{
  "version": "https://jsonfeed.org/version/1.1",
  "title": "Blog — Open Agent and AI Security Community",
  "home_page_url": "https://open-agent-ai-security.github.io/blog/",
  "feed_url": "https://open-agent-ai-security.github.io/blog/feed.json",
  "description": "Announcements, release notes, and project updates from the Open Agent and AI Security Community.",
  "items": [
    {
      "id": "https://open-agent-ai-security.github.io/blog/observra-1-1-release/",
      "url": "https://open-agent-ai-security.github.io/blog/observra-1-1-release/",
      "title": "Observra 1.1: Bring Observability to Any AI Agent",
      "summary": "Observra 1.1 opens its telemetry pipeline to any custom agent framework — no adapter required — plus local storage, a live terminal dashboard, and support for 100+ LLM providers.",
      "content_text": "Today we're releasing  Observra 1.1 , a major step toward making structured, security-aware telemetry available to every AI agent—regardless of the framework, model provider, or infrastructure behind it. \n The headline feature is simple:  Observra now works with custom and in-house agent frameworks without requiring a dedicated adapter.  \n That means teams no longer need to wait for us to add native support for their framework before they can capture consistent telemetry across prompts, model calls, tool activity, costs, errors, and agent sessions. \n One telemetry pipeline for any framework \n Observra already includes native integrations for several popular agent frameworks. In 1.1, we're opening the same telemetry pipeline to virtually any agent implementation. \n Developers can now instrument custom agent stacks while retaining Observra's built-in capabilities, including: \n \n Automatic redaction of sensitive information \n Prompt-injection detection \n Token and cost tracking \n Structured model and tool-call events \n A normalized telemetry schema across frameworks \n \n We have also improved session tracking for existing framework integrations. Multi-step agent runs now maintain more reliable event histories and more accurate cost attribution across the full session. \n Teams are already putting this to work, instrumenting agents such as OpenClaw and Hermes with no adapter needed, just  emit()  or a webhook call. \n \n \"Agent frameworks are evolving too quickly for observability to depend on a growing collection of one-off integrations,\" said  Neville Mascarenhas, lead maintainer of Observra . \"With Observra 1.1, developers can instrument the agent they actually built, using the framework—or no framework—they chose, and still get the same consistent telemetry and security controls.\" \n \n Store everything locally \n Observra 1.1 introduces a new local storage option for teams that want a complete, queryable record of agent activity without deploying a separate backend. \n This makes it easier to: \n \n Inspect historical agent sessions \n Investigate unexpected behavior \n Compare model and tool activity over time \n Analyze token usage and cost \n Develop and test agents entirely on a local machine \n \n It is especially useful during development, experimentation, and early-stage deployments where standing up additional infrastructure would add unnecessary friction. \n Watch your agent work in real time \n The release also includes a new terminal dashboard that provides a live view of agent activity as it happens. \n From the terminal, developers can follow: \n \n Active sessions \n Model requests and responses \n Tool calls \n Token consumption \n Estimated spend \n Errors and security events \n \n Instead of reviewing logs after something goes wrong, teams can now see how an agent is behaving while it is running. \n Broader model-provider support \n Observra 1.1 also expands model coverage through support for more than 100 LLM providers. \n Whether an agent uses a major commercial model, an open model, or a less common provider, developers can capture the same core observability signals without rebuilding their instrumentation for each platform. \n Built in the open \n Observra is an open-source project developed under the  Apache 2.0 license  as part of the Open Agent AI Security community. \n It is developed alongside  Praxen , our open-source agent behavior verification project. While Praxen helps determine whether an agent behaves within its intended boundaries, Observra provides the underlying visibility into what the agent did, which tools it used, what it consumed, and what happened along the way. \n Together, the projects are intended to help developers and security teams better understand, test, and secure increasingly autonomous systems. \n Get Observra 1.1 \n Observra 1.1 is available now through  pip . \n  pip install --upgrade observra\n  \n We'd love for the community to try the new release, instrument your agents, report issues, and tell us what you want to see next.",
