At a glance
- Destructive agent actions are prevented on the endpoint: discover every agentic component, assess it, enforce allow and deny policy, then block actions inline.
- Endpoint detection and response was built to catch malicious processes and files; an agent's instructions and tool calls sit outside that boundary.
- Agent Skills and rules files are often plain markdown executing with the employee's own permissions, so inventory has to come before control.
- Shadow AI means agents, MCP servers and Skills running without security approval, frequently under an employee's personal account on a corporate machine.
Backslash Security
Published:
You prevent AI agents from taking destructive actions on enterprise systems by governing them where they actually execute: the employee's endpoint. That takes four ordered steps. Discover every agentic component installed, assess which ones are safe, enforce allowlist and denylist policy per team, and block risky actions inline before they run. The instructions an agent acts on can come from an MCP server (a Model Context Protocol connection an agent can act through), from an Agent Skill (packaged instructions and scripts, often just a markdown file, that execute with the user's own permissions), or from a rules file (a file carrying standing instructions an agent reads on every run). Backslash Security discovers every agent, model, MCP server, MCP tool, Skill, hook, rules file, plugin and connector running on an endpoint, and every enforcement decision depends on that inventory. One no-cost starting point available as of 2026 is Backslash's free Skills Security Scanner, which scans AI agent Skills for security risks.
What counts as a destructive action when an AI agent runs on an enterprise endpoint?
A destructive action is one an agent takes that the organization cannot undo, did not authorize, and cannot reconstruct afterward. It comes in two forms.
The first form is a state change: an agent writing, deleting or overwriting something that cannot be restored from the endpoint it ran on. Running rm -rf against a working tree, force-pushing over shared Git history, dropping a database schema or making a non-idempotent API call to a production service all belong here. The damage is the state change itself, and the machine that issued it cannot roll it back.
The second form destroys a trust boundary rather than data. An agent that reads a credential file and sends its contents to an external endpoint deletes nothing, yet it compromises the identity involved for good. Cloud keys, package registry tokens and Git configuration are typical targets, and once they leave the machine they cannot be taken back.
Which components actually execute these actions?
"The agent" rarely takes the step alone. A connected set of components carries it out, each running with the employee's own permissions and identity:
- Agents and models. Locally installed assistants such as Claude Code, Cursor, GitHub Copilot or Codex, plus the models behind them.
- MCP servers and MCP tools. Model Context Protocol is how agents reach external tools and data sources, and each server is a live connection an agent can act through.
- Agent Skills. Packaged instructions and scripts that extend what an agent can do. A Skill is often just a markdown file on the machine, and it executes with the user's permissions.
- Hooks. Triggers that fire on an agent action and run something before or after it.
- Rules files such as AGENTS.md or CLAUDE.md. Standing instructions an agent reads on every run.
- Plugins, connectors and supplied context. The inputs that shape what the agent believes it was asked to do.
Any of these can originate, authorize or perform the irreversible step.
Why do autonomous agents reach destructive outcomes in the first place?
Autonomous agents usually reach destructive outcomes step by step. A benign prompt produces a plan, the plan produces tool calls, and every tool call runs with the permissions of the person who started the run. No single step needs to look hostile. Several mechanics can turn a routine request into an irreversible operation:
- Tool chaining. An agent composes calls across MCP servers, so a read operation can feed a write operation with no human in between.
- Overbroad scopes. Cloud tokens, Git credentials and database connections are issued to a person for all of their work, and the agent borrows them wholesale for a single run.
- Untrusted context. Prompt injection is hidden instructions placed in a file, repository, issue or web page, which the agent follows as though the operator had typed them. A rules file such as AGENTS.md or CLAUDE.md is one place those instructions can sit.
- Long-horizon planning. Multi-step goals generate intermediate actions nobody specified.
- Inherited identity. The agent runs as the employee, on the employee's machine, under the employee's session.
