Kong and Straiker: Runtime Security and Agent-Level Control for AI Agents

Kong and Straiker announced an integration that combines Kong AI Gateway's traffic enforcement with Straiker's agent-level security analysis, including Straiker's Agentic Kill Switch, which can revoke tools, suspend sessions, freeze memory, or take an agent or fleet of agents offline. Under the integration, Kong receives AI traffic, Straiker evaluates configured context for risks such as prompt injection, jailbreak attempts, sensitive-data exfiltration, unsafe output, and policy violations, and Kong enforces the resulting verdict in the request path. The companies said the requirements behind the integration come from customer deployments and active proofs of value in healthcare, life sciences, health insurance, and financial services.

Kong AI Gateway already gives platform teams a central place to route, observe, and enforce policy across AI traffic. Security teams working alongside those platform teams often need another set of answers: Which agents are connected? Which attack paths actually succeed against them? What happened across the full session or tool chain? And if an agent is compromised, can its next action be stopped before it reaches an enterprise system? The integration is designed to be complementary. Kong continues to govern and enforce AI traffic, while Straiker adds the security context teams need to understand agent behavior, validate risk, and escalate from a request-level block to broader containment when necessary. How does the Straiker integration work in the Kong request path? Kong AI Gateway handles the traffic patterns production agent systems depend on. The Straiker integration can be applied to configured traffic so the relevant request context is evaluated before the action continues. For LLM traffic, Straiker evaluates risks such as prompt injection, jailbreak attempts, sensitive-data exfiltration, unsafe output, and policy violations in the context of the broader agent workflow. At runtime, the flow is intentionally simple: Kong receives the AI traffic, Straiker evaluates the configured context and returns a security verdict, and Kong enforces the resulting action in the request path. That lets customers preserve Kong as the enforcement point while adding security analysis designed specifically for agent behavior. Example: What happens when an indirect prompt injection turns into an MCP action? - An agent retrieves a document or message containing hidden instructions to move sensitive information. - The agent follows the instruction and attempts to call an MCP tool that can send data to an external destination. - Kong mediates the MCP request as part of the normal traffic path. - Straiker evaluates the semantics of the request and tool arguments and returns a block decision when the action violates policy or matches malicious behavior. - Kong blocks the transaction. If the behavior indicates that the agent itself is compromised or unsafe, the response can escalate beyond that single request. Why does agent-level containment matter if Kong can already block a request? Per-request enforcement solves the immediate transaction. It does not necessarily solve the actor generating the transaction. A compromised agent can try a different tool, start another session, or pass malicious context downstream. Straiker's Agentic Kill Switch https://www.straiker.ai/blog/agentic-kill-switch-for-coding-agents Agentic Kill Switch is the escalation path for that case. Security teams can move from blocking an unsafe action to containing the agent itself, including revoking tools, suspending a session, freezing memory, or taking the agent or a fleet of agents offline. Kong continues to enforce traffic policy; Straiker provides the agent-level response when the security problem extends beyond one transaction. That distinction matters operationally. A security team can stop the malicious action in the traffic path first, then remove the agent's ability to continue acting when the evidence points to broader compromise. This content contains a video which can not be displayed in Agent mode What does this look like in regulated enterprise environments? The requirements behind this integration are familiar from customer deployments and active proofs of value across healthcare, life sciences, health insurance, and financial services. In those environments, AI traffic can touch sensitive data and high-impact systems while multiple application teams share the same platform infrastructure. Security teams in those organizations typically want more than another block list. They want the evidence around the decision: which agent initiated the behavior, what it was connected to, what happened earlier in the session, which attack path succeeded during testing, and whether the event should be contained at the request level or escalated to the agent itself. Kong provides a consistent place to govern and observe the AI traffic. Straiker adds the agent-specific security context and response around that traffic. This gives platform and security teams a shared operating model instead of separate architectures and separate views of the same workflow. How should Kong customers roll out the integration? The lowest-friction motion is to start with production workflows already routed through Kong, prove the runtime value against real traffic, and expand the security program only where the customer needs it. 1. Select one or more production agent workflows already routed through Kong AI Gateway. 