Inside the Exchange Inspector: How Tenable uses OpenAI GPT cyber models to review open-source AI agents

The CyberAgents Exchange is a vendor-agnostic, open-source directory for AI agents that automate security operations tasks. To ensure security, Tenable developed the Exchange Inspector, a vetting process that includes automated security checks, OpenAI GPT cyber model assessments, and human verification of runtime behavior. This review tests for 15 types of security issues across three stack layers, including conventional vulnerabilities like SSRF and path traversal, as well as agent-specific risks such as excessive permissions and memory poisoning. The vetted agents have demonstrated significant efficiency improvements in SOC workflows. The Exchange Inspector process was developed to address the risks posed by AI agents that carry credentials and autonomously interact with security tools, which could otherwise increase the attack surface and blast radius. The directory’s openness is balanced by this thorough review to prevent supply chain risks. Currently, three tools have passed the vetting process, including two from Tenable and one from Splunk.

The vetted AI agents reduce manual workload for security teams by autonomously performing complex, multistep security tasks such as threat hunting, vulnerability triage, and cloud posture assessment. However, AI agents inherently carry credentials and perform autonomous actions, which increases their potential blast radius compared to typical open-source libraries. Without proper vetting, deploying unreviewed AI agents could introduce risks such as SSRF, path traversal, excessive permissions, and memory poisoning. The Exchange Inspector mitigates these risks by screening for prompt injection, exposed secrets, and other security issues before deployment. The vetted agents have already demonstrated operational efficiency gains, such as a 75% reduction in hunt times for Tenable’s security team.

The Exchange Inspector process provides a comprehensive vetting mechanism combining automated checks, AI model assessments, and human verification to ensure AI agents are secure before deployment. Security teams should deploy only Exchange Inspector-vetted AI agents from the CyberAgents Exchange to minimize risk. Since the vetting process is actively maintained and includes runtime verification, no additional immediate mitigation actions are required beyond using vetted agents. Organizations should review the source code of AI agents in public repositories prior to deployment as part of their security assessment.