Docker, Snyk, and Keycard launched Agent Baseline, an open v1.0-draft framework defining 35 controls across six security outcomes (Discover, Constrain, Authorize, Observe, Validate, Respond) for safely operating enterprise AI agents. The framework addresses risks like prompt injection attacks embedded in tickets or documents that could trick agents into exfiltrating data, emphasizing runtime visibility, least-privilege authority, correlated logging, pre-deployment testing, and incident containment rather than relying on models to behave correctly. It was announced at Black Hat USA 2026 and is open for community review until September 30, 2026, alongside Docker's related products: Docker Sandboxes and Docker AI Governance.
Table of contents
Agents turn familiar controls into a new systems problemEnter the Agent Baseline: an open blueprint for building, operating and governing enterprise agents.The Agent Baseline in PracticeSecuring organizations in the decade of agentsRead more about Agent Baseline:Questions this post answers
What is Agent Baseline and what security controls does it define for AI agents?
Agent Baseline is an open security framework created by Docker, Snyk, and Keycard defining 35 controls across six outcomes: Discover, Constrain, Authorize, Observe, Validate, and Respond. It aims to limit what enterprise AI agents can access and do rather than relying on the underlying model to behave correctly. The v1.0-draft was published on July 30, 2026, and is open for community review until September 30, 2026. Teams standardizing AI agent security controls can track Agent Baseline updates and related tooling on daily.dev.
How can a customer-support AI agent be tricked into leaking data via a malicious ticket attachment?
An attacker can hide an instruction inside a ticket attachment telling the agent to query the customer database and send results to an external address. Since the agent can already read tickets, query internal systems, and connect to the internet, the malicious instruction looks like normal work. Controls like network-destination allowlists, short-lived scoped credentials, and correlated run logging are needed to block and detect the exfiltration attempt. Developers securing agent workflows against prompt injection can follow this pattern on daily.dev.