An AI agent that hunts for vulnerabilities needs access to the systems it tests. That is the uncomfortable part of agentic security. The tool that finds the weak spot also holds keys to the house.
On Tuesday at Oracle AI World in Las Vegas, Oracle announced a managed service that tries to deal with both halves of that problem. Oracle AI Security Mesh uses OpenAI's frontier cyber models, combined with Oracle's testing tools and the context customers supply about their own systems. It covers applications and infrastructure on Oracle Cloud Infrastructure, in other clouds, and on-premises.
According to Oracle, the models reason through how an application behaves and investigate how a weakness could be exploited. They help security teams rank the most serious risks, and they supply evidence, including reproduction steps and test results. When a fix is proposed, the service tests it within the approved scope and checks the effect on expected application behavior. Customers approve each change before Oracle AI Security Mesh applies it.
The part that matters most to anyone building agents is how Oracle says it controls the agents themselves. Each agent runs with its own identity, a defined task scope, and permissions granted just in time. Separate monitors watch for activity outside the approved scope and can stop it. In other words, the testing agents get the same treatment a security team would want for any agent it deploys. Identity, scope, short-lived access, an independent watcher, and a human sign-off before anything changes.
Customers decide where testing is authorized and control its scope. Oracle runs the safeguards meant to reduce the risk of outages or disruption during testing. The pitch, as the OpenAI announcement puts it, is that customers don't have to build and operate their own offensive and defensive agent systems.
"As AI agents take on more responsibility, enterprises need security that can keep pace with how these systems operate," said Phil Newman, senior vice president of Security and Identity at Oracle. Johannes Landgraf, head of cyber at OpenAI, said the combination can help security teams "investigate complex issues, prioritize critical risks, and accelerate remediation while maintaining the controls they require."
Oracle paired the service with two existing pieces. The first is OCI Identity Assurance, which puts the human side of the problem in view. Before a sensitive action such as releasing a payment or changing access permissions, it can use biometrics to verify the identity and presence of the person approving it. Oracle says that in agent workflows, this helps establish that an approval came from a verified person. It is built into OCI Identity and Access Management and works across Oracle Cloud services, including Oracle applications.
Oracle also pitches the same checks for hiring and ongoing access. It combines identity document checks with biometric verification to help spot impostors, and it names North Korean IT worker schemes as an example. Later biometric checks can catch impersonation and account handoffs by confirming that the person using a resource matches the enrolled user.
The second piece is OCI Zero Trust Packet Routing, which sits underneath the agents. Oracle launched it in 2024 and says it was the first cloud provider to implement the emerging open standard. Policies are written in human-readable form and define which resources can talk to each other and which paths can reach sensitive data. Traffic to a protected resource has to be allowed by both those policies and the existing network controls. Oracle says the protection holds as network configurations change, which helps keep a misconfiguration from exposing a resource.
For AI workloads, the point is that enforcement happens below the application and the agent. A compromised agent can't talk its way around a network rule it never sees. Oracle says this helps contain compromised workloads, block lateral movement, and restrict routes for data exfiltration. The implementation follows an open specification developed through an industry initiative, with an open-source reference implementation.
Plenty is still missing. The announcement doesn't give an availability date or pricing. It doesn't say which OpenAI models power the service or how Oracle measures the quality of its findings and fixes. It offers no false-positive rates and no data on how often a proposed fix breaks something. Nothing explains how the independent monitors decide that activity is out of scope, or how long a just-in-time permission lasts. And testing live systems is risky, so teams will want to know how the service behaves against production.
Even so, the design is worth copying. If you build agents, whether for security or anything else, the checklist is short. Give each agent its own identity. Scope each task. Grant access only when needed. Put an independent monitor over the agent. Require a verified human to approve anything that changes a system. Oracle says it built those into a product. Teams building their own agents can start from the same list.