      "date_published": "2026-08-06T00:00:00Z",
      "authors": [
        {
          "name": "Steve Wilson"
        }
      ],
      "tags": [
        "release",
        "observra"
      ]
    },
    {
      "id": "https://open-agent-ai-security.github.io/blog/promptfall-launch/",
      "url": "https://open-agent-ai-security.github.io/blog/promptfall-launch/",
      "title": "Promptfall: Ten Vulnerabilities. One Hero. Zero Slide Decks.",
      "summary": "Our newest open-source project is a browser platformer that teaches the 2026 OWASP Top 10 for LLM Applications, one stomped vulnerability at a time. No install, no account, no homework. Just play.",
      "content_text": "We've shipped a telemetry SDK. We've shipped a security scanner. Today we're shipping... a video game? \n Yes. Meet   Promptfall  , a modern browser platformer that turns the  2026 OWASP Top 10 for LLM Applications  into a playable campaign. It runs right in your browser, on desktop or phone. There's no install, no account, and no backend. Click the link and you're playing. \n The premise \n Prompt Injection, Data Poisoning, Excessive Agency... the OWASP Top 10 for LLMs is essential reading for anyone building with AI. It is also, let's be honest, a document most people skim once and file away. \n So we gave each risk a body, a bad attitude, and a boss level. \n You play as  Praxi  (yes, the Praxen fox, moonlighting from their day job of scanning agents) running a gauntlet of eleven high-tech environments. Each of the first ten levels is one OWASP risk, brought to life as an animated threat you have to stomp. Defeat every threat in a level to drop the force field and reach the exit. \n Sneaky, sneaky education \n Here's the trick: every level hides six educational encounters in the action. A definition, why the risk matters, two real-world examples, and two defenses, all caught mid-jump without ever stopping the game. Each level ends with a quick quiz to lock it in, drawn from a bank of  33 questions . By the time you've cleared LLM05, you actually know what Data and Model Poisoning is, how it happens, and what to do about it. You just also happened to be dodging things while learning it. \n   \n Beat all ten levels and you unlock  The Gauntlet : every threat returns for one final wrap-up run, each carrying a single key insight worth remembering. All told, that's  70 in-game learning opportunities  across the campaign. (We counted. It's in the source code. You can check.) Survive the Gauntlet and you've effectively speed-read the whole Top 10, with better retention than any compliance training we've ever sat through. \n The soundtrack slaps, and it's studying \n Promptfall ships with  12 original songs , one per level plus a title theme and a Gauntlet reprise, and they're not background filler: the lyrics reinforce what each level teaches. Prompt Injection gets \"Borrowed Hands.\" Excessive Agency gets \"Too Much Rope.\" Misinformation gets \"Beautifully Wrong,\" and Improper Output Handling closes on \"Passed Without Question.\" If you catch yourself humming a mitigation strategy three days later, that's the design working. \n The details \n \n  The whole game is open source  (Apache 2.0), like everything we build. Not just \"the engine\": the campaign data, the lesson content, the quiz bank, the art, and the music all live in the  GitHub repo . Peek at how it works, borrow it for a security-training session, or contribute a level idea. \n  Runs anywhere.  The whole game is static files served from GitHub Pages. Desktop gets keyboard controls, mobile gets touch controls, and pausing freezes everything so you can actually read the hints. \n  Privacy-respecting.  Cookieless pageview counters only. We don't record your controls, your progress, or how many times LLM06 got you. (It got us plenty.) \n \n Why a game? \n Because security education mostly fails at the \"anyone voluntarily does it\" step. The OWASP Top 10 for LLMs matters to developers, security teams, students, and honestly anyone deploying AI, and we wanted a way in that doesn't feel like homework. If one person ships a safer agent because a pixel-art vulnerability once chased them across a platform, that's a win. \n  Play it now:  open-agent-ai-security.github.io/promptfall   \n Tell us your Gauntlet time. We won't tell you ours.",
