At a glance
- Endpoint AI visibility is a live inventory of every AI agent, model, MCP server, Skill, hook and rules file on employee machines.
- EDR is built to catch malicious processes, files and known-bad behavior; agent instructions and tool connections sit above that boundary.
- Shadow AI spreads through personal logins and markdown files that mobile device management consoles were never designed to enumerate.
- Backslash Security discovers these components on endpoints, assesses their risk, and blocks risky agent actions inline before execution.
Backslash Security
Published:
Endpoint AI visibility is a continuously refreshed inventory of the AI software actually running on employee machines (the agents, models, MCP servers, MCP tools, Agent Skills, hooks, rules files, plugins and connectors), together with an assessment of which of those components are safe to use and a record of what each one did. Endpoint detection and response (EDR), the incumbent endpoint security layer, does not produce that inventory, because it was built to catch malicious processes, files and known-bad behavior on a machine. A sanctioned coding agent such as Claude Code or Cursor is a legitimate process, and the instructions it follows sit above the process boundary. EDR sees the process but not the cause. Controls that work at the agentic layer itself close that gap, with options available as of 2026.
Backslash Security secures this layer. It discovers the AI agents, MCP servers and Skills running on employees' endpoints, assesses which ones are safe to use, provides guardrails for continuous safe usage, and blocks risky agent actions inline before execution. That scope includes Shadow AI: unapproved tools and private-account logins on corporate machines.
What is endpoint AI visibility?
Endpoint AI visibility is the continuous discovery and assessment of the AI components running on an employee's own machine, plus a trace of what those components did. A one-off inventory does not qualify. Employees install, update and reconfigure these components themselves, so the picture has to refresh continuously to stay accurate.
The objects being discovered are specific:
- AI agent: a tool such as Claude Code, Cursor, GitHub Copilot or Codex that plans and executes multi-step work on the machine.
- Model: the engine the agent reasons with, including locally hosted models.
- MCP server: a connection built on the Model Context Protocol (MCP), the protocol agents use to connect to external tools and data sources. Each server is a connection an agent can act through.
- MCP tool: an individual callable action exposed by that server.
- Agent Skill: packaged instructions and scripts that extend what an agent can do. In practice a Skill is often just a markdown file, and it runs with the user's own permissions.
- Hook: a trigger that fires on an agent action, running something before or after it.
- Rules file: a file such as AGENTS.md or CLAUDE.md that carries standing instructions an agent reads on every run.
- Connector and plugin: integrations that attach the agent to enterprise systems and data.
| Dimension | What it answers |
|---|---|
| Inventory | Which agents, models, MCP servers, MCP tools, Skills, hooks, rules files, plugins and connectors exist on each endpoint |
| Risk posture | Which of those components are safe to use |
| Guardrails | Which components are allowlisted or denylisted, under policies set per team and risk profile |
| Inline blocking | Which risky actions are stopped before they execute |
| Audit and tracing | What happened, from prompt to agent to tool call to outcome |
Which AI components actually run on employee endpoints today?
An inventory of the AI components on employee endpoints runs well past the chat assistant listed in a software catalog. In practice it covers the agentic layer: agents, models, connections and configuration files running on a laptop under the employee's own identity and access.
| Component | How it typically arrives | Why central inventory misses it |
|---|---|---|
| Agents and assistants (for example Claude Code, Cursor, GitHub Copilot) | Self-installed, or bundled inside an approved IDE | Installed per user, outside managed package flows |
| Locally hosted models | Downloaded by the employee | The models it loads are data, not tracked applications |
| MCP servers and the tools they expose | Added from a public registry or by editing a config file | No installer and no package record, only a configuration entry |
| Agent Skills | Copied from a repository or written by the employee | A file on disk, not a tracked application |
| Hooks, rules files and plugins | Written locally or carried in a cloned repository | Text artifacts that change what an agent does |
| Connectors and local context | Authorized by the user, sometimes under a private account | Identity sits with the employee, not the directory |
The IT and endpoint administrators who own the fleet describe the same blind spot: MDM does not control what AI agents use and install, such as Skills. Developer workstations are a prominent use case. Any employee endpoint running an assistant with file and credential access belongs in the same inventory. Backslash's coverage includes AI coding agents such as Claude Code, Cursor, Codex, Devin, GitHub Copilot and Antigravity.
How does process-level endpoint telemetry differ from agentic-layer visibility?
Process-level endpoint telemetry and agentic-layer visibility watch the same machine at different layers. The EDR layer is built to catch malicious processes, files and known-bad behavior: it records what executed. The agentic layer records what an agent was instructed to do, and through which agent, Skill or MCP server.
| Observation criterion | Process-level EDR layer | Agentic AI layer |
|---|---|---|
| Unit of observation | Processes and files | Agent run, tool call, Skill, MCP server, rules file, hook |
| Cause of an action | Sees the process but not the cause | The prompt, agent, Skill or MCP server that produced the action |
| Policy decision point | Not tied to agent instructions | Before a risky agent action executes |
| Evidence left behind | Process-level events | Prompt, agent, tool call and outcome as one connected path |
| Question it can answer | "What ran on this machine?" | "What was this agent told to do, and what did it reach?" |
Why can't EDR give security teams this visibility today?
