This past summer, an AI agent from outside the organization, operating well within its authenticated permissions, still caused a breach. Not from a stolen credential or a broken login, but from a sequence of individually plausible actions that added up to an unauthorized outcome. It has since become the reference case for a question every team policing incoming agentic traffic now has to answer: once an agent proves who it is, how do you know what it does next?
The public account credited AI defenders with catching an AI attacker mid-breach. What happened underneath that headline was messier. The agents involved had valid, authenticated sessions the entire time and used them to reach far more than intended. The activity stopped, if you can call it that, only when the effort behind it died off on its own for unrelated reasons. A later wave of agents found the leftover access and took it further, eventually gaining administrative control over a research cluster. No identity check ever flagged any of this, because none of the credentials involved were fake.
That lack of visibility into agent behavior post-identity verification is what the latest release of Cequence’s Application and API Protection was built to address.
Agent Trust: identity and behavior, in one place
Agent Trust is the headline capability in this release, treating agentic traffic as its own category within the platform rather than folding it into general bot activity. Four components make up the capability:
- An issuer registry gives you a central place to register the identity providers you trust to vouch for an agent, unifying externally issued identity and Cequence’s existing Biometric Check in one configuration.
- Agent access policies let you allow, challenge, or block traffic based on that verified identity, using the same policy priority and reporting model the Cequence platform already uses for every other mitigation policy.
- A detected agents inventory gives you a live, deduplicated view of every agent interacting with your APIs, with drill-down into identity and issuer.
- An agent activity log records what a given agent did, request by request, with full identity context attached to every action.
Together, Agent Trust enables you to see, for any agent interacting with your applications, APIs and data, who it claims to be, whether that claim checks out, and what actions the agent has since taken. Before this release, most customers had pieces of that picture spread across separate tools. Having it in one place means you can let in authenticated agents and stop any that attempt unauthorized actions in real time, not after the fact.
Verified identity doesn’t guarantee safe behavior
A verified credential only confirms who an agent claims to be. It does not tell you whether an agent that passed identity verification is still behaving the way its role implies an hour later. That is what happened in the event mentioned in the opening: the credentials were valid; how they were used was the problem.
Agent Trust is built as two layers for that reason. Identity verification through the issuer registry and access policies sits on top of the behavioral detection. Cequence’s Bot Management engine already runs on “regular” and agentic traffic alike, which keeps evaluating what an agent does regardless of whether it presented a valid credential. A verified agent that starts pulling data outside its normal pattern, chaining calls in a sequence its role has no reason to make, or drifting from the behavior its persona implies gets caught by the same pipeline that has been refining what behavioral fingerprinting can see for a while now. Identity and behavior run side by side, feeding one policy engine and one audit trail, so an agent doesn’t get a pass just because its credentials are valid.
Built to be open
There are several different agent identity approaches on the market right now: Skyfire, Visa’s Trusted Agent Protocol, Google’s AP2, OpenAI and Stripe’s ACP, plus whatever verification a customer’s own identity provider already runs. Cequence’s issuer registry is protocol-agnostic by design.
Many vendors are building closed, proprietary agent-security graphs and asking customers to treat that graph as the single source of truth for everything agent-related. Betting on one identity framework, one vendor’s graph, is a bet against a market that has not converged and may never fully converge on a single standard. Standards bodies like IETF, W3C, and the FIDO Alliance appear to be heading toward the same approach: meet customers and agent frameworks without requiring them to change first, and treat interoperability as the differentiator, not lock-in.
Agent Trust vs. Agent Personas
Cequence’s Agent Trust and Agent Personas capabilities both combine identity and behavior, and the difference lies in which agents each is built to handle. Agent Personas, part of Cequence’s AI Gateway, offers proactive, real-time governance for agents that your enterprise controls: the ones your own team writes, and the ones you allow into your internal apps. Agent Trust, part of Application and API Protection, is reactive control for agents you don’t control: outside/external agents calling the apps and APIs you expose to the world.
The Hugging Face incident shows why an enterprise needs both. OpenAI built and ran the agents that caused the breach, so AI Gateway and Agent Personas are what would have governed them before they reached past their intended scope. Hugging Face owned the APIs those agents reached, so Application and API Protection and Agent Trust are what would have prevented the agents from breaking in. Both products would have caught a different half of the same incident. Agent Trust and Agent Personas operate at different points of the interaction, and solve two different, but related, problems.
How the pieces connect
“Identity plus behavior” is easy to say and harder to build. Cequence captures identity telemetry directly from agent traffic as it arrives. That feeds a detection pipeline where it identifies which traffic is agentic and routes it into a dedicated agent-data index. From there, the issuer registry and policy engine verify identity against whatever providers you’ve registered and apply your agent access policy: allow, challenge, or block. The detected agents inventory and agent activity log sit on top of all of it, surfaced in the same Cequence dashboards your team already uses for API inventory and risk, rather than a separate tool you have to reconcile against them.
The rest of the product release, briefly
Agent Trust is the most prominent capability of this Application and API Protection release, but three other changes are worth mentioning. The risk rules catalog now covers 28 compliance and regulatory frameworks, adding the EU AI Act, SOC 2, and NIST SP 800-228, the first framework in the catalog to address AI-specific API risk directly, including prompt injection. The API spec generation wizard now handles inventories of 10,000 or more endpoints without breaking a sweat. And the AI Assistant now handles bulk risk clearing, file-extension filtering, and content-type filtering directly through natural language, work that previously required the UI.
The limits of an identity-only approach
The Hugging Face incident is a useful test for any vendor’s agent security story, because it exposes where an identity-only approach isn’t sufficient for governing interactions from external agents. An identity-only product would have watched those credentials pass every check the entire time and had nothing else to say. A closed behavioral graph, without an open way to verify identity across whatever framework a customer’s agents use, solves half the problem and asks the customer to trust its proprietary model for the rest.
Agent Trust pairs an open, protocol-agnostic identity layer with behavioral detection that has been running across bot and API traffic on the Cequence platform for years. That combination is a fuller answer than identity or behavior alone, and because it lives in the same platform already inventorying and protecting your APIs, it is built to keep working even as new agent-identity frameworks arrive and displace the old.