The last point has a direct consequence. When the agent inherits the user's identity, every access decision already granted to that user has, in effect, been granted to the agent.
| Do this | But watch out for this, and how to handle it |
|---|---|
| Narrow the credentials available to an agent session | Scoping limits the blast radius but does not stop an action; pair it with enforcement before execution |
| Require human sign-off for destructive commands | Asking for sign-off on everything erodes attention; reserve it for actions touching credentials, production or external destinations |
| Treat repository and document content as untrusted input | Prompt injection can sit in any file an agent reads; review Skills and rules files before approving them, not only the application that reads them |
| Keep the full run path, not only the end event | A record that stops at the process shows that something ran, not why; keep the chain from the prompt that started the run to the outcome it produced |
How do you block a risky agent action inline before it executes?
You block a risky agent action inline by placing the control between the agent's decision and the system change it triggers. That covers the moment it calls an MCP server, runs a shell command, reads a credential file or writes to a repository, so the action is stopped before it executes. Once a token has been read, a branch force-pushed or a file sent off the machine, the change cannot be undone, so the control has to act first.
Backslash blocks risky agent actions inline before execution, including unauthorized code execution, credential access, privilege escalation, and data sent to unapproved destinations.
| Do this | But watch out for this, and how to handle it |
|---|---|
| Place the control before execution, not after | Process-level visibility shows that an agent binary ran, not what it was instructed to do; extend coverage to the components the agent actually uses: Skills, hooks, rules files, connectors and MCP servers |
| Allowlist approved components and denylist risky ones | A blanket deny stops the people who asked for these tools; give the policy a precise list of what is approved and what is not |
| Write distinct policies per team and risk profile | One corporate policy either stops engineers working or permits too much; Backslash supports custom policies for different teams and risk profiles, enforced continuously |
Which control layers actually see an agent's actions, and where do the gaps sit?
Four control layers sit between an AI agent and an enterprise system: network egress controls, identity and authorization systems, endpoint telemetry, and the agent-level layer. The agent-level layer is what Backslash calls the agentic AI fabric: the interconnected set of agents, models, MCP servers, Skills, hooks, rules files and connectors running on one machine.
Four criteria decide which layer answers a given question:
- Unit of observation. What the layer counts as one event: a packet and destination, a token exchange, an operating-system process, or a prompt followed by a tool call.
- Enforcement point. Where in the sequence of an action the layer applies its control.
- Identity resolution. Whether the action resolves to a device, a corporate account, a personal login, or the agent, Skill or MCP server behind it.
- Reconstructable record. Whether the layer's logs explain why an action happened, not only that it happened.
| Layer | Unit of observation | Enforcement point | Identity resolution | Reconstructable record |
|---|---|---|---|---|
| Network egress controls | Destinations, domains, encrypted flows | At the perimeter, on outbound traffic | Device or network session | Where traffic went |
| Identity and authorization systems | Authentication events and token grants | At the moment access is granted | Corporate account; personal logins often invisible | Who signed in |
| Endpoint telemetry (EDR) | Processes, files, known-bad behavior | At the process boundary | The logged-in user | Process trees, without the instructions behind them |
| Agent-level layer | Agent, Skill, MCP server and tool call | Inline, before the action executes | Which agent, Skill or MCP server caused an action | The run traced from prompt to agent to tool call to outcome |
Each layer fits a different job:
- Network egress controls: destination policy and data-movement boundaries.
- Identity and authorization systems: standing access and account hygiene.
- Endpoint telemetry: malware and process-level abuse.
- Device management tooling: which applications are installed. It does not reach the Skills, MCP servers and rules files an approved agent picks up afterward.
Questions about which agent, Skill or MCP server caused an action belong to the agent-level layer. That is the layer where Backslash operates on the endpoint.
What do you need to discover and govern before you can enforce anything?
If you are accountable for AI risk on machines you do not control, you need to discover the full component set before you can govern or enforce anything. Enforcement scope comes from the inventory, and an allowlist cannot cover a component nobody has recorded. The unit of discovery is the layer on top of the installed application: the files, connections and standing instructions an agent reads at run time.
