Security1 publisher2 min readPublished
Tenable ties each AI agent registry review to a single Git commit
The CyberAgents Exchange gives every submission a baseline check and sends only high-risk ones to a new inspector built with OpenAI's GPT Cyber models. Findings are pinned to the commit that was reviewed.
The Watch · Security desk
What happened
- Tenable and OpenAI announced the CyberAgents Exchange AI Inspector at OpenAI's "Intelligence at Work: Cyber Summit", extending a partnership the two firms began in June.
- The CyberAgents Exchange went live in August as an open source, vendor-agnostic registry and hosts more than 100 listings, some of them built at Tenable's SWARM event at Black Hat USA.
- Every submission gets a baseline review before it is listed, and only submissions Tenable grades high risk are passed to the Inspector for deeper scrutiny.
- The Inspector combines Tenable One AI Exposure scanning, frontier model assessment using OpenAI's GPT Cyber models, and human review of each submission.
- Tenable said the Inspector was expected to be available in September.
Compiled by The WatchSomething wrong?How this is made
Why it matters
- constraint Deep inspection is rationed by risk grade to hold down compute cost, so the triage decision, not the Inspector, is the control that determines whether prompt injection and tool permission analysis ever runs on a listing.
- exposure The useful facts on a listing page are the reviewed commit and the review date, because a consumer installs whatever the repository holds at install time.
- decision With no review, rejection or finding counts published, a security team cannot yet treat the registry's vetting as a replacement for its own pre-install check of an agent or MCP server.
- precedent Registry-side vetting that reads model instructions and tool permissions gives other agent and MCP hubs a bar their own submission processes will be compared against.
Tool chaining is the part of the surface a code scanner does not see. Tenable wrote that tool chaining "can amplify risk across trust boundaries that no single component would cross on its own" [9]. By Tenable's account, an AI agent's attack surface takes in the instructions given to the model, the tools it is authorized to invoke, and the data it is permitted to access or transmit, where conventional software security mostly looks at the code [8].
The registry accepts submissions at both extremes. One may be a single skill markdown file holding instructions for an LLM. Another may ship full agents, MCP servers, external libraries and calls to remote services and APIs [10]. The markdown file has almost no code to scan, and its instructions are what the model will obey.
Depth is rationed. Tenable says the process matches an AI model tier to each submission's risk level so that vetting does not carry excessive computational overhead [11].
Every submission points to a code repository with its own commit history [19]. Reviews are anchored to one commit, so findings trace back to a known state, vetting is not automatically carried forward, and any material change requires a new review [7]. The post says a material change requires a fresh review but does not describe how a post-review push is detected [16].
After source review, submissions are installed and exercised in a clean, isolated environment using only the documented setup steps, and observed behaviour is compared with what the documentation claims [12]. Behaviour that needs an undocumented flag, a second tool in the chain or a different environment sits outside that path [17]. Tenable also assesses the trustworthiness of the repository owner, any backing organization and the authors, and turns those signals into a confidence rating that informs whether the review proceeds at all [13].
That leaves the current shelf where it started. Every listing now in the registry was cleared by the baseline review alone, because the Inspector was not available when those submissions went up [14]. Tenable has not published how many submissions it has reviewed, how many it turned down, or what the reviews found [18]. The whole account comes from the vendor running the registry.
What to watch
- Whether the Inspector shipped on the September date Tenable gave, and whether listing pages show the reviewed commit hash and review date.
- Whether Tenable publishes review counts, rejection counts and sample findings from the Exchange.
- Whether re-review is triggered automatically once a listed repository's branch moves past the anchored commit.