# Every agent gets an identity anyone can check. And an off switch it cannot reach. > Your agents can reach whatever their host can reach, DNS included, and a control that runs on that host is one a rogue agent can tamper with. *Source: https://www.whisper.security/solutions/engineering* *Last updated: 2026-10-01* --- Whisper Graph XDR is identity and egress control for AI agents: each one gets its own address anyone can verify with dig, a rule on what it may reach and a revoke that works from our edge. - [Start free](https://console.whisper.security/sign-up?redirect_url=https%3A%2F%2Fwww.whisper.security%2Fsolutions%2Fengineering) - [Book a demo](https://meetings-eu1.hubspot.com/rsaggar) ## Put a rule on the way out. An agent that can read private data, take in untrusted content and send data out is what Simon Willison calls [the lethal trifecta](https://simonwillison.net/2025/Jun/16/the-lethal-trifecta/). The first two are usually the job. Graph XDR puts a rule on the third: every lookup an agent makes passes a policy that knows who is on the other end, and on a routed tier, every connection does too. In September 2026, [OpenAI reported](https://alignment.openai.com/misalignment-reports/an-agent-used-dns-to-reach-an-external-chatbot) that an agent in one of its training sandboxes reached an outside chatbot through insufficient DNS filtering, and has since limited DNS queries to an allowed list. ## An identity you can verify with dig. A real agent identity from our lab. The reverse DNS, the forward match and the registry record are public and DNSSEC-signed, so nobody has to trust our API. **Verify an agent identity** ```bash $ dig -x 2a04:2a01:c787:fa3b:d78c:23bd:a6:c4ae +short ad78c23bd00a6c4ae.tb00ab91b62bf1dbae50af8a9a292633e.agents.whisper.online. $ curl -s https://rdap.whisper.online/ip/2a04:2a01:c787:fa3b:d78c:23bd:a6:c4ae | jq .status [ "active" ] ``` - [How verification works](https://www.whisper.security/docs/identity/verify) ## One identity per agent, and everything that follows from it. - **Its own address**: An IPv6 address of its own on Whisper's network, AS219419, with signed reverse DNS, a pinned certificate and a public registry record. - **[A rule on what it may reach](https://www.whisper.security/solutions/security-leaders#rules)**: Countries, bulletproof hosting, Tor exits, new registrations and RPKI-invalid routes, plus a per-identity firewall by address, network, host and port. - **An off switch outside the host**: Revoke the identity and it stops resolving, its firewall drops traffic and its public record is withdrawn. [See Graph XDR](https://www.whisper.security/products/graph-xdr) ## Revoke a build server and its agents stop with it. Identities form a tree. Revoking one cuts everything connected beneath it, and the console shows you exactly what before you confirm. Every action goes to the audit trail. Revoking host build-01 cuts it and its two agents, three identities in all. Host web-02 and its agent keep running. ## Nothing here asks you to trust us. - **[Whisper's own network](https://stat.ripe.net/AS219419)**: AS219419, allocated by RIPE, with exact-length RPKI routes you can check without asking us. - **[A public log of every identity](https://www.whisper.security/docs/identity/transparency)**: Every identity granted or revoked is written to a public, append-only log, cosigned by a witness. - **[Compared, with sources](https://www.whisper.security/compare)**: Graph XDR's agent identity next to other identity products, cell by cell, with a source for each. ## Three ways to connect an agent. Route all its traffic through a tunnel, send chosen apps through our egress proxy, or use only our DNS. An identity and DNS-level policy need no software on the host. Three ways to connect a machine or agent to Whisper’s edge: a routed WireGuard tunnel for every packet, a SOCKS egress proxy for chosen apps, or resolver-only DNS. Every tier gets graph scoring, policy and containment. - [Connect your first agent](https://www.whisper.security/docs/network/egress/tiers) ## Where to start building. - **[Give an agent an identity](https://www.whisper.security/docs/identity)**: How identities are issued and named, and how anyone checks one. - **[Attributable egress for fleets](https://www.whisper.security/docs/network)**: The tunnel, egress proxy and DNS-only tiers, and the policy bundles. - **[Ground an agent over MCP](https://www.whisper.security/docs/ai)**: The MCP server, agent sign-up and Agent Skills. - **[Issue and revoke identities](https://www.whisper.security/docs/control-plane)**: Every change to an agent goes through one procedure you can script. ## What engineers ask first. - **How do I control what an AI agent can reach?**: Give it its own identity in Whisper Graph XDR, then set rules on countries, bulletproof hosting, Tor exits, new registrations and RPKI-invalid routes, plus a per-identity firewall. Try them in monitor mode first. - **Our identity provider already gives agents identities. What does this add?**: An identity provider's identity is a token the agent carries. A Graph XDR identity is the agent's own network address, so every connection it makes carries it, and a revoke stops the traffic itself. - **[How does anyone check an identity without trusting you?](https://www.whisper.security/docs/identity/verify)**: The reverse DNS, the forward match and the registry record are public and DNSSEC-signed. dig and curl are enough. - **What happens if Whisper is unreachable?**: Resolution fails open by default, so your agents keep working. A strict mode that blocks instead is available. - **[What does an agent cost?](https://www.whisper.security/pricing)**: The same as any other identity. Five identities are free, for good, and every paid tier is listed on the Whisper pricing page. ## Write down the rule you could never enforce. Then start free with five identities, for good, and €3.99 per endpoint per month, billed yearly, after that. - [Start free](https://console.whisper.security/sign-up?redirect_url=https%3A%2F%2Fwww.whisper.security%2Fsolutions%2Fengineering) - [Book a demo](https://meetings-eu1.hubspot.com/rsaggar)