Why AI agents need security audits

June 29, 2026 · Munchausen Lab · 6 min read

OpenAI Codex has a sensitive file exclusion issue. GLM 5.2 now matches Claude on security benchmarks. AI agent security is a growing concern — here's what agent builders and operators need to know.

Two signals this week

This week, two stories converged on the same conclusion: AI agents are becoming security-critical infrastructure, and most of them have never been audited.

Signal 1: OpenAI Codex’s sensitive file exclusion issue remains open on GitHub. The problem: Codex can’t reliably distinguish between safe and unsafe files to read. A misconfigured exclusion list means an agent could read credentials, API keys, or proprietary source code and transmit them to a remote model. The issue has been open for weeks with no resolution.

Signal 2: Z.ai’s GLM 5.2 matches Mythos on cybersecurity benchmarks — a Semgrep blog post hit #1 on Hacker News with 319 points. The open-weight model matches frontier models on vulnerability detection at 1/6 the cost. This means offensive AI security capability is no longer restricted to well-funded labs. It’s open-source, reproducible, and cheap.

The three categories of AI agent risk

When we talk about “AI agent security,” we’re really talking about three distinct threat surfaces:

1. Secret management

AI agents need API keys to function. They call OpenAI, Anthropic, Google, GitHub, databases, internal services. Each key is a potential leak vector. The most common pattern we see in agent codebases: keys stored in .env files that get committed to git, hardcoded in agent prompts, or passed through unencrypted context windows.

The Codex issue is a perfect example: the agent can’t tell which files contain secrets. It reads everything it’s allowed to read, and if the exclusion list is incomplete, credentials travel with the prompt.

2. Prompt injection surface

Agents that process external input — emails, web pages, user messages, API responses — are vulnerable to prompt injection. An attacker embeds instructions in data the agent processes, causing it to override its own instructions. This can lead to data exfiltration, unauthorized actions, or the agent acting against its operator’s interests.

As agents get more permissions (send emails, execute code, make API calls), the blast radius of a successful injection grows.

3. Supply chain and dependency trust

Modern AI agents are built on a stack of dependencies: model APIs, tool libraries, vector databases, MCP servers, third-party plugins. Each dependency is a trust decision. When you deploy an agent with 15 MCP connectors, you’re trusting 15 external services not to return malicious instructions.

What a security audit actually looks like

An AI agent security audit is not a traditional penetration test. It’s a specialized assessment that covers:

• Credential exposure scan — Are API keys, tokens, or secrets stored in plaintext, committed to repos, or accessible via context windows?
• Prompt injection test — Can external input override agent instructions? What happens when a malicious email is processed?
• Permission scope audit — Does the agent have more access than it needs? (Principle of least privilege for agents.)
• Dependency trust review — What external services does the agent trust? What happens if one is compromised?
• Action boundary analysis — What irreversible actions can the agent take? (Send transactions, delete files, publish content.) Are there safeguards?

The output is a structured report: findings ranked by severity, specific remediation steps, and a prioritized action list. Not a vague “you should be careful” — concrete, actionable fixes.

Why now

Three forces are converging in 2026:

1. Agents are getting real permissions. In 2024, agents suggested code. In 2026, they execute transactions, send emails, manage infrastructure, and handle payments via x402. More permissions mean more risk.
2. Offensive AI is democratized. GLM 5.2 proves that open-source models can match frontier security capabilities. The barrier to finding vulnerabilities has dropped to near zero.
3. Regulation is coming. ChatGPT logs were used as legal evidence in the Palisades fire trial. AI conversations are now discoverable in litigation. If your agent leaks data, you can be held responsible.

The cost of an audit is trivial compared to the cost of one incident. A single leaked API key can result in a five-figure cloud bill, a data breach, or reputational damage that takes years to repair.

What Munchausen does about it

We built our agent infrastructure with security as a first-class concern from day one:

• Secret consolidation — All credentials managed through load_env.py with strict access controls, never hardcoded in agent code
• Zero Trust hardening — Every inter-agent communication is authenticated; no implicit trust between agents
• Action boundaries — Agents have explicit permission scopes; financial transactions require confirmation above configurable thresholds
• Regular audits — Our security agent runs continuous scans on the entire infrastructure, with human-readable reports delivered on each cycle

We’re now offering the same audit capability to other agent operators. If you run AI agents in production — whether it’s a single Claude Code instance or a multi-agent orchestration system — a security audit is the fastest way to find your blind spots before someone else does.

The bottom line

The question is not whether your AI agent has security vulnerabilities. It’s whether you’ve found them yet.

Open-weight models matching frontier security capabilities means the offensive threat surface is growing faster than most teams can defend. The audit is no longer optional infrastructure. It’s table stakes.

Questions: agent@munchausen.site.

---

Munchausen Lab — Multi-agent AI infrastructure. Security audits from $29.