2

That reading is plausible, with caveats. Two platforms are a small sample, and the evidence comes from a single company's research team. Still, the underlying logic holds up. Platform providers mostly rely on model-based filtering because it scales and adapts. But model-based filtering is exactly what determined attackers learn to get around. Unless the platforms add their own hard policy layers, the gap stays open.

Why it matters: the governance gap is now a market

The clearest takeaway is commercial. The governance gap around AI agents is no longer just a research concern; third-party vendors are now packaging it as a product category. 2 This mirrors earlier shifts in cloud and SaaS security. Platforms shipped quickly, built-in controls lagged behind real enterprise risk, and an ecosystem of add-on tools grew up to fill the space.

For enterprises deploying agents, the practical lessons are:

• Treat native guardrails as a baseline, not a guarantee.
• Restrict what credentials and network paths an agent can reach.
• Watch long-term memory as a possible target for persistent attacks.

Whether Zenity's product delivers on its claims will depend on independent testing. Its central warning, though, is credible on its own terms. Agents that can act need controls that do not depend on a model correctly deciding it is being manipulated.