Secure mainframe access for AI agents

A system for securing access to MF data from an LLM or an AI client, the system comprising:

• a hardware processor and a memory;
• an intermediate agent configured to:
• receive from the AI client, a request for data or actions from an MF system, the request comprising a token, the token was previously generated, the token is associated with a uID of the MF system, wherein the uID is associated with a set of privileges within the MF system;
• and
• provide the request to an MF agent executed by the MF system, wherein the MF agent has a privilege to spawn an MF process associated with the uID, wherein the MF agent is restricted from accessing data or performing actions other than spawning the MF process;
• and
• an MF agent configured to:
• upon receiving the request from the intermediate agent, spawning an MF process, the MF process is executed by the MF system, wherein the MF process has the set of privileges that is associated with the uID, wherein the MF process is restricted from spawning another process, thereby implementing secure access to the MF system,
• wherein the intermediate agent is further configured to:
• receive from a client a request to generate the token for accessing the MF system, the request comprising the uID of the MF system and the set of privileges or a portion thereof;
• send a request to the AI client for a password associated with the uID of the MF system;
• receive the password from the AI client;
• send the uID and the password to the MF system for verification;
• and
• generate the token subject to receiving from the MF system a verification that the password corresponds to the uID.

A computer program product comprising a non-transitory computer readable storage medium retaining program instructions for securing access to MF data from an LLM or an AI client, the program instructions comprise:

• receiving, by an intermediate agent, from an AI client, a request for data or actions from an MF system, the request comprising a token, the token was previously generated, the token is associated with a uID of the MF system, wherein the uID is associated with a set of privileges within the MF system;
• providing by the intermediate agent the request to an MF agent executed by the MF system, wherein the MF agent has a privilege to spawn an MF process associated with the uID, wherein the MF agent is restricted from accessing data or performing actions other than spawning the MF process;
• and
• spawning, by the MF agent, the MF process, the MF process is executed by the MF system, wherein the MF process has the set of privileges that is associated with the uID, wherein the MF process is restricted from spawning another process, thereby implementing secure access to the MF system,
• wherein the token is generated by:
• receiving by the intermediate agent from a client a request to generate the token for accessing the MF system, the request comprising the uID of the MF system and the set of privileges or a portion thereof;
• sending by the intermediate agent a request to the AI client for a password associated with the uID of the MF system;
• receiving by the intermediate agent the password from the AI client;
• sending the by the intermediate agent uID and the password to the MF system for verification;
• and
• subject to receiving by the intermediate agent from the MF system a verification that the password corresponds to the uID, generating the token.