A stat from 2026 that should stop you cold: 88% of organizations reported a confirmed or suspected AI agent security incident in the past year (92.7% in healthcare). And more than half of all agents run with no security oversight and no logging — naked.

The problem isn't that the AI isn't smart enough. It's that almost nobody welded boundaries around it. And boundaries are exactly where rigor lives.

The incident list: speed flooring it, boundaries naked

The last couple of weeks of security signals line up scarily well:

• 88% of orgs reported confirmed/suspected AI agent incidents in the past year; healthcare 92.7%; over half of agents have no security oversight or logging.
• Supply chain is the front door. A plugin-ecosystem supply-chain attack harvested agent credentials from 47 enterprise deployments; attackers used them to reach customer data, financial records, and proprietary code — undetected for six months. A public skills marketplace at one point hosted 824 of 10,700 malicious "skills."
• Config is an attack surface. Check Point disclosed remote code execution in a popular coding agent via poisoned repository config files; MCP (Model Context Protocol) is the connective tissue across nearly every incident this year — poisoned configs, malicious marketplace skills, unauthenticated exposed MCP servers.
• By early 2026, at least ten public incidents across six major AI coding tools were attributed to "agents acting with insufficient boundaries."

The industry's own summary: AI agent security in 2026 is a supply chain problem first, a prompt-injection problem second. And every one of these shares a single root cause — the agent can act, but there's no architectural boundary on what it can touch, change, or call.

Why "naked" is inevitable: bolt-on boundaries always leak

Why do half the agents run with no oversight? Because in the mainstream approach, boundaries are bolt-ons: an allow-list here, a gateway there, logs you read after the fact. The trouble:

• The tools an agent can call, the data it can read/write, the systems it can reach are scattered across config and code — no single, enforced boundary.
• One poisoned config file or one malicious skill walks straight past the boundary you assumed existed.
• When something goes wrong, with no structured audit, it hides for months (those six months are the proof).

Bolt-on boundaries are forever racing the agent's capabilities and attack surface. The real question: can you make the agent unable to cross the line — where the boundary isn't config, it's part of the architecture?

Welding boundaries into the architecture

This is the core idea behind Oinone — let AI own the speed, but enforce boundaries, permissions, and audit in the framework:

1. The AI emits metadata — not code, and not opaque "skills." "Add a 3-level approval to the quote object" produces a structured metadata diff of model/view/flow/permission — a few dozen readable, auditable, rollbackable lines. No hidden attack surface buried in config or plugins.
2. Permissions and boundaries are framework-enforced, not bolt-on allow-lists. Who can read / edit / approve is a first-class, enforced part of the metadata; the agent can't move it or route around it. A poisoned config file can't get past the framework's permission model.
3. Auditable and governable by construction. Where others have "half their agents with no logs," metadata-driven means every change is a structured, traceable, rollbackable diff — audit isn't a bolt-on, it's native. That "undetected for six months" incident would be visible at commit time.
4. Self-hosted; data and context never leave your environment. No dependence on public marketplace skills, no feeding enterprise context to an uncontrolled cloud MCP server — the supply-chain attack surface shrinks at the source.

One line: Speed by AI, rigor by Oinone. The 88% number proves capability without boundaries always blows up; Oinone welds boundaries, permissions, and audit into the architecture, so the agent runs fast inside the safe zone instead of running naked.

Three questions for anyone evaluating tools

1. Where do your agent's boundaries live? A bolt-on allow-list/gateway (racing the attack surface), or framework-enforced so the agent can't cross the line?
2. How fast would you detect a breach? Reading logs after the fact (if they exist), or every change is a structured, auditable, rollbackable diff?
3. Who are you feeding enterprise context to? Public marketplace skills / cloud MCP (a supply-chain minefield), or self-hosted, data-stays-put, output constrained to framework metadata?

FAQ

Q: Where do these security numbers come from?
A: Multiple 2026 AI agent security reports — 88% of orgs reported confirmed/suspected agent incidents in the past year (healthcare 92.7%), over half of agents run with no oversight or logging, a supply-chain attack harvested credentials from 47 enterprises undetected for six months, Check Point's poisoned-config RCE in a major coding agent, malicious marketplace skills, and ten+ incidents across six tools attributed to "insufficient boundaries" (2026-06).

Q: Is Oinone competing with Claude Code / Cursor?
A: No — complementary. Those are general coding agents; Oinone is an AI-native low-code framework that makes the AI emit architecture-constrained, boundary-enforced, auditable metadata for enterprise apps. Use a general agent for low-level extensions, Oinone/Aino for a governed business app.

Q: Is it open source?
A: Yes (AGPL-3.0). One docker compose and it's up in ~5 minutes; self-hosted, data never leaves your environment. It runs in the core systems of billion-scale enterprises.

If this framing helped, the project is open source (AGPL-3.0) — a ⭐ supports the maintainers:

• GitHub: https://github.com/oinone/oinone-pamirs

(Disclosure: I work with Oinone.)