      "date_published": "2026-08-05T00:00:00Z",
      "authors": [
        {
          "name": "Steve Wilson"
        }
      ],
      "tags": [
        "release",
        "promptfall",
        "owasp"
      ]
    },
    {
      "id": "https://open-agent-ai-security.github.io/blog/praxen-1-2-release/",
      "url": "https://open-agent-ai-security.github.io/blog/praxen-1-2-release/",
      "title": "Praxen 1.2: Now Aligned to the 2026 OWASP Top 10 for LLM Applications",
      "summary": "Praxen 1.2 aligns risk findings to the 2026 OWASP Top 10 for LLM Applications, with clearer scoring, scan-to-scan comparisons, and a new shareable Worker Remit.",
      "content_text": "Today we're releasing   Praxen  1.2 , aligned to the newly published  2026 OWASP Top 10 for LLM Applications . \n The  OWASP GenAI Security Project  — the open, vendor-neutral community that maintains the industry's most widely-adopted LLM risk model — is shipping the 2026 revision of the list, and Praxen 1.2 ships aligned to it from day one. \n This is more than a terminology update. Praxen now evaluates agent risks using the latest OWASP guidance, helping teams connect what an agent can do, what it is allowed to do, and where its controls may fall short against the industry's most current risk model. \n For developers and security teams, that means Praxen findings are easier to interpret, prioritize, and communicate using a framework the broader industry already recognizes. \n \n \"The 2026 OWASP Top 10 reflects how quickly AI application risk is evolving. Praxen 1.2 brings that guidance directly into the review process, so teams can evaluate real agent capabilities, permissions, and behavior against the latest industry standard.\" \n — Steve Wilson, creator of Praxen and project co-lead for the  OWASP Top 10 for LLM Applications  \n \n What's new in Praxen 1.2 \n Alongside the updated OWASP support, this release includes several improvements designed to make reviews clearer and more useful: \n \n Updated risk mapping aligned to the 2026 OWASP Top 10 for LLM Applications \n Clearer, more consistent findings through an improved analysis and scoring process \n Scan-to-scan comparisons showing what is new, resolved, or unchanged \n A new human-readable, shareable Worker Remit for developers, security reviewers, auditors, and leadership \n Reliability improvements so analysis holds up on large, complex codebases instead of stalling \n Scan scoping — point Praxen at the specific component in a monorepo or multi-agent project \n \n Praxen's public 12-agent benchmark remains available for anyone who wants to inspect its performance on real software. \n The benchmark was designed to be transparent and repeatable. Each target was analyzed three times against identical inputs, with the median result published. An independent source review examined roughly 130 findings and found that every reviewed issue traced back to real code or configuration. \n   \n Why the OWASP update matters \n Praxen is built to verify whether an agent's actual capabilities and behavior match the role it was authorized to perform. \n With 1.2, those reviews are now grounded in the latest OWASP risk categories. Teams can move from a raw technical finding to a recognized security concern without manually translating between the two. \n That makes Praxen more useful not only for developers, but also for security teams, risk leaders, and auditors who need a common language for discussing agent security. \n Built in the open \n Praxen is available under the Apache 2.0 license as part of the Open Agent AI Security community. The OWASP Top 10 for LLM Applications, and the companion Agentic AI Top 10, are maintained by the  OWASP GenAI Security Project  — an open, vendor-neutral community — and Praxen 1.2 adopts both 2026 lists as its default risk mapping. \n Get Praxen 1.2 \n Praxen 1.2 installs from the Open Agent AI Security community marketplace — one command to add it, one to install. \n  Claude Code  \n  claude plugin marketplace add open-agent-ai-security/plugins\nclaude plugin install praxen@open-agent-ai-security\n  \n  OpenAI Codex  \n  codex plugin marketplace add open-agent-ai-security/plugins\ncodex plugin add praxen@open-agent-ai-security\n  \n Then point it at an agent and ask for a Praxen analysis. Full instructions, including the no-marketplace path for any other coding agent, are in the  installation guide ; the  project home page  has the benchmark results and worked example reports, and the source lives on  GitHub . \n The same marketplace serves every plugin from this community, so anything we publish next is one  install  away. \n Try the release, run it against your agents, and let us know what you find.",
