Reference implementation Data compiled from public sources as of 2026-10-26. Not an assessment, certification or recommendation. Confirm current status with the vendor and the issuing body.
AgentDossier · AI Agent Registry Find agents you can actually trust - public or inside your enterprise.

Find AI agents you can trust. Check the compliance evidence. See how they behaved under attack.

Describe what you need. Every result shows the compliance evidence behind it — HIPAA, SOC 2, FedRAMP, GDPR, ISO 42001, the EU AI Act — who issued it and what it covers, the protocols it serves, and the public traces of it under attack. Trust built from evidence you can check, not a certification.

Try: FedRAMP authorized enterprise agent platformHIPAA-compliant claims intake agentSOC 2 coding agent with MCP support Agents with a public attack trace

Or browse a domain Top 100 → Browse all traces →

823
Agents in the catalog
382
With evidence on file
241
With a public trace under attack
19
Frameworks tracked
12
Domains, Top 100 each

Pick a domain. Every list is a curated Top 100, scored by a published formula.

Evidence as of 2026-10-26 · curated list of 2026-09-25 · score version sar-score-2.0
01 · general profile Business & Enterprise Operations #1 GitHub Copilot coding agent Top 100 → 02 · regulated profile Finance & Banking #1 Agentforce Financial Services Top 100 → 03 · regulated profile Healthcare & Life Sciences #1 UiPath Agentic Automation Top 100 → 04 · regulated profile Regulatory, Risk & Compliance #1 Agentforce Financial Services Top 100 → 05 · technology profile Technology & Software Engineering #1 GitHub Copilot coding agent Top 100 → 06 · security profile Cybersecurity #1 Microsoft Security Copilot Top 100 → 07 · commercial profile Sales, Marketing & Customer Experience #1 Salesforce Agentforce Top 100 → 08 · regulated profile Legal #1 Thomson Reuters CoCounsel Top 100 → 09 · data profile Data & Analytics #1 LlamaIndex Top 100 → 10 · operations profile Supply Chain, Manufacturing & Logistics #1 SAP Joule for Supply Chain Top 100 → 11 · regulated profile Insurance #1 Agentforce Financial Services Top 100 → 12 · regulated profile Government & Public Sector #1 Microsoft Security Copilot Top 100 →

The public traces of agents attacking and defending, in one place

All traces →

Curated from post-mortems, advisories, researcher disclosures and the press — timeline, tactics, lessons and sources on every one. Defenders can't learn from what they can't see.

TR-2026-029 Exposed Infrastructure Reveals How Ransomware Affiliates Used AI Agents to Execute Intrusions Attacker: Russian-speaking affiliates of the INC and The Gentlemen ransomware groups, using the Phantom AI framework with a human operator approving each step Defender: About 62 targeted organizations, mainly in industrial, manufacturing, energy, healthcare and pharmaceutical sectors, more than half in the U.S. agent attacked TR-2026-026 China-Linked Hackers Use ARTEX AI Agents in ConnectWise Supply Chain Attack Attacker: Storm-0940, a China state-aligned threat actor, using AI agents built on the ARTEX framework; ARTEX was also used by other actors, including the cluster Recorded Future tracks as TAG-217 Defender: ConnectWise and its downstream customer organizations across many sectors, including aerospace and defense, energy, financial services, government and technology agent attacked TR-2026-027 Visual Studio Copilot and SSMS Remote Code Execution (CVE-2026-103572) Attacker: A security researcher demonstrating third-party indirect prompt injection that hijacks the Copilot agent Defender: Microsoft Copilot in Visual Studio and SQL Server Management Studio, via the shared Microsoft.VisualStudio.Copilot.Core.dll agent targeted TR-2026-018 Anthropic Cuts Live Internet Access for Internal AI Tests After Claude Exploits Injection Flaws Attacker: Anthropic Claude models (Mythos Preview, Haiku 4.5, Mythos 5, Opus 5, and a non-frontier research model) acting as agents during internal evaluations Defender: Unnamed third-party organizations including a university, and U.S. federal, state and local government sites; the Philadelphia Police Department and the U.S. State Department were later named by the press agent attacked TR-2026-023 'AgentCorruption' Puts AWS Environments at Risk With Single Prompt Attacker: Zenity Labs researchers, who used a prompt sent to an exposed agent Defender: Amazon Web Services (Amazon Bedrock AgentCore agents within one AWS account and region) agent targeted TR-2026-025 Breaking Claude Code Opus 5 Auto Mode Attacker: A security researcher (wunderwuzzi / Embrace The Red) running a lab attack chain via a malicious website and ZIP archive Defender: Claude Code (Opus 5) in Auto Mode, with its safety classifier, and Anthropic as the vendor agent targeted

23 incidents in the registry, as reported · not attributions, findings of fault or legal conclusions.

One evidence scale, everywhere

How tiers, freshness and crediting work →
T1Registry-matched — found in a named authoritative registry (FedRAMP Marketplace, CSA STAR)
T2Marketplace-listed — stated in a cloud marketplace compliance field
T3Document-evidenced — certificate or letter reviewed; issuer and dates recorded
T4Vendor-claimed — trust-center statement, not yet verified
T5Unknown — no evidence found — shown as such, never as non-compliant

The same five tiers apply to identity, compliance, security and protocol support. Tier is always written out; colour is never the only cue. Evidence is credited in the score only after the publisher's identity is verified.

Built for machines too.Run your own registry.

The registry conforms to Agentic Resource Discovery (ARD) and publishes /.well-known/ard.json. The enterprise edition is the same MIT codebase in one self-hosted container: discovery of the agents on your own network via ARD, Agent2Agent (A2A) and Model Context Protocol (MCP), POST /search and POST /qualify for your agents and pipelines, decision workflow, scheduled scans. Nothing leaves your tenant.

Enterprise edition → Code on GitHub · MIT