BeyondTrust launches security tool to monitor AI agent actions

The rise of autonomous agents

BeyondTrust has launched a new feature called AI Agent Security on its Pathfinder platform for Windows and macOS. This tool is designed to help organizations manage the risks posed by AI agents, which are autonomous tools that perform tasks on behalf of human users. The company wants to provide a way to control these actions at the endpoint, which is the specific computer or device being used.

The launch comes as businesses increasingly test coding assistants and other autonomous tools in their daily workflows. Security teams are concerned because these agents can carry out long chains of actions on local devices and remote services. Once a human issues a single prompt, the agent may execute multiple steps with very little direct oversight from the person who started the process.

Marc Maiffret, Chief Technology Officer at BeyondTrust, noted that AI agents are becoming a new source of privileged activity. He explained that these agents often have the same access as the humans who use them, which expands the number of entities that can exercise power within a company. The goal of the new software is to separate what a human is allowed to do from what their AI agent is permitted to do.

Research on agent behavior

To support the launch, BeyondTrust published research from its Phantom Labs division based on telemetry from early customers. The study looked at how AI coding agents behave on enterprise endpoints, specifically looking at shell command requests and connections to Model Context Protocol (MCP) servers. MCP servers are tools that allow AI agents to reach across different services and platforms to perform tasks.

The study showed that AI coding agents asked for roughly 1.28 million shell commands across approximately 132,000 prompts over a four-week period. This averages out to nearly 10 command requests per prompt, which shows that one user instruction can trigger many downstream actions. This behavior highlights how quickly an agent can move from a simple request to complex technical execution on a machine.

The research also revealed that 85% of the coding-agent users had at least one MCP server configured. These users averaged 4.35 unique servers each, though one specific user was connected to 36 different servers. This connectivity expands the potential area for a breach because a hacker who gets into a user's AI account might be able to move across various linked platforms without needing to find new login details for each one.

Hidden skills and risks

BeyondTrust also examined the 'skills' that shape how coding agents behave, which can sometimes include embedded code. In a study of a mid-sized enterprise, 60% of AI-active devices ran a coding agent. A typical user in this environment had about two dozen installed skills, and at least one in seven of those skills was used within a four-week window.

The research found that about half of these skill installations arrived bundled in code repositories. This presents a challenge for security teams because they may have limited visibility into which add-ons are actually installed. Without clear visibility, it is difficult for administrators to know how these various skills influence the behavior of the AI agents across the organization.

The new security product addresses these issues by providing visibility into AI agents across endpoints. It identifies whether a specific activity is coming from a person or an agent. By capturing context like the human owner, the device, the session, and the specific skills used, the software helps teams understand the full scope of agent activity.

Real-time policy enforcement

Unlike some security measures that only block known bad commands or detect suspicious behavior after it happens, this product evaluates actions at runtime. This means it checks every individual action against a set policy before the agent is allowed to carry it out. This approach allows security teams to set specific permissions for an AI agent that are different from the permissions of the employee using it.

The system is built around three core functions: visibility, intelligence, and protection. It discovers agents, identifies the source of the activity, and enforces policies as requests are made. If an action requires more privilege than the agent currently has, the product can trigger a human review or a just-in-time approval process.

David Morimanno, Field Chief Technology Officer at Xalient, stated that this shifts how companies view trust. He noted that these agents can make decisions and exercise delegated authority at machine speed. The security focus is shifting from simply managing access to continuously managing trust based on the context of the action, the level of authority, and the specific timing of the request.