Resources & Reports
TrustworthAgent produces independent due diligence for autonomous businesses — the companies whose software agents act, decide, and operate without continuous human oversight. Our reports are built for investors, acquirers, and enterprise risk teams who need a defensible record before they commit capital or integrate an autonomous product.
All public reports and guides on this page are based on publicly available information only. They do not represent private audits, vulnerability disclosures, or investment recommendations. Read each report's methodology and limitations section before relying on any finding.
The 6-Dimension Security Framework
Every TrustworthAgent report evaluates the same six dimensions. Scores and findings vary by target; the framework is constant.
Buyer Guides
A practical due diligence framework for investors, acquirers, and enterprise risk teams. Covers legal and operational identity, technical architecture, the six security dimensions, traction evidence, operational risk, reputation, legal/liability exposure, and the final Go/No-Go decision record. Includes a concrete checklist for each section.
Read the guide →A buyer-grade audit checklist for customer data, prompt injection, credentials and API keys, payments, operational continuity, and legal liability. Built for investors, acquirers, and enterprise risk teams.
Read the checklist →A paste-in agentic-AI annex for procurement and third-party risk teams: 24 questions across the six security dimensions, with what a credible answer looks like and the red flags, for scoring an AI agent vendor before production access.
Read the questionnaire →What a TPRM platform subscription does well, where it stops on an agentic vendor, and when an independent report with a written verdict is the right buy — with the trade-offs stated honestly, including the one where the subscription wins.
Read the comparison →Turn the evidence review into a bounded internal decision. Copy the memo for access limits, six-dimension conditions, residual-risk acceptance, named approvers, and stop and recovery ownership.
Read the template →Free Public Reports
The separation-related deletion notice and user-managed backup path, resolved email-injection research, credential isolation, and a three-month liability cap. Anonymous data-loss reports are explicitly unverified. Verdict: CONDITIONAL GO STRICT; independent recovery and restricted authority are approval conditions.
Public-information security audit of the AI app-creation platform. Covers the disputed CVE-2025-48757 record (MITRE CVSS 9.3 CRITICAL, CWE-863), 303 endpoints across 170 generated apps with inadequate RLS, exposed endpoints handing out third-party API keys, a publish-time scanner that checked policy existence rather than correctness, deleted vendor statements during disclosure, and a remediation arc documented only by the vendor. Verdict: Conditional Go Strict.
Public-information security audit of the agentic software creation platform. Covers the July 2025 incident in which the Agent deleted a customer's production database and misreported that rollback was impossible, self-reported and unaudited dev/prod separation, a 'never accessible to the AI Agent' secrets claim contradicted by docs that expose secrets as environment variables, consumer terms that disclaim data loss, and a 12-month fee cap with a 10-day modification right.
Public-information security audit of the autonomous software engineering agent. Covers a published prompt-injection chain that reached remote code execution and cloud credentials, an unanswered 120-day disclosure, a well-documented CLI permission model that does not demonstrably cover the cloud and Slack paths, fully NDA-gated SOC 2 and ISO 27001 artefacts, and a liability cap of six months of fees or US$100.
Public-information security audit of the AI coding agent. Covers prompt-injection exposure in Composer, credential handling pre-transmission, MCP/plugin blast radius, LLM-provider concentration, and GDPR/DPA gaps. Six dimensions scored, with concrete deal-team diligence questions.
Due diligence review of the autonomous-agent secure-execution platform: scoped permissions model, intervention handlers, immutable audit trails, and a 72-hour testing-key policy. Key gap: legal pages, DPA, and npmjs SDK package absent from public surface.
Due diligence review of the AI agent benchmarking and cost-analytics platform. Examines benchmark-data methodology, metric provenance, API-key purchase flow, traction claims ($4.2M costs analyzed, 12,000+ agents tracked), and missing legal/status pages.
All reports are based on publicly available information only and are provided for informational purposes. They do not constitute investment advice, legal advice, or private audit findings. TrustworthAgent has no commercial relationship with any subject company.
Get an independent audit
Commission a TrustworthAgent report on any autonomous AI company you are evaluating — before you invest, acquire, or integrate. Delivered within 48 hours. Confidential. Independent.
All reports are subject to TrustworthAgent's standard methodology, non-affiliation policy, and limitations. Confidential results are not published without client consent.