      "date_published": "2026-08-04T00:00:00Z",
      "authors": [
        {
          "name": "Steve Wilson"
        }
      ],
      "tags": [
        "release",
        "praxen"
      ]
    },
    {
      "id": "https://open-agent-ai-security.github.io/blog/praxen-scan-earns-keep/",
      "url": "https://open-agent-ai-security.github.io/blog/praxen-scan-earns-keep/",
      "title": "When a Security Scan Earns Its Keep",
      "summary": "A developer building a security-sensitive AI agent put Praxen to work on their own codebase. Here's what it found, and how fast it got fixed.",
      "content_text": "We built Praxen to help developers verify what their agents actually do, versus what they intend, so nothing tells us we're on the right track like hearing from people building real, security-sensitive systems. We're always glad to hear from our users, and we especially love it when the feedback is great. \n Recently, a developer building an AI agent with serious security requirements put Praxen to work on their own codebase. They asked to stay anonymous, and we're happy to respect that, so what follows is shared with every identifying and proprietary detail stripped out. The findings themselves are what matter. \n Praxen surfaced a handful of real issues, and the developer verified and fixed them the same day: \n \n  A data-exposure gap in a diagnostics export.  A redaction routine scrubbed one field, but the same sensitive value rode along, intact, in a sibling field of the same export. The kind of leak that's easy to miss and ends up in every export from then on. It's now fixed so every value-bearing field scrubs, with a test that asserts the secret appears nowhere in the output. \n  A tool description quietly teaching an unsafe ordering of operations , in the instructions the model reads. Corrected to spell out the safe pattern instead. \n  Untrusted third-party text flowing unescaped into a privileged instruction channel.  A classic prompt-injection surface, now defanged. \n \n In the developer's own words, the report was \"very impressive\": the high-priority findings were genuinely high-priority, and, a detail we were glad to hear, it was token-efficient. The severity ranking did its job. The things that mattered rose to the top. \n This is exactly what Praxen is for: a pre-ship security gate that checks an agent's actual behavior against its declared intent, before it reaches users. Feedback like this, real findings on a real system, from a developer who holds a high bar, is exactly how we sharpen it. \n If you're building a security-sensitive agent, we'd love to hear from you. Try Praxen, and tell us what worked and what didn't. Anonymous or not, your feedback shapes where we take it next. \n  Grab Praxen today and scan your own agents:   github.com/open-agent-ai-security/praxen",
      "date_published": "2026-08-02T00:00:00Z",
      "authors": [
        {
          "name": "Open Agent and AI Security Community"
        }
      ],
      "tags": [
        "praxen",
        "security"
      ]
    },
    {
      "id": "https://open-agent-ai-security.github.io/blog/steve-common-sense-ai-security/",
      "url": "https://open-agent-ai-security.github.io/blog/steve-common-sense-ai-security/",
      "title": "Community Spotlight: It's Time for Common-Sense AI Security",
      "summary": "Community member Steve Wilson argues that securing AI agents doesn't call for new theory, just the basics applied properly, verifying behavior before deployment, building real audit trails, and treating agents as identities the SOC actually watches.",
      "content_text": "Our community member Steve Wilson has a new piece out that starts from a real incident: press coverage from the Washington Post and the BBC described a five-day attack where an AI agent escaped its sandbox, found a zero-day in its own containment, escalated privileges, and worked its way into another company's production systems, not out of malice, just by relentlessly pursuing its assigned goal. \n His response isn't a call for exotic new defenses. It's a case for three things the industry already knows how to do, applied to agents: verify an agent's behavior before it ships, the way Praxen scans an agent's code, configuration, and behavior for what it actually does versus what it's supposed to do; build a real audit trail for model calls, tool use, and data access, which is exactly what Observra's telemetry SDK is for; and route that activity into the SOC, treating agents as identities with permissions and behavior worth watching, not blind spots. \n Check it out:  It's Time for Common-Sense AI Security",