2. Start in detect or observe mode and review the security decisions against normal production behavior. 3. Move high-confidence controls into inline enforcement through Kong. 4. Add inventory, posture, and adversarial testing where the security team needs deeper context around the agent and its connected tools. 5. Define Agentic Kill Switch criteria for incidents where the agent itself must be contained, not just the latest request. This gives customers a practical adoption path: protect what is already running, validate the signal in their own environment, and add broader agent security capabilities without rebuilding the gateway architecture. How do Kong and Straiker fit together as agents become more autonomous? As agents gain access to more tools and data, platform and security teams need to stay aligned on the same execution path. Kong gives platform teams the controls to govern AI traffic consistently. Straiker gives security teams the agent-specific insight to understand how that traffic can be abused and what to do when the agent itself becomes unsafe. "Straiker is creating the agentic security control plane for security teams: a place to see what agents are connected to, test how they can be compromised, stop malicious actions at runtime, and contain the agent when the risk goes beyond a single request. Kong gives platform teams the trusted gateway and enforcement layer. Together, we give enterprises one operating model for scaling agents while keeping security and platform teams in control." Ankur Shah - CEO/Cofounder, Straiker What does this partnership give Kong customers in practice? Kong customers should not have to choose between standardizing AI traffic through the gateway they already operate and giving security teams deeper visibility into agent behavior. The partnership is designed to bring those two requirements together. How does Straiker complement Kong AI Gateway's existing security capabilities? Kong provides the gateway controls, observability, authentication, AI governance, and native protections used to manage LLM, MCP, and A2A traffic. Straiker adds agent-specific security analysis and response, including deeper context around agent behavior, connected tools, attack paths, and cases where the agent itself may need to be contained. What types of AI traffic can the integration evaluate? The integration is designed around the same traffic patterns Kong AI Gateway manages: LLM requests and responses, MCP and tool calls, and agent-to-agent communication. The exact context and enforcement behavior can be configured for the customer's deployment. This can span coding, homegrown, and other types of agents. Can customers start by observing security decisions before they enable blocking? Yes. A detect-first rollout gives platform and security teams a way to review decisions against normal traffic, validate the signal in their own environment, and move high-confidence policies into enforcement through Kong when they are ready. How does the integration help platform and security teams work together? Both teams can work from the same AI traffic path rather than introducing a separate proxy or security architecture. Kong remains the gateway and enforcement point, while Straiker adds the agent-specific security context security teams need to investigate behavior, validate risk, and determine the appropriate response. What happens when the security issue extends beyond a single malicious request? Kong can enforce the immediate request-level action. If the evidence indicates that the agent itself is compromised or unsafe, Straiker can escalate to agent-level containment through the Agentic Kill Switch. That separates immediate traffic enforcement from the broader incident response needed to stop repeated malicious action. Claude Code is Anthropic's agentic coding and agent harness tool. Unlike traditional code-completion assistants that suggest the next line in an editor, Claude Code operates as an autonomous agent that reads entire codebases, edits files across mult Alex Drag Model Context Protocol MCP Security: How to Restrict Tool Access Using AI Gateways MCP servers expose all tools by default. There are two problems with this: security agents get capabilities they shouldn't have and performance too many tools degrade LLM tool selection . The solution? Put a gateway between agents and MCP server Deepak Grewal Your Multi-Agent System Is Only as Reliable as Its Context Layer Multi-agent workflows live and die on context. Every agent-to-agent call and every agent-to-tool call is either a retrieval — fetching information the agent needs — or a mutation — changing state that downstream agents will depend on. At prototype s Hugo Guerrero The Architecture Decision Your Multi-Agent System Will Live With Multi-agent systems are, at their core, context distribution systems. Every agent in your workflow is a consumer and producer of context. The interesting architectural questions are all about how that context moves. Two operations drive everything: Hugo Guerrero AI Agent Platforms Are Getting Hacked. Here's What's Missing. The Langflow CVEs and Dify Vulnerabilities: What Actually Happened Langflow's security problems arrived in waves. CVE-2025-3248 introduced a code injection vulnerability allowing remote code execution through unsanitized user input \10\ . Months la Kong AI Gateway vs. Direct LLM API Integration: The Architecture Decision Defining Your AI Strategy Most teams start the same way. A developer creates an API key, calls OpenAI or Anthropic, and ships a prototype. The problems surface when that prototype becomes five production services calling three providers. Hardcoded provider dependencies are Kong Building the Agentic Commit Log: A Technical Blueprint with Apache Kafka and Kong The architecture is built around two data planes, both managed by Kong. The first is the sync data plane — Kong AI Gateway — which handles all synchronous traffic between your agents and the outside world. Every inbound client request, every outbo Hugo Guerrero Governing Claude Code: How To Secure Agent Harness Rollouts with Kong AI Gateway Claude Code is Anthropic's agentic coding and agent harness tool. Unlike traditional code-completion assistants that suggest the next line in an editor, Claude Code operates as an autonomous agent that reads entire codebases, edits files across mult Alex Drag Model Context Protocol MCP Security: How to Restrict Tool Access Using AI Gateways MCP servers expose all tools by default. There are two problems with this: security agents get capabilities they shouldn't have and performance too many tools degrade LLM tool selection . The solution? Put a gateway between agents and MCP server Deepak Grewal Your Multi-Agent System Is Only as Reliable as Its Context Layer Multi-agent workflows live and die on context. Every agent-to-agent call and every agent-to-tool call is either a retrieval — fetching information the agent needs — or a mutation — changing state that downstream agents will depend on. At prototype s Hugo Guerrero The Architecture Decision Your Multi-Agent System Will Live With Multi-agent systems are, at their core, context distribution systems. Every agent in your workflow is a consumer and producer of context. The interesting architectural questions are all about how that context moves. Two operations drive everything: Hugo Guerrero AI Agent Platforms Are Getting Hacked. Here's What's Missing. The Langflow CVEs and Dify Vulnerabilities: What Actually Happened Langflow's security problems arrived in waves. CVE-2025-3248 introduced a code injection vulnerability allowing remote code execution through unsanitized user input \10\ . Months la Kong AI Gateway vs. Direct LLM API Integration: The Architecture Decision Defining Your AI Strategy Most teams start the same way. A developer creates an API key, calls OpenAI or Anthropic, and ships a prototype. The problems surface when that prototype becomes five production services calling three providers. Hardcoded provider dependencies are Kong Building the Agentic Commit Log: A Technical Blueprint with Apache Kafka and Kong The architecture is built around two data planes, both managed by Kong. The first is the sync data plane — Kong AI Gateway — which handles all synchronous traffic between your agents and the outside world. Every inbound client request, every outbo Hugo Guerrero Governing Claude Code: How To Secure Agent Harness Rollouts with Kong AI Gateway Claude Code is Anthropic's agentic coding and agent harness tool. Unlike traditional code-completion assistants that suggest the next line in an editor, Claude Code operates as an autonomous agent that reads entire codebases, edits files across mult Alex Drag Model Context Protocol MCP Security: How to Restrict Tool Access Using AI Gateways MCP servers expose all tools by default. There are two problems with this: security agents get capabilities they shouldn't have and performance too many tools degrade LLM tool selection . The solution? Put a gateway between agents and MCP server Deepak Grewal Your Multi-Agent System Is Only as Reliable as Its Context Layer Multi-agent workflows live and die on context. Every agent-to-agent call and every agent-to-tool call is either a retrieval — fetching information the agent needs — or a mutation — changing state that downstream agents will depend on. At prototype s Hugo Guerrero The Architecture Decision Your Multi-Agent System Will Live With Multi-agent systems are, at their core, context distribution systems. Every agent in your workflow is a consumer and producer of context. The interesting architectural questions are all about how that context moves. Two operations drive everything: Hugo Guerrero AI Agent Platforms Are Getting Hacked. Here's What's Missing. The Langflow CVEs and Dify Vulnerabilities: What Actually Happened Langflow's security problems arrived in waves. CVE-2025-3248 introduced a code injection vulnerability allowing remote code execution through unsanitized user input \10\ . Months la Kong AI Gateway vs. Direct LLM API Integration: The Architecture Decision Defining Your AI Strategy Most teams start the same way. A developer creates an API key, calls OpenAI or Anthropic, and ships a prototype. The problems surface when that prototype becomes five production services calling three providers. Hardcoded provider dependencies are Kong Building the Agentic Commit Log: A Technical Blueprint with Apache Kafka and Kong The architecture is built around two data planes, both managed by Kong. The first is the sync data plane — Kong AI Gateway — which handles all synchronous traffic between your agents and the outside world. Every inbound client request, every outbo Hugo Guerrero Ready to see Kong in action? Get a personalized walkthrough of Kong's platform tailored to your architecture, use cases, and scale requirements.