The Composio breach: Let's stop blaming the agents. Composio disclosed a security incident on May 21. The security incident report describes how an attacker reached a foothold in an internal agentic tool monitoring Composio's infrastructure, escalated through the automated remediation systems that fix errors in their connectors, registered malicious tool definitions in the platform's sandbox and ended with arbitrary code execution in Composio's tool-execution sandbox. The important lesson is not that an agentic system was involved. It is that internal automation had enough standing authority to become an attack path. Once the attacker found a way to drive that automation, the platform's own trusted workflows carried the breach forward. While the incident report highlights that the full list of leaked connections was only 0.3% of total active connections, the disclosed impact still included roughly 5,000 GitHub OAuth grants and 5,241 cached API keys that Composio assesses were "likely" exposed. A leaked internal GitHub token also prompted Composio to obfuscate the production codebase. The dangerous part was not the sandbox, it was the ungoverned path into it. The breach chain Composio describes runs entirely inside their own boundary. A monitoring agent for connectors was abused into facilitating the next elevated access step. Whether the agent itself was reasoned into invoking remediation functions, or whether the foothold gave the attacker a separate path into a neighboring remediation system, is not clear from the public bulletin. Regardless, the monitoring surface was supposed to observe. The remediation surface was supposed to fix. But once those systems were connected with enough privilege between them, observation became a path to destructive action. From there, the attacker registered malicious tool definitions in Composio's sandboxed execution environment and was able to run arbitrary code in the runtime where customer-scoped tool calls execute. The chain matters more than the entry point. While the bulletin notes the attacker showed "deep knowledge of our API surface and internal architecture" and was "likely augmented by advanced AI systems," that changes the timeline of an attack but not the control failure. The systems the attacker traversed were already in place, already wired together, and already held the privilege the attacker exercised through them. Same failure, different driver. Neha, its CPO, recently covered control failures of this kind, where standing privileges held by an agent led to a production incident on the agent's own initiative. The Composio case is the other side of that coin: an attacker purposefully abused the agent rather than the agent going wrong on its own. The underlying failure is the same. Any internal automation surface with broad standing privilege becomes dangerous once someone else can drive it. It does not matter whether that "someone" is a confused agent, a compromised workflow or an attacker with deep knowledge of the platform. The blast radius is defined by the standing privileges already sitting there. This is the uncomfortable part for agentic platforms. It is not enough to ask whether the agent, tool or sandbox is secure in isolation. The real question is what each system is allowed to do at runtime, how that permission is granted, how long it lasts and whether the action is authorized in the context of the customer, credential or connector being touched. Without that critical control layer, internal tools become trusted shortcuts through the very boundaries they were meant to protect. What this means in practice. For operators of agentic platforms: assume an internal-automation compromise is a likely entry point and design around it. Separate trust zones between observation and action. Require per-action authorization for changes that touch customer credentials. Keep an audit trail clear enough that a post-incident reader can tell from outside the platform which kind of escalation occurred. For buyers of agentic tool platforms: the platform holds enough on your behalf that its own internal pivots belong in your threat model. Composio is being commendably transparent in their disclosure, and the chain they describe is worth examining carefully against your own architecture. Short post: The Composio breach was not only about agentic AI, leaked credentials or sandbox execution. It was about trusted internal systems with enough standing privilege to become an attack path.

Integrations: connect your AI agents to any business system in minutes. Today, AiXplain Inc. is making it radically easier to connect your AI agents to your business systems. In fact, your agents can now securely connect to Slack, Notion, Salesforce, Jira, Google Drive, Airtable, and 230+ other tools. As a result, these integrations enable them to fetch data, trigger actions, and complete multi-step workflows across your entire stack. From powerful to simple. AiXplain Inc. has always given customers deep control through its integrated marketplace and flexible REST API wrapping. You could connect to virtually any service and run tools safely in sandboxed environments with full permissions control, in under 10 minutes. However, AiXplain Inc. wanted to make enterprise integrations even simpler and faster to scale. That's why AiXplain Inc. has partnered with Composio to bring 230+ production-ready connectors directly into aiXplain, with zero setup required beyond secure authentication. Composio is an integration platform that provides secure, low-latency access to over 230 enterprise applications. In addition, it handles authentication, action definitions, and credential management. As a result, developers can integrate tools without writing custom wrappers or managing middleware. Enterprise-Grade security, zero setup. * Multiple authentication methods: OAuth, API keys, and service accounts * Multi-account support: Connect personal and business accounts separately * SOC 2 Type II compliance: Zero-trust architecture with isolated token handling * Native governance: Full observability and permission controls in your aiXplain dashboards How AI integrations with Composio work. Best of all, no manual schema definitions are required. All Integrations are fully documented and introspectable, allowing agents to plan and act immediately. # Demo: Using Integration Tools in Agents. # Step 1: Get Airtable tool from aiXplain marketplace airtable_tool = ToolFactory.get("68cc6b33d4e0b5e6e10cb3f8") # Step 2: Explore available actions airtable_tool.actions # Step 3: Define which actions your agent needs needed_actions = {"AIRTABLE_CREATE_FIELD", "AIRTABLE_CREATE_MULTIPLE_RECORDS", "AIRTABLE_CREATE_TABLE", "AIRTABLE_DELETE_RECORD", "AIRTABLE_GET_BASE_SCHEMA", "AIRTABLE_GET_RECORD", "AIRTABLE_LIST_RECORDS", "AIRTABLE_UPDATE_RECORD",} # Step 4: Configure tool scope (filter to only needed actions) airtable_tool.action_scope = [a for a in airtable_tool.actions if a.code in needed_actions] # Step 5: Create agent with clear instructions and tool integration sales_agent = AgentFactory.create( name="Sales Analytics Agent", description="Specialized agent for sales data analysis and reporting.", tools=[airtable_tool], # Add Airtable) response = sales_agent.run("Get a summary of the sales data") # Test Real-World impact of AI integrations: the Attio agent. To help its Business Development team, its Ops Agent Architect developed a specialized agent integrated with Attio CRM that demonstrates the power of true automation: Specifically, the agent monitors new company entries and pipeline changes, scanning notes, emails, and metadata for key signals like funding stage and strategic fit. When this happens and opportunities meet thresholds, it launches an autonomous workflow: * Generates opportunity profiles and posts summaries in Slack * Auto-creates pre-filled Google Drive deal briefs for qualified leads * Sends follow-up tasks to assigned AEs via Attio with suggested next steps This autonomous agent uses Gmail, Google Drive, Slack, and Attio Integrations to streamline business processes and improve deal momentum without human intervention. Get started today. All aiXplain users can access Integrations immediately. In addition, there are no installations and no additional subscriptions required. * Open Studio * Connect with an Integration with your credentials * Add the Integration Tool to any agent and start orchestrating Finally, each Integration connection generates a new Tool, enabling safe multi-identity workflows. For more details, documentation is available in the aiXplain Cookbook, with support ready to help your team get set up on Discord.