Open Agent Security Benchmark
97,127 hosts scanned.
One benchmark emerged.
OASB is the open standard for AI agent security — 46 controls, 3 maturity levels, built from real-world data.
npx hackmyagent secure --benchmark oasb-1Internet-wide scan data
The current state of AI agent security
HackMyAgent scanned the public internet for exposed AI agent infrastructure. The results informed which OASB controls matter most.
97,127
Hosts discovered
11,192
Hosts scanned
1,594
Vulnerable
1,190
CLAUDE.md exposed
645
MCP tools exposed
5,042
Outdated endpoints
Three measurement systems
One benchmark, three specifications
Check agent compliance
CIS Benchmarks for AI agents. 46 controls across 10 categories with L1/L2/L3 maturity levels. Answers: “Is your agent secure?”
Govern agent behavior
Behavioral governance for AI agents. 72 controls across 9 domains with 4 agent tiers. Answers: “Does your agent behave correctly?”
Evaluate security tools
MITRE ATT&CK Evaluations for AI agent security tools. 222 attack scenarios across 10 MITRE ATLAS techniques. Answers: “Does your EDR catch this?”
Security controls
46 controls across 10 categories
Identity & Auth
4 controls
Authorization
4 controls
Input Security
4 controls
Output Security
3 controls
Credentials
4 controls
Supply Chain
4 controls
Isolation
3 controls
Memory & Context
3 controls
Monitoring & Ops
3 controls
Agent-to-Agent
14 controls
Open-source toolkit
Every control maps to a free tool
Scan, fix, and verify compliance without vendor lock-in. All tools available at opena2a.org.
HackMyAgent
163 security checks + attack simulation
npx hackmyagent secureSecretless AI
Credential protection for AI tools
npx secretless-ai initAIM
Cryptographic identity and trust scoring
opena2a identity createBrowser Guard
Detect and control browser-based AI agents
Chrome Web StoreDVAA
Vulnerable AI agent for security training
docker compose upOpenA2A CLI
Orchestrates all tools from one command
npx opena2a-cli reviewVerify your agent's security
Run the benchmark against your AI agent. Read the docs for CI/CD integration.
npx hackmyagent secure --benchmark oasb-1