Hong Kong FinTech Week: HKU releases the world’s first KYA report; Ant Digital Technologies, GCSA and peers set industry benchmarks

During Hong Kong FinTech Week 2026 × StartmeupHK Festival, Professor Wang Yang, Vice-President of The University of Hong Kong, and Associate Professor Yang Hong of HKU Business School, representing the HKU KYA research team, formally released KYA: Know Your Agent — Research Report on Agent Credit Systems. The Global Cybersecurity Alliance (GCSA) is included as a featured enterprise case in cybersecurity protection and offensive–defensive governance.

Centered on the judgment that “without KYA, there is no agent economy,” the report argues that as AI moves from content generation to autonomous action, the key constraint on the agent economy is shifting from technical capability to trust systems. It proposes a three-dimensional framework of identity trustworthiness, credit trustworthiness, and permission trustworthiness, and builds an L0–L5 agent maturity model as a systematic reference for agent credit assessment and trustworthy governance.

According to the report, 76% of respondents encountered concerns about agent trust, security, or compliance in the past year, and 88% believe the industry needs unified standards for trustworthy agent assessment or certification.

In Chapter 4, “Practice Validation,” the report features a case study titled “GCSA: Security Protection and Offensive–Defensive Governance for the Agent Ecosystem,” analyzing GCSA’s technical practices in AI code security, data loss prevention, agent vulnerability auditing, and automated offensive–defensive evaluation.

Among them, SecVibe Code — jointly developed by The University of Hong Kong and the GCSA AI and Cybersecurity Research Institute — embeds dynamic security auditing and data loss prevention (DLP) into AI coding workflows through a Harness architecture, helping identify code vulnerabilities, sensitive credentials, and privacy leakage risks. The report also cites CyberGym test data provided by GCSA, showcasing research progress of its security-audit agents in vulnerability localization, attack-chain reasoning, and verification.

GCSA emphasizes in the report that security data is an important part of agent credit systems, but building KYA cannot be completed by any single enterprise. Governments, research institutions, and industry stakeholders must jointly advance standard-setting, data sharing, and collaborative governance.

The report includes practices from Ant Digital Technologies, Stripe, GCSA, and other enterprises across domains, illustrating diverse exploration of a trustworthy agent ecosystem. Going forward, GCSA will continue advancing AI security research and offensive–defensive technology innovation, actively participate in building trustworthy agent governance systems, and provide professional support for the secure development of the agent economy.

Full report download: https://www.hkuweb3.com/KYA/report