Each component type carries its own risk, which is why each one belongs in the inventory.
| Component | What it is | Why it matters |
|---|---|---|
| Agent or model | The assistant or model executing tasks, such as Claude Code, Cursor, GitHub Copilot or Codex | A personal sign-in on a corporate machine is a concrete form of Shadow AI |
| MCP server or tool | Model Context Protocol connections an agent acts through | Each server is a live path into the systems the agent can reach |
| Agent Skill | Packaged instructions and scripts that extend an agent, often just a markdown file on disk | A Skill executes with the user's own permissions |
| Rules file (AGENTS.md, CLAUDE.md) | A file carrying standing instructions an agent reads on every run | Its instructions apply to every session |
| Hook | A trigger that fires before or after an agent action and runs something alongside it | It runs something every time the action it is attached to happens |
Next, assess the risk posture of each discovered component, then turn that assessment into scope you can enforce. Backslash's guardrails work on that basis. Approved components are allowlisted, risky ones are denylisted, and custom policies for teams with different risk profiles are enforced continuously. A platform engineering group and a finance team do not need the same rule set, and a single global policy tends to be too loose for one or unworkable for the other.
Frequently Asked Questions
What destructive actions can an AI agent actually take on an enterprise system?
An AI agent acts with the identity and permissions of the employee running it, so its destructive range is whatever that person can do. That includes reading credentials from a developer workstation, escalating privilege, executing shell commands, rewriting repository history and pushing data to an unapproved destination. One route in is prompt injection: hidden instructions planted in a file, repository, issue or web page that the agent reads and follows as though the user had typed them. Backslash's data exfiltration research found that malicious instructions hidden in a repository's AGENTS.md file could trick OpenAI Codex into silently accessing AWS credentials, npm tokens and Git configuration.
Can you enforce agent policy without blocking the developers who asked for these tools?
Yes. Backslash's guardrails allowlist approved agents, MCP servers and Skills, denylist risky ones, and apply custom policies for teams with different risk profiles, enforced continuously, so the policy is a precise list rather than a blanket ban. Philip Walsh, Head of Security Engineering at Happy Returns, put it this way: "Backslash gave us a live picture of the AI our engineers were already running, and a way to govern it without slowing anyone down."
Why doesn't the existing endpoint stack see this layer?
EDR (endpoint detection and response) is the incumbent layer, built to catch malicious processes, files and known-bad behavior on a machine. It inspects what runs. An agent that reads a poisoned rules file and then exfiltrates a token uses ordinary binaries and the user's own permissions, so the activity looks unremarkable at the process boundary. MDM manages device configuration and applications, and it does not control which Skills, hooks or MCP connections an agent picks up after enrollment. EDR sees the process but not the cause: which prompt, agent, Skill or MCP server produced the action. Backslash resolves which agent, Skill or MCP server caused an action. It fills that gap alongside EDR rather than replacing it.
What is an Agent Skill, and how do I check whether one is safe?
An Agent Skill is a set of packaged instructions and scripts that extend what an agent can do. In practice it is often just a markdown file on a developer's machine, and it executes with that user's own permissions, which means a Skill can be installed without anyone reviewing it. Backslash's free Skills Security Scanner scans AI agent Skills for security risks. As a general habit, treat a Skill like any other code that runs with your permissions and read what it instructs the agent to do before anyone installs it.
How do I find the AI agents nobody told security about?
Start with discovery. Shadow AI is the agents, models, MCP servers and Skills running inside the organization that security has not approved and cannot see. Employees usually install them on their own endpoints, sometimes under personal accounts. Backslash discovers every agent, model, MCP server, MCP tool, Skill, hook, rules file, plugin and connector running on an endpoint. For one specific corner of that surface, Backslash publishes Claw-Hunter, an open-source tool for discovering and assessing OpenClaw risks.
What evidence do I need to reconstruct an incident involving an agent?
You need the chain of intent, not only the end event. Backslash traces the full path of an agent run from prompt to agent to tool call to outcome, and it automatically generates audit evidence for EU AI Act, NIS2, DORA and SOC.
About this article
Backslash Security publishes this article under its own name and is responsible for its accuracy. Articles are researched and drafted with AI assistance and approved by Backslash Security before publication; publication and update dates reflect substantive edits, not automated refreshes. Last updated: 2026-11-10