AI agent security everywhere agents run

Why one layer isn't enough

Every place AI runs hides it from the others. Security that watches one of them leaves agents in the rest unseen, and an agent that can't be seen can't be stopped.

• A desktop agent sees Cursor and Claude Code on the laptop, but not ChatGPT in a browser tab.
• Nothing on a laptop sees Claude or ChatGPT used from a phone or a personal computer, or an agent working in a cloud sandbox.
• A gateway sees the traffic routed through it, not the files an agent reads or the commands it runs on the machine.

So the layers work together: each covers its environment, and all of them report into the same inventory, the same session history and the same guardrails policy. A session the endpoint agent and an AI SaaS integration both recorded is one session, on one person.

How to cover every environment

1. 01

   Start on endpoints

   Install the endpoint agent on macOS, Windows and Linux with one command, or silently through Intune, Jamf Pro, Iru (Kandji), JumpCloud, Mosyle, Fleet or any MDM. Its first scan finds the AI agents on each machine.

2. 02

   Add the browser and AI SaaS

   Push the browser extension to Chrome, Edge and Firefox, and connect Claude Enterprise, ChatGPT Enterprise and Microsoft 365 Copilot, so AI used outside the desktop is in the same picture.

3. 03

   Cover the cloud and gateways

   Put the agent into your container images and your Claude Code and Cursor cloud environments, point your LiteLLM proxy at your guardrails, and move MCP servers behind the MCP Gateway.

Endpoints

The endpoint agent is a lightweight agent on each laptop and server, the endpoint security agent for AI. It finds the AI agents installed there, reads what they load and records what they do.

• macOS 13 or later, Windows and Linux; a one-line installer for a first machine, or silent fleet deployment through your MDM.
• More than 50 desktop AI agents discovered: coding agents, AI IDEs, chat apps and local model runners.
• Where the agent exposes hooks (Cursor, Claude Code, Codex, Gemini CLI, ChatGPT Desktop and more), guardrails block a dangerous command or redact a secret before it runs or leaves.
• Everything is tied to a person, so an alert names who ran the agent, not just a hostname.

Try it free: Cursor · Claude Code · Codex

Browsers

The browser extension covers AI used in a browser tab, which a desktop agent can't see, and reports into the same views as the endpoint agent.

• Chrome, Edge and Firefox 140 or later, deployed by your MDM or from the web store.
• ChatGPT, Claude, Gemini, Microsoft 365 Copilot and Copilot Cowork, and NotebookLM: prompts, responses and tool calls captured.
• Prompts held at submit and checked by your guardrails, as the endpoint agent does on the desktop.
• AI web apps you haven't approved blocked by domain, app or the region their provider is in: off by default, then observe, then enforce.
• Conversation text is hashed by the extension, not stored by it.

Try it free: ChatGPT · Shadow AI

AI SaaS

AI SaaS integrations read usage from each AI vendor's own API, server-side, so you see it even from devices you don't manage. Each also supplies its users, so cloud-only use still has a name.

• Claude Enterprise: Claude Code and Cowork sessions and claude.ai chats, through Anthropic's Compliance API. With prompt inspection on, Anthropic asks Autonomous before each prompt reaches the model, so guardrails block it there.
• ChatGPT Enterprise: ChatGPT conversations and Codex sessions, through OpenAI's Compliance API. Visibility only.
• Microsoft 365 Copilot: every licensed user's prompts and responses, through Microsoft Graph. Visibility only.
• A session the endpoint agent also recorded is merged into one, and everything is scored for risk and checked by your guardrails.

Try it free: Claude · Microsoft Copilot

Containers and cloud agents

Cloud agents and background agents work with nobody watching: in dev containers, CI runners, Kubernetes pods and the sandboxes Anthropic and Cursor start for each task. Autonomous puts the same agent inside them.

• Containers: the agent goes into your Docker image, on glibc-based Linux, x64 and arm64. Each container reports as an endpoint, grouped by workload, with the same inventory, activity, policy and guardrails as a laptop.
• Claude Code cloud: the environment's own setup script installs the agent, so every Claude Code session in Anthropic's cloud is covered.
• Cursor Cloud agents: the cloud agent environment's install and start scripts put the agent in every Cursor Cloud agent, and a team hook can refuse prompts from agents started outside the protected environment.
• A missing key or an unreachable backend never stops your workload: agents keep working, and enroll when they can.

Try it free: Cursor

LLM gateway

Already route model calls through a LiteLLM proxy? It asks Autonomous before each request goes to the model and again on the answer, and lets it through, masks the secrets in it, or blocks it, by the same guardrails policy your endpoints use. About ten minutes to set up.

Try it free: LiteLLM guardrails

MCP gateway

The MCP servers your agents use, run by us in isolated sandboxes instead of on laptops. An administrator adds each server once and decides which of its tools everyone may call; each person signs in as themselves, and their tokens stay in a vault the agent never sees.

More on the MCP Gateway →

Frequently asked questions