Tenable Uses OpenAI GPT Cyber Models to Vet Open-Source AI Agents

Why open-source security agents need vetting

Security teams are increasingly deploying AI agents to triage alerts, correlate threat intelligence, investigate suspicious activity and prioritize vulnerabilities. Tenable argues that such agents carry more risk than a typical open-source library. An agent holds credentials, calls tools and acts on what it reads, so its blast radius is bigger.

The CyberAgents Exchange, powered by Tenable, is an open-source, vendor-agnostic directory where practitioners discover, share and deploy agentic AI. Contributors keep their code in their own public GitHub repositories, so visitors can read it before running it. The directory lists agents, MCP servers, skills and playbooks that chain them into end-to-end workflows.

Tenable says that openness makes the Exchange useful but also makes a review process necessary. A baseline review has existed since the initial release. It began as a manual process that was resource-intensive and took days, depending on submission type. Tenable then converted parts of it into skills that collect data, analyze it and create artifacts for the reviewer. The company announced the Exchange Inspector in September and is now sharing initial findings.

The three stages of the Exchange Inspector

Tenable developed the Exchange Inspector through its participation in the OpenAI Daybreak Defense Network, and calls it the first major release from that collaboration. A listing must clear all three stages.

Stage 1: automated screening. Candidates first run through the skills-inspection engine in Tenable One AI Exposure. It parses the agent's instructions, the tools it may invoke and the data it may reach. It then flags prompt injection and jailbreak attempts, hidden instructions, hardcoded secrets, personally identifiable information exposure and sensitive data access. Tenable says this pass clears what is obviously safe, blocks what is obviously unsafe and hands everything else to deeper review with findings attached.

Stage 2: frontier assessment. The submission is then assessed with OpenAI GPT Cyber models available through Tenable's Daybreak access. Standard models handle baseline review. Daybreak Blue supports source code review and dual-use components. Daybreak Red is reserved for higher-risk submissions that need exploit validation and adversarial security testing. Tenable says the models examine how untrusted content could reach the model, what a hijacked or rogue agent could do with its tool permissions, and where a chain of individually harmless actions becomes harmful. The stage is designed to help identify threats a static scanner may not surface.

Stage 3: expert review. Tenable's security research team validates the automated and frontier findings and executes the component in a clean environment to check that its runtime behavior matches its description. It also produces an auditable record covering provenance, threat model, source review and runtime verification. Tenable says this record separates a vetted tag from a one-time automated pass and can be a strong indicator of confidence for a CISO approving a community tool for production.

15 issue classes across three layers

Tenable says every review covers 15 classes of security issues at the model, application and infrastructure layers, and describes them as "the floor, not the ceiling." They range from conventional flaws such as SSRF and path traversal to agent-specific problems such as excessive permissions and memory poisoning. At the model layer, the agent's reasoning and memory are treated as part of the attack surface.

Using OpenAI GPT Cyber models, the Inspector assesses how a threat actor could abuse a specific agent, MCP server or skill rather than matching it against a predetermined list. Tenable says this can surface flaws that do not yet have a name.

What the vetted tag means for users

A listing that passes all three stages is promoted to Exchange Inspector vetted status and carries a tag on the CyberAgents Exchange. Users can filter the directory's search to show vetted listings only.

Three listings currently hold the tag: two built by Tenable and one by Splunk. Their contributors report that the tools accelerate threat hunting, remediation triage and cloud posture investigation. Tenable says one of them, SOC Hunter, has cut hunt times by 75% for its own security team.

For teams weighing community-built agents for production, the tag offers a documented review trail rather than a default trust in contributors, though Tenable's figures and results are its own claims.