Most of the AI agent security coverage this year has been about attacks — clever exploits, alarming success rates, universal jailbreaks. That's the fun part to write about. But quietly, the defensive side has been catching up, and the frameworks emerging in 2026 are more interesting than the usual "add a guardrail" advice.
They share a common instinct: stop trying to make the model trustworthy, and start containing what happens when it isn't. Here are three developments worth knowing.
1. Zero Trust, pointed at your own agents
Anthropic published a framework applying Zero Trust principles to AI agents, and the framing is the point. Zero Trust in traditional security means "never trust, always verify" — you don't grant access based on where a request comes from, you authenticate and authorize every action. Applied to agents, it means treating your own agent the way you'd treat any other untrusted actor inside your perimeter.
The framework tackles the four failure modes that keep showing up in the research: prompt injection, tool poisoning, identity abuse, and memory poisoning. What I find compelling is the identity angle. An agent often aggregates the credentials and permissions of everything it can touch, which makes it a single, juicy point of privilege escalation. Zero Trust says: don't let it. Scope its authority per-action, verify each tool call, and assume any given step could be adversarial.
Agentic SOAR
The framework also floats an "agentic SOAR" — bringing security orchestration and automated response to bear on agent behavior, so misuse gets caught at runtime rather than in a post-mortem.
2. Treating your agents as insider threats
Google DeepMind's AI Control Roadmap takes an even more provocative stance: assume your internal agents might be misaligned, and design as if you're defending against an insider threat.
This is defense-in-depth for a world where you can't fully trust the thing you built. Instead of asking "is this agent safe?" and hoping the answer is yes, you build layered controls that hold up even if it isn't — monitoring, constrained permissions, and the assumption that the agent may, at some point, act against your interests. It's a mindset shift from alignment (make the agent want the right thing) to control (make it unable to do the wrong thing even if it wants to).
An oddly reassuring detail
Most of the anomalies they observed came from overeagerness rather than genuine adversarial intent — agents doing too much, too helpfully, not agents plotting. That's a hopeful data point about where we are today. But the roadmap's whole premise is that you build the controls before that changes, not after.
3. Certified defenses against memory poisoning
The development I'm most excited about is the arrival of certified defenses for agent memory — because "certified" means something specific and rare in security.
Memory poisoning is one of the nastiest agent attacks: corrupt an agent's persistent memory once, and it can misbehave across future sessions, long after the original injection is gone. (I've demonstrated how cheap this is — two chat messages.) Most defenses against it are heuristic — they raise the bar but offer no guarantees. This year brought two that go further. Non-malleable memory authority binds memory to its origin with machine-checked guarantees and reportedly drives memory-laundering attacks to a zero success rate. And SMSR (Signed Memory with Smoothed Retrieval) is described as the first certified defense against multi-session memory poisoning, with proven robustness bounds rather than empirical "we couldn't break it" claims.
Why "certified" matters
An empirical defense says "we tried hard and it held." A certified defense comes with a mathematical bound — a proof that within a defined threat model, the attack cannot exceed a known success rate. That's the difference between a lock that's never been picked and a lock with a proof it can't be. We need a lot more of the latter in AI security.
The through-line
Read these three together and a coherent philosophy emerges. Nobody serious is betting on making the model itself trustworthy. Zero Trust verifies every action. The AI Control Roadmap assumes misalignment and builds controls that survive it. Certified memory defenses stop trusting persistent state and start proving bounds on it. The common move is to shrink what you have to trust and put verifiable boundaries around the rest.
That's not a coincidence — it's the same lesson the whole field is converging on from every direction. You don't secure an agent by making it good. You secure it by making sure it can't do much harm when it's bad.
Sources: Adversa AI — Top Agentic AI Security Resources, July 2026 (Anthropic Zero Trust for AI Agents; Google DeepMind AI Control Roadmap v0.1; Non-Malleable Memory Authority; SMSR certified memory defense).