--- title: A new security baseline for enterprise agentic adoption description: Docker, Snyk, and Keycard launched Agent Baseline, an open v1.0-draft framework defining 35 controls across six security outcomes (Discover, Constrain,... canonical: https://daily.dev/posts/a-new-security-baseline-for-enterprise-agentic-adoption-eczh0ttmp twitter:card: summary_large_image twitter:site: @dailydotdev og:type: website og:site_name: daily.dev og:title: A new security baseline for enterprise agentic adoption | daily.dev og:description: Docker, Snyk, and Keycard launched Agent Baseline, an open v1.0-draft framework defining 35 controls across six security outcomes (Discover, Constrain,... og:url: https://daily.dev/posts/a-new-security-baseline-for-enterprise-agentic-adoption-eczh0ttmp og:image: https://api.daily.dev/og/posts/ECZh0tTmP.png og:image:alt: A new security baseline for enterprise agentic adoption og:image:width: 1200 og:image:height: 630 og:locale: en --- > ## Documentation Index > Fetch the complete documentation index at: https://daily.dev/llms.txt > Use this file to discover all available pages before exploring further. # A new security baseline for enterprise agentic adoption **[Docker](https://daily.dev/sources/docker)** · 7 min read · 0 upvotes · 0 comments ## Summary Docker, Snyk, and Keycard launched Agent Baseline, an open v1.0-draft framework defining 35 controls across six security outcomes (Discover, Constrain, Authorize, Observe, Validate, Respond) for safely operating enterprise AI agents. The framework addresses risks like prompt injection attacks embedded in tickets or documents that could trick agents into exfiltrating data, emphasizing runtime visibility, least-privilege authority, correlated logging, pre-deployment testing, and incident containment rather than relying on models to behave correctly. It was announced at Black Hat USA 2026 and is open for community review until September 30, 2026, alongside Docker's related products: Docker Sandboxes and Docker AI Governance. ## Full article daily.dev links to this article rather than hosting it. Read it at the original source: ## Questions this post answers ### What is Agent Baseline and what security controls does it define for AI agents? Agent Baseline is an open security framework created by Docker, Snyk, and Keycard defining 35 controls across six outcomes: Discover, Constrain, Authorize, Observe, Validate, and Respond. It aims to limit what enterprise AI agents can access and do rather than relying on the underlying model to behave correctly. The v1.0-draft was published on July 30, 2026, and is open for community review until September 30, 2026. _Teams standardizing AI agent security controls can track Agent Baseline updates and related tooling on daily.dev._ ### How can a customer-support AI agent be tricked into leaking data via a malicious ticket attachment? An attacker can hide an instruction inside a ticket attachment telling the agent to query the customer database and send results to an external address. Since the agent can already read tickets, query internal systems, and connect to the internet, the malicious instruction looks like normal work. Controls like network-destination allowlists, short-lived scoped credentials, and correlated run logging are needed to block and detect the exfiltration attempt. _Developers securing agent workflows against prompt injection can follow this pattern on daily.dev._ ## Similar posts on daily.dev - [The Agent Baseline: Where Should You Start?](https://daily.dev/posts/the-agent-baseline-where-should-you-start--obr1mbjvo) · Snyk · 1 upvotes · 0 comments - [Docker AI Governance: Unlock Agent Autonomy, Safely](https://daily.dev/posts/docker-ai-governance-unlock-agent-autonomy-safely-s3gotzrnq) · Docker · 2 upvotes · 0 comments --- Tags: [#security](https://daily.dev/tags/security), [#ai-agents](https://daily.dev/tags/ai-agents), [#docker](https://daily.dev/tags/docker), [#prompt-injection](https://daily.dev/tags/prompt-injection) [View this post on daily.dev](https://daily.dev/posts/a-new-security-baseline-for-enterprise-agentic-adoption-eczh0ttmp) ```json {"@context":"https://schema.org","@graph":[{"@type":"Organization","@id":"https://daily.dev/#organization","name":"daily.dev","url":"https://daily.dev","logo":{"@type":"ImageObject","url":"https://daily.dev/apple-touch-icon.png","width":180,"height":180},"sameAs":["https://twitter.com/dailydotdev","https://github.com/dailydotdev","https://www.linkedin.com/company/daily-dev-ltd"]},{"@type":"WebSite","@id":"https://daily.dev/#website","url":"https://daily.dev","name":"daily.dev","publisher":{"@id":"https://daily.dev/#organization"},"potentialAction":{"@type":"SearchAction","target":{"@type":"EntryPoint","urlTemplate":"https://daily.dev/search?q={search_term_string}"},"query-input":"required name=search_term_string"}}]} {"@context":"https://schema.org","@type":"TechArticle","headline":"A new security baseline for enterprise agentic adoption","url":"https://daily.dev/posts/a-new-security-baseline-for-enterprise-agentic-adoption-eczh0ttmp","mainEntityOfPage":{"@type":"WebPage","@id":"https://daily.dev/posts/a-new-security-baseline-for-enterprise-agentic-adoption-eczh0ttmp"},"datePublished":"2026-08-12T17:26:51.994Z","dateModified":"2026-08-24T07:02:51.350Z","description":"Docker, Snyk, and Keycard launched Agent Baseline, an open v1.0-draft framework defining 35 controls across six security outcomes (Discover, Constrain,...","image":"https://media.daily.dev/image/upload/f_auto,q_auto/v1/posts/7be8a0db8ab91f7126d8d6f3da0e7f7f?_a=AQAEuop","thumbnailUrl":"https://media.daily.dev/image/upload/f_auto,q_auto/v1/posts/7be8a0db8ab91f7126d8d6f3da0e7f7f?_a=AQAEuop","isAccessibleForFree":true,"articleSection":"Docker","inLanguage":"en","publisher":{"@type":"Organization","name":"daily.dev","url":"https://daily.dev","logo":{"@type":"ImageObject","url":"https://daily.dev/apple-touch-icon.png","width":180,"height":180}},"author":{"@type":"Organization","name":"Docker","logo":"https://media.daily.dev/image/upload/t_logo,f_auto/v1/logos/8a1022bebfc04a7d824c309bd3686787","url":"https://daily.dev/sources/docker"},"commentCount":0,"discussionUrl":"https://daily.dev/posts/a-new-security-baseline-for-enterprise-agentic-adoption-eczh0ttmp","interactionStatistic":[{"@type":"InteractionCounter","interactionType":{"@type":"LikeAction"},"userInteractionCount":0},{"@type":"InteractionCounter","interactionType":{"@type":"CommentAction"},"userInteractionCount":0}],"keywords":"security,ai-agents,docker,prompt-injection","timeRequired":"PT7M"} {"@context":"https://schema.org","@type":"BreadcrumbList","itemListElement":[{"@type":"ListItem","position":1,"name":"Home","item":"https://daily.dev"},{"@type":"ListItem","position":2,"name":"Docker","item":"https://daily.dev/sources/docker"},{"@type":"ListItem","position":3,"name":"A new security baseline for enterprise agentic adoption"}]} {"@context":"https://schema.org","@type":"FAQPage","@id":"https://daily.dev/posts/a-new-security-baseline-for-enterprise-agentic-adoption-eczh0ttmp#faq","mainEntity":[{"@type":"Question","name":"What is Agent Baseline and what security controls does it define for AI agents?","acceptedAnswer":{"@type":"Answer","text":"Agent Baseline is an open security framework created by Docker, Snyk, and Keycard defining 35 controls across six outcomes: Discover, Constrain, Authorize, Observe, Validate, and Respond. It aims to limit what enterprise AI agents can access and do rather than relying on the underlying model to behave correctly. The v1.0-draft was published on July 30, 2026, and is open for community review until September 30, 2026. Teams standardizing AI agent security controls can track Agent Baseline updates and related tooling on daily.dev."}},{"@type":"Question","name":"How can a customer-support AI agent be tricked into leaking data via a malicious ticket attachment?","acceptedAnswer":{"@type":"Answer","text":"An attacker can hide an instruction inside a ticket attachment telling the agent to query the customer database and send results to an external address. Since the agent can already read tickets, query internal systems, and connect to the internet, the malicious instruction looks like normal work. Controls like network-destination allowlists, short-lived scoped credentials, and correlated run logging are needed to block and detect the exfiltration attempt. Developers securing agent workflows against prompt injection can follow this pattern on daily.dev."}}]} ```