      "date_published": "2026-08-01T00:00:00Z",
      "authors": [
        {
          "name": "Open Agent and AI Security Community"
        }
      ],
      "tags": [
        "community",
        "security",
        "ai"
      ]
    },
    {
      "id": "https://open-agent-ai-security.github.io/blog/vinaya-finbot-sailors/",
      "url": "https://open-agent-ai-security.github.io/blog/vinaya-finbot-sailors/",
      "title": "Community Spotlight: Connecting SAILORS to Praxen",
      "summary": "Community member Vinaya Vasu connects her SAILORS security framework to Praxen, showing how design-time checks and post-build verification reinforce each other.",
      "content_text": "Community member Vinaya Vasu has been connecting her own security framework, SAILORS, to Praxen, and it's exactly the kind of cross-pollination we love to see. \n SAILORS is a design-time security checklist (input sanitization, access management, output inspection, least-privilege tooling, human override gates, action recording, and prompt hardening) meant to catch agent risks before a single line of code ships. In her latest piece, Vinaya runs Praxen against an agent from the OWASP Agentic AI CTF and lines the results up against SAILORS's seven checks, showing how the two approaches reinforce each other: SAILORS at the sprint review, Praxen after the build. \n Check it out and see how she connects the dots: \n  What Praxen Found on FinBot — and Where SAILORS Fits",
      "date_published": "2026-07-31T00:00:00Z",
      "authors": [
        {
          "name": "Open Agent and AI Security Community"
        }
      ],
      "tags": [
        "community",
        "praxen"
      ]
    },
    {
      "id": "https://open-agent-ai-security.github.io/blog/join-linkedin-community/",
      "url": "https://open-agent-ai-security.github.io/blog/join-linkedin-community/",
      "title": "Join Us on LinkedIn",
      "summary": "Our LinkedIn community is live — join for release announcements, discussion, and news from the people building Observra and Praxen.",
      "content_text": "We've started an  Open Agent and AI Security Community page on LinkedIn , and we'd love for you to join us. \n It's where we'll share release announcements, project updates, and the occasional deeper dive — and where we want to hear from you: what you're building, what's breaking, and what you want agent security tooling to do next. \n If you care about securing agentic and AI systems, come follow along and join the conversation. \n  Follow us on LinkedIn →",
      "date_published": "2026-07-30T00:00:00Z",
      "authors": [
        {
          "name": "Steve Wilson"
        }
      ],
      "tags": [
        "community",
        "linkedin"
      ]
    },
    {
      "id": "https://open-agent-ai-security.github.io/blog/steve-owasp-agentic-findings/",
      "url": "https://open-agent-ai-security.github.io/blog/steve-owasp-agentic-findings/",
      "title": "Community Spotlight: Mapping OWASP Risks with Praxen",
      "summary": "Community member Steve Wilson used Praxen to test 12 open-source agent projects against both the OWASP LLM and Agentic Top 10 — and found the two risk taxonomies overlap more than most people expect.",
      "content_text": "Our community member Steve Wilson just published his latest findings, using Praxen to analyze 12 open-source agent projects against both the OWASP Top 10 for LLM Applications and the OWASP Agentic AI risk framework. \n Across 114 findings, nearly half — 46 — spanned both frameworks, with the strongest overlap between Excessive Agency (the most common LLM-side finding) and Unexpected Code Execution (the most common agentic-side finding). His takeaway: the two taxonomies describe different layers of the same failures — the LLM framework catches model-level weaknesses, the agentic framework catches what happens when those weaknesses turn into real operational consequences — and real-world security failures often chain across both. \n Check it out:  When OWASP LLM Risks Meet Agentic Risks",
      "date_published": "2026-07-14T00:00:00Z",
      "authors": [
        {
          "name": "Open Agent and AI Security Community"
        }
      ],
      "tags": [
        "community",
        "praxen",
        "owasp"
      ]
    }
  ]
}