![\"Open](\"https:\/\/www.europesays.com\/ai\/wp-content\/uploads\/2026\/05\/openagenttruststack_logo.jpeg\"){kind=logo}
<\/p>\n<\/p>\n
Open standard enables any vendor to implement zero-trust security for AI agents with verifiable conformance<\/p>\n
ThirdKey AI Publishes Open Agent Trust Stack (OATS)\u00a0v1.3.0<\/p>\n
ThirdKey AI today published the Open Agent Trust Stack<\/a> (OATS) version 1.3.0, an open specification Agent security is an industry challenge, not a competitive advantage. We\u2019re publishing OATS so any vendor can implement verifiable security guarantees.\u201d<\/p>\n \u2014 Jascha Wanger, ThirdKey AI<\/p>\n \u201cAI agents are executing consequential actions in enterprise environments, but the security model Five-Layer Architecture<\/p>\n OATS specifies five integrated security layers:<\/p>\n \u2013 ORGA Reasoning Loop: Typestate programming makes policy enforcement structurally unbypassable at Also Read:\u00a0AIThority Interview With Rohit Agarwal, Founder & CEO of Portkey<\/a><\/p>\n Empirical Validation<\/p>\n The specification is informed by approximately nine months of autonomous operation through Key findings:<\/p>\n \u2013 263 forbidden tool-call attempts refused, zero reaching execution across 874 adversarial runs The v1.3.0 release also identifies a bounded refinement: on content-shape attacks, six of seven Vendor-Neutral Standard<\/p>\n OATS is model-agnostic, framework-agnostic, and vendor-neutral. The conformance requirements \u201cAgent security is an industry challenge, not a competitive advantage,\u201d Wanger continued. \u201cWe\u2019re Regulatory and Compliance Support<\/p>\n The OATS audit journal provides technical infrastructure supporting HIPAA, SOC2, SOX, and GDPR Comparison with Existing Approaches<\/p>\n OATS distinguishes itself through architectural innovations not found together in prior work: Open Source Implementation<\/p>\n ThirdKey AI is releasing OATS as an open specification at openagenttruststack.org. The complete The Symbiont reference implementation is available under Apache 2.0, enabling enterprises to Future Development<\/p>\n The most important next deliverable identified in v1.3.0 is multi-implementation conformance \u2014 ThirdKey AI is engaging with industry standards bodies to explore formal standardization paths and Also Read:\u00a0\u200b\u200b<\/a>AI-Driven Risk Intelligence: How FIs Are Predicting Systemic Shocks<\/a><\/p>\n
defining how autonomous AI agents should be secured at runtime. As enterprises deploy AI agents
that execute consequential actions \u2014 querying databases, sending communications, managing
credentials, invoking cloud services \u2014 existing security frameworks have proven inadequate for
systems where AI-driven actions are irreversible, execute at machine speed, and originate from
orchestration layers vulnerable to prompt injection.<\/p>\n
hasn\u2019t caught up,\u201d said Jascha Wanger, founder of ThirdKey AI. \u201cCurrent approaches try to
intercept arbitrary actions and decide which to block. OATS inverts this by constraining what
actions can be expressed in the first place, making dangerous actions structurally inexpressible.\u201d<\/p>\n
compile time
\u2013 Tool Contracts: Declarative interfaces constrain agent\u2013tool interactions to typed, validated
parameters, with content sanitization (new in v1.3.0) for invisible-Unicode and homoglyph defense
\u2013 Identity Stack: Bidirectional cryptographic verification, with explicit algorithm allowlists
(new in v1.3.0) that require JWT verifiers to reject unsafe algorithm classes
\u2013 Policy Engine: Formally verifiable authorization decisions evaluated outside LLM influence,
fail-closed by construction
\u2013 Audit Journal: Hash-chained, Ed25519-signed records providing tamper-evident forensic
reconstruction, with W3C Trace Context propagation (new in v1.3.0) for multi-agent forensic
stitching<\/p>\n
ThirdKey\u2019s\u00a0Symbiont reference implementation. Initial results validate five of seven core
conformance requirements through three companion preprints, evaluated across nine widely available
hosted LLMs including GPT-5, Claude Haiku 4.5, Gemini 2.5 Pro, DeepSeek-V3.1, and Qwen3-235B.<\/p>\n
\u2013 333 of 335 argument-injection attempts blocked through tool-contract validation across eight
attack categories (100% bite-rate against hostile inputs)
\u2013 0\/560 escape on four pure-action vectors against Symbiont, versus 88\u201398% pooled escape rates on
permissive Python and Docker-isolated Python substrates with the same lures and models \u2014 the
comparative claim that single-substrate evaluations cannot make
\u2013 The two-fences finding: in stack-stripping ablation, the executor profile-of-one fence refused
219 out-of-profile dispatches even with the policy engine disabled, demonstrating that the action
layer is two independent fences operating in series
\u2013 Performance: Cedar policy gate adds 30\u201395 \u00b5s per call, content sanitizer adds ~345 ns \u2014 orders
of magnitude below LLM inference latency<\/p>\n
evaluated models cluster at 1\u20134% bypass while GPT-5 alone retains ~16% \u2014 the \u201cregex ceiling\u201d
against frontier models, addressed as a research direction rather than a v1.3.0 spec change.<\/p>\n
(C1\u2013C7 mandatory, E1\u2013E9 extended, with E9 newly added in v1.3.0) enable comparable evaluation
across different agent platforms and implementations.<\/p>\n
publishing OATS as an open standard so that any vendor \u2014 from cloud providers to startup agent
frameworks \u2014 can implement these requirements and provide enterprises with verifiable security
guarantees.\u201d<\/p>\n
requirements. Version 1.3.0 adds an explicit redaction protocol (\u00a79.6) for sensitive parameters
such as API keys and credentials, keeping the fact of dispatch auditable while removing secret
values from long-lived logs. This support is particularly relevant for healthcare, financial
services, and government deployments where the consequences of unauthorized agent actions could be
severe.<\/p>\n
allow-list enforcement rather than deny-list interception; compile-time policy enforcement rather
than runtime checking; bidirectional cryptographic identity with per-credential-class algorithm
allowlists; formal conformance criteria; and comparative empirical validation against OS-isolation
baselines.<\/p>\n
v1.3.0 specification is published at zenodo.org\/records\/20298543 with DOI 10.5281\/zenodo.20298543
for permanent citation. The three companion preprints \u2014 typestate-enforced agent loops
(10.5281\/zenodo.19896446), declarative tool-argument contracts (10.5281\/zenodo.19957596), and
substrate comparison (10.5281\/zenodo.20043247) \u2014 provide the empirical grounding.<\/p>\n
deploy OATS-compliant infrastructure without licensing barriers. Symbiont v1.14.0 (May 2026)
shipped alongside the v1.3.0 specification, responding to an independent security audit covering 5
critical, 7 high, 10 medium, and 9 low findings \u2014 several of which motivated the v1.3.0
SHOULD-level additions.<\/p>\n
building an independent OATS-compliant runtime in a different language ecosystem and verifying
that the conformance criteria reproduce. Other targets include closing the content-shape ceiling
against frontier models through structural validator design, expanding empirical coverage to
context accumulation under load and Gate-influence probing, and incorporating findings from
controlled production case studies.<\/p>\n
welcomes participation from vendors, researchers, and enterprise security teams.<\/p>\n