Mend.io drops a 7-artifact guide to lock down AI agents before your AppSec team loses track

Traditional application security is built on a simple premise: the code is the blueprint. An agentic AI system laughs at that idea. Mend.io just published a practitioner’s guide that confronts the mess head-on, arguing that agent behavior is an emergent cocktail of model weights, system prompts, live context, and the tools it’s allowed to call. Two identical deployments can veer in opposite directions, and the failure modes—prompt injection slipping through a data feed, a poisoned tool description on an unregistered MCP server silently redirecting behavior—won’t show up in any CVE feed.

The guide is organized around three moves: see what matters, fix it faster, and protect the thing while it’s running. It ships with seven reusable artifacts, starting with a five-layer attack surface map that splits risk across interaction, agent, integration, model, and code layers. One of the more immediately useful pieces is a discovery framework for hunting down shadow agents, unregistered MCP servers, and embedded frameworks that never passed through procurement. Mend.io insists every MCP server needs an owner, a defined access scope, and a review, backing that up with five concrete discovery methods—from scanning repos for agentic signatures to watching network egress for model API calls.

The prioritization model is where things get practical. Artifact 3.1 draws a clear automation line: any finding that’s automatically closed must carry evidence, or it gets kicked to a human. Error rates are sampled and reviewed, with thresholds that trigger retraining if things drift. That’s a level of operational rigor most shops talk about but rarely codify into a checklist. The guide also extends the AI-BOM concept with nine fields per agent or MCP server, covering identity, autonomy level, tool permissions, credential scope, and more.

Runtime protection gets equal billing, with guardrails deployable either as a Python SDK or a standalone Docker-based API server. The minimal viable setup catches inbound prompt injections and jailbreaks while scanning outbound traffic for leaked credentials, PII, or proprietary code. A maturity roadmap ties it all to NIST AI RMF, OWASP AIMA, and the EU AI Act, so compliance teams have something to point at. The self-assessment is refreshingly blunt: 15 questions, and if you score under 6, you’re in what the framework politely calls the “Emerging” stage. For many organizations running LLM-powered apps in production right now, that’s probably generous. The guide doesn’t solve the problem—no static framework can—but it gives security leads a coherent language for asking questions their existing AppSec tooling was never designed to answer.