AI Agent Security Report — aegis scan results for 39 repos
Description: We scanned 39 AI agent repos for ungoverned tool calls. 36/39 scored F. 2,555 findings total.

# AI Agent Security Report

`aegis scan` results for 39 AI agent repositories. Scanned 0 Python files. Last updated: April 2026.

0
Ungoverned tool calls
36/39
Repos scored F
39
Repos scanned
0/39
Have selection governance

## Key Finding

36 out of 39 scanned repositories have zero governance on their AI tool calls.

0 out of 39 have any form of selection governance (detecting what agents choose NOT to show).

Combined: 2,555 ungoverned tool calls across 35,616 Python files.

Filter:

Repository | Stars | Files | Findings | Grade | Categories |
--- | --- | --- | --- | --- | --- | ---

## Methodology

`aegis scan` performs static AST analysis on Python files. It detects tool calls, LLM API invocations, subprocess executions, and MCP tool definitions that lack a governance wrapper (policy check, guardrail, or approval gate).

Each finding is mapped to the OWASP Top 10 for Agentic Applications. A governance wrapper does not mean the code is vulnerable — it means there is no automated policy enforcement at that call site.

Selection governance check: We also verified whether each framework implements any form of selection-by-negation detection, option filtering audit, or commit-reveal protocol. None do.

Scanner source: aegis/cli/scan.py. Results are reproducible — clone the repo and run `aegis scan .`.

## Scan your own repo

Find ungoverned AI tool calls in your codebase.

pip install agent-aegis && aegis scan .