AI Agent Security Report — aegis scan results for 9 major frameworks
Description: We scanned 9 major AI agent repos (LangChain, CrewAI, AutoGen, LlamaIndex, etc.) for ungoverned tool calls. All 9 scored F. 871 findings total.

# AI Agent Security Report

`aegis scan` results for 9 major AI agent repositories. Scanned 0 Python files. Last updated: April 2026.

0
Ungoverned tool calls
9/9
Repos scored F
9
Repos scanned

Repository | Stars | Files | Findings | Grade | Categories |
--- | --- | --- | --- | --- | --- | ---

## Methodology

`aegis scan` performs static AST analysis on Python files. It detects tool calls, LLM API invocations, subprocess executions, and MCP tool definitions that lack a governance wrapper (policy check, guardrail, or approval gate).

Each finding is mapped to the OWASP Top 10 for Agentic Applications. A governance wrapper does not mean the code is vulnerable — it means there is no automated policy enforcement at that call site.

Scanner source: aegis/cli/scan.py. Results are reproducible — clone the repo and run `aegis scan .`.

## Scan your own repo

Find ungoverned AI tool calls in your codebase.

pip install agent-aegis && aegis scan .