Your AI Agents Have Shell Access. Who Is Watching Them?

The productivity case for AI agents won. Engineering teams use them to write and ship code. Operations teams let them reconcile data, file tickets, and manage infrastructure. Finance teams point them at ERPs. Each agent arrives with the same job description: act on the company's behalf, at machine speed, with the permissions of the humans who deployed it.

Read that sentence again as a security engineer, and the problem is obvious. We have spent twenty years building identity controls around one assumption — that the entity holding the credential has human judgment, human speed, and human accountability. Agents break all three.

Why existing controls miss

Every legacy control operates either before the agent runs or after it has acted:

• IAM and least privilege decide what an agent could do — but an agent with legitimate deploy rights can still deploy the wrong thing, delete the wrong bucket, or exfiltrate the data it legitimately reads.
• Prompt-level guardrails filter what the model says, not what its tools do. A perfectly polite agent can still run rm -rf on the wrong host after a confused plan.
• EDR and DLP see the effects — a process, a transfer — without the intent. They cannot distinguish an agent doing its job from an agent being hijacked through prompt injection to do an attacker's job.
• Audit logs tell you what happened yesterday. With an actor that executes hundreds of actions per minute, yesterday is far too late.

The only place agent risk can actually be governed is the moment between decision and execution.

Runtime defense: the action is the perimeter

This is the design principle behind AIDR, our runtime defense layer for AI agents. Every action an agent attempts — every shell command, file operation, package install, browser step, API request, and tool call — is evaluated at the point of execution, in context, before it runs. Three outcomes are possible:

• Allow. The action fits policy and the agent's task context. It executes with a full record.
• Escalate. The action is high-impact or unusual — production credentials, a mass deletion, an unfamiliar external endpoint. A human approves or rejects, with the agent's plan and evidence attached.
• Deny. The action violates policy or matches an attack pattern — say, a prompt-injected instruction to post credentials to an external URL. It never executes. The agent can be quarantined, and anything it already changed can be rolled back.

Context is what makes this more than a firewall for tool calls. The same command — curl to an external host — is routine for a research agent and alarming for a payroll agent. Judging that difference requires reasoning about the task, the history, and the blast radius, which is why AIDR runs on Maximus, the same cyber-reasoning model that powers our SOC, rather than on a static rule list.

The threat is not hypothetical

Prompt injection has matured from party trick to tradecraft. An agent that reads external content — web pages, emails, tickets, documents — can be steered by anyone who controls that content. The instruction does not need to compromise the model; it needs to convince the agent that exfiltrating a file is step three of its task. Combined with legitimate credentials, a hijacked agent is the perfect insider: fast, tireless, authorized, and naive.

Agent sprawl makes it worse. Companies that cannot enumerate their service accounts are now spawning fleets of ephemeral agents through platforms their security team has never reviewed. Governing the actions — rather than trying to inventory the actors — is the only control point that scales with that reality.

Governance your auditor can read

Because AIDR sits at the execution boundary, it produces something legacy tooling never could: a complete, evidence-grade record of everything your AI workforce did — what was attempted, what was allowed, what was escalated, who approved it, and what was rolled back. When the first serious agent-caused incident hits your industry, that record is the difference between an explanation and an admission.

And like everything we build, it runs where your constraints live: cloud, on-premises, or fully air-gapped — because the enterprises deploying agents fastest include exactly the sovereign and regulated environments that can least afford to stream their agents' activity to someone else's cloud.