A new open-source project, Open Agent Primitives (OAP), has hit the scene with a bold thesis: the biggest security flaw in current AI agents is that they trust the model to know its limits. Released on October 29, 2026, OAP argues that prompts are not security boundaries. Instead, it enforces every action via the platform before the agent can execute it, ensuring that a compromised model cannot widen its own authorization scope.

The Core Problem: Credential Sprawl

The project highlights a critical vulnerability in typical agent deployments: 'Your agent can reach everything its credentials can.' In most setups, a token granted for one repository inadvertently exposes all repositories. OAP fixes this by decoupling what an agent is authorized to do from what the model thinks it should do. The platform checks every tool call, memory lookup, and interaction against a permission graph, ensuring that injected instructions cannot trick the agent into accessing resources it wasn't explicitly granted.

Six Primitives for Secure Execution

OAP is built around six fundamental primitives that address distinct security concerns. First, 'Define' creates versioned AgentClass templates with isolated runtimes. Second, 'Constrain' uses declarative tool contracts checked at write-time and run-time. Third, 'Broker' manages identity by injecting credentials directly into tools, hiding them from the model entirely. Fourth, 'Decide' handles authorization per action, not per session. Fifth, 'Carry' manages channels like Slack and GitHub with strict sender verification. Finally, 'Remember' secures memory and knowledge graphs with item-by-item access checks.

Mapping to OWASP Agentic Top 10

The platform explicitly maps its security posture to the OWASP Top 10 for Agentic Applications (2026). While not all controls are fully mature, OAP claims 'substantial' coverage for risks like Tool Misuse, Identity Abuse, and Unexpected Code Execution. For instance, isolation is enforced per session, though tool calls within a single session currently share a UID. The project is transparent about its gaps, noting that features like goal-lock detection and signed tool manifests are still in progress.

Developer Experience and Infrastructure

OAP is designed to run on infrastructure you already control, from a local laptop to GKE, EKS, or self-managed Kubernetes. It supports major model providers like Anthropic, OpenAI, and OpenRouter, allowing teams to swap models without re-architecting their security layer. The 'Agent Builder' feature lets developers describe an agent in plain language, generating a portable .oap bundle that administrators can review and install, streamlining the deployment of secure agents.

Key Takeaways

  • Authorization moves from the model's judgment to the platform's enforcement, preventing prompt injection from widening access.
  • Credentials are brokered and hidden from the LLM, reducing the risk of token leakage.
  • The project provides a transparent assessment of its security posture against the OWASP Agentic Top 10.
  • OAP supports existing infrastructure (Kubernetes, GKE, EKS) and major model providers, avoiding vendor lock-in.

The Bottom Line

This is the security layer we’ve been waiting for. If you’re running agents in production, stop trusting the model to police itself and start enforcing limits at the platform level.