Alibaba Cloud Launches AI Agent Security Framework at WAIC 2026 with Three-Layer Unified Protection

On July 18, at the "Agentic Cloud: Infrastructure for the Agent Era" forum during WAIC 2026 at Shanghai World Expo Center, Alibaba Cloud Intelligence Group's cloud security product lead Zhu Jianyue delivered a keynote titled "Building Trustworthy Agents with Agentic-Native Security," systematically introducing Alibaba Cloud's security framework for the AI Agent era. The event also marked the official release of the 2026 Alibaba Cloud AI Agent Security Best Practices.

Zhu stated that as AI Agents enter the large-scale deployment phase, security has evolved from an "optional feature" into a "business imperative." Alibaba Cloud proposed a "three-layer unified, integrated protection" concept covering the infrastructure layer, model layer, and application layer. This framework builds security capabilities around the full lifecycle of an Agent, creating a complete闭环 from pre-incident risk identification, through real-time runtime protection, to post-attack traceability.

On the product side, Alibaba Cloud launched the Agent Security Center platform, which supports Agent asset identification, vulnerability detection, AI Red Team penetration testing, and runtime security covering user input, model inference, tool invocation, and result output. For typical AI Agent risks such as prompt injection and credential leakage, the system provides full-chain detection and filtering while keeping runtime latency under 100 milliseconds.

Additionally, Alibaba Cloud introduced two "shift-left security" capabilities: Agent ID Guard for identity authentication and least-privilege access management for Agents, and AI code security capabilities deeply integrated with Git and CI/CD pipelines. These help enterprises identify and fix security risks during the development phase, reducing the attack surface before deployment.

Zhu revealed that Alibaba Cloud has already integrated over a dozen security products into the SKS security capability system, all accessible through Agent invocation. The platform currently serves over 300 enterprise clients with more than 500,000 daily API calls, offering intelligent security operations including vulnerability analysis, risk monitoring, and automated response.

Releasing this security practice at WAIC 2026 reflects the growing industry focus on AI Agent security as deployment accelerates. From prompt injection attacks to Agent privilege abuse, AI Agents face threat models fundamentally different from traditional applications.

Zhu concluded his speech by calling on the industry to embed security natively into the full chain of infrastructure, models, and applications in the AI-native era, in order to build a trustworthy AI Agent ecosystem. This sentiment resonated widely among attendees.

Alibaba Cloud's release provides enterprises planning or already deploying AI Agents with a systematic security reference framework, potentially driving the industry toward more mature Agent security practice standards.