Salt Security launches AWS WAF managed ruleset for AI agents and APIs

Salt Security has released a new managed ruleset for AWS WAF that aims to block API abuse and AI agent-driven attacks without adding proxies or new infrastructure. The ruleset is now available in AWS Marketplace and is designed to help AWS customers secure existing deployments in minutes.

Why it matters: - APIs now power most digital experiences, and AI agents are becoming a fast-growing source of API traffic. - Salt Security’s new ruleset is designed to close security gaps that traditional WAF rules were not built to handle. - The release targets threats tied to API abuse and agentic activity inside AWS WAF environments customers already use.

What happened: - Salt Security announced Salt Managed Rules for AWS WAF in AWS Marketplace. - The product was announced at Black Hat USA 2026. - The managed ruleset is delivered through the AWS WAF Partner Managed Rules program. - Salt says the ruleset is the first managed ruleset built to secure both APIs and the AI agents that drive them. - AWS WAF customers can attach the ruleset to existing web ACLs from the AWS console. - The deployment does not require proxies, traffic redirection or new infrastructure. - Black Hat USA 2026 attendees can visit Salt Security booth #5938 for an Agentic Attack Assessment, a demo of the Agentic Security Graph and a first look at the new ruleset.

The details: - The ruleset is meant to detect and block credential brute force, excessive GraphQL queries, SSRF, prototype pollution and JWT-based anomalies. - Salt says the ruleset includes industry-first Model Context Protocol awareness. - The MCP features identify and label traffic from MCP endpoints. - The MCP features also block unauthenticated MCP access. - The ruleset adds deeper observability into MCP interactions in AWS WAF environments. - Context-aware rate limiting can apply smart limits to sensitive parameters such as user IDs and email addresses. - Security signal enrichment labels request attributes such as auth headers, user identifiers and GraphQL queries. - Salt said the enrichment is meant to improve detection fidelity and downstream analytics. - The company said the recent Hugging Face incident shows how the gap in traditional defenses can be exploited.

Between the lines: - The launch reflects a shift in how security vendors are packaging AI-era controls: as add-ons to existing cloud security tools rather than standalone products. - By focusing on AWS WAF, Salt is targeting teams that want faster deployment and minimal operational change. - The MCP emphasis suggests Salt sees agent-to-tool interactions as an emerging attack surface.

What's next: - Salt Managed Rules for AWS WAF — AI Agent & API Security is available now in the AWS Marketplace across all commercial AWS Regions. - The ruleset is also available globally via Amazon CloudFront. - Existing AWS WAF customers can subscribe and attach the ruleset directly from the AWS console. - Salt directs customers to the AWS Marketplace listing for more information. - The company also provides a step-by-step deployment walkthrough. - Salt says its broader Agentic Security Platform is designed to discover agents, MCP connections and APIs, stop attacks in real time and eliminate vulnerabilities before production. - Salt Security was founded in 2016 and is backed by Sequoia Capital, S Capital, Tenaya Capital, Salesforce Ventures, Advent International and other investors.