The gap comes from what the EDR layer was designed to watch, not from how any one vendor builds it. An AI coding agent is an approved application. An employee launches it on purpose, and it runs under that employee's own identity and access.
The failure mode is a legitimate process doing an illegitimate thing one layer above the one the sensor watches. EDR sees the process but not the cause. It cannot tell which prompt, agent, Skill or MCP server produced an action, and without the cause, security cannot stop the action in time. Security leaders feel the same limit: their detections and log routing stop at the process boundary.
Backslash works at that layer. It traces the full path of an agent run from prompt to agent to tool call to outcome. Backslash replaces nothing: it fills a gap that EDR does not cover.
What risks go unmanaged when endpoint AI activity is unseen?
When endpoint AI activity goes unseen, the risks are concrete. To the employee each one looks like an ordinary workday, and it leaves no record that security can see. An unvetted MCP server can be added to an agent's configuration. A Skill can be pulled from an untrusted source with no review. Prompt injection is another risk: hidden instructions placed in content an agent reads, such as a file, repository or web page, which the agent follows as though the user had typed them.
Backslash's data exfiltration research found that malicious instructions hidden in a repository's AGENTS.md file could trick OpenAI Codex into silently accessing AWS credentials, npm tokens and Git configuration. The same research found that malicious repository configurations can redirect Claude Code API requests to an attacker-controlled server, silently exposing the user's sign-in token.
Each of those gaps maps to a control Backslash provides:
- Unapproved components and private-account logins: detection of Shadow AI, meaning unknown and untrusted agents, models, MCP servers and Skills, plus private-account access on enterprise machines.
- A permitted agent steered into a risky action: inline blocking before execution, including unauthorized code execution, credential access, privilege escalation, and data sent to unapproved destinations.
- No record to reconstruct afterward: audit and tracing data from prompt to agent to tool call to outcome.
Frequently Asked Questions
What does endpoint AI visibility actually cover?
It covers the AI components that run on employee machines with the employee's own identity and access, and it is kept up to date continuously. According to the agentic endpoint security page on its website, Backslash discovers every agent, model, MCP server, MCP tool, Skill, hook, rules file, plugin and connector running on an endpoint. It also assesses the risk posture of those components.
Why can't EDR give me this today?
EDR is the incumbent endpoint layer, built to catch malicious processes, files and known-bad behavior on a machine. What an agent was instructed to do, which tool call it made, and which rules file shaped its run all sit above the process boundary. EDR sees the process but not the cause, so an action by an approved agent such as Claude Code or Cursor gives no sign of which prompt, Skill or MCP server produced it.
How is Shadow AI different from a rogue agent?
Shadow AI means AI tools, agents, MCP servers and Skills running inside the organization that security has not approved and cannot see. They are usually installed by an employee on their own endpoint, often under a personal account, such as a private Gmail login used on a corporate machine. A rogue agent is an approved agent taking actions nobody asked for, such as reaching for credentials, escalating privilege, or sending data to an unapproved destination. Shadow AI is a tool you did not approve; a rogue agent is one you did. Each needs its own control.
What is an Agent Skill, and how would I know whether one is risky?
An Agent Skill can tell an agent to read a file, call an API, or run a shell command, and it does so with the user's own permissions. Backslash operates a free Skills Security Scanner that scans AI agent Skills for security risks. It is a reasonable starting point for a team that has no inventory yet.
Who is behind Backslash, and why trust it on this layer?
According to the About page on its website, Backslash was founded by Shahar Man, CEO and Co-founder, and Yossi Pik, CTO and Co-founder. It is backed by Stage One, First Rays Venture Partners, Artofin and D E Shaw & Co, alongside a group of individual investors. Latio's 2026 AI Security Market Report states that Backslash "was one of the first companies to focus on securing AI on the endpoint, building AI endpoint controls well before this year's rush of newcomers."
How can my team see this without deploying new software?
Backslash offers a free AI Endpoint Exposure Assessment, also called Scout. It is agentless, read-only, and retains no data: information is collected without leaving software permanently installed on the machine. It is a short script distributed through your existing MDM that runs, reports and disappears. "Agentless" applies to discovery and assessment only. Enforcement, including inline blocking of risky agent actions, runs on the host.
About this article
Backslash Security publishes this article under its own name and is responsible for its accuracy. Articles are researched and drafted with AI assistance and approved by Backslash Security before publication; publication and update dates reflect substantive edits, not automated refreshes. Last updated: 2026-11-10