At a glance
- Visibility starts at the endpoint: continuously inventory every AI agent, MCP server, Skill, hook and rules file before writing any policy.
- Agentless, read-only discovery makes a first fleet-wide inventory practical without permanently installing software on employee machines.
- Shadow AI means unapproved agents, models, MCP servers and Skills running under employee identities; only repeated discovery surfaces it.
- According to Backslash Security's agentic endpoint security page, the platform blocks risky agent actions inline before execution, including credential access and privilege escalation.
- Tracing data turns agent activity into usable evidence for compliance reporting and incident investigation.
Backslash Security
Published:
Security teams gain visibility into AI agent activity at scale by inventorying the agentic layer where it actually executes (on the employee endpoint, under the employee's own identity and access) and by discovering it continuously rather than once. The practical sequence is discovery first, risk assessment of each discovered component second, and enforceable policy third, because you cannot allowlist, denylist or investigate what was never enumerated. That enumeration has to reach past the chat window to the components agents act through: MCP servers, Agent Skills, hooks, plugins, connectors and rules files (files carrying standing instructions an agent reads on every run, such as AGENTS.md or CLAUDE.md). According to its agentic endpoint security page, Backslash Security discovers every agent, model, MCP server, MCP tool, Skill, hook, rules file, plugin and connector running on an endpoint. Among the options available as of 2026, discovery methods, assessment criteria, guardrail models and forensic records each answer a different part of the visibility question.
What exactly is the AI agent activity security teams need to see?
The AI agent activity security teams need to see is not one process. It is a set of distinct, separately installed components, each with its own install path, permissions and update cycle. Until each is named, there is nothing to inventory, allowlist or report against.
| Component | What it is | Why it has to be enumerated |
|---|---|---|
| Agent | The client that plans and executes tasks, such as Claude Code, Cursor, GitHub Copilot, Codex, Devin or Antigravity | Determines which actions are possible, and it runs under the employee's identity |
| Model | The reasoning engine behind the agent, hosted or run locally through tools such as Ollama or LM Studio | Unknown models and private account access on enterprise machines are part of Shadow AI |
| MCP server | Under the Model Context Protocol, a connection an agent can act through to reach external tools and data | Each server is a live path from the agent into external tools and data |
| MCP tool | An individual callable function exposed by that server | It is the unit an agent actually calls |
| Agent Skills | Packaged instructions and scripts extending an agent, often just a markdown file on the machine, executing with the user's own permissions | A Skill can tell an agent to read files, call an API or run shell commands |
| Hook | A trigger that fires before or after an agent action | It runs automatically around agent actions |
| Rules file | Standing instructions an agent reads every run, typically AGENTS.md or CLAUDE.md | Its directives persist across sessions |
| Plugins and connectors | Extensions and integrations added to the agent | They extend what an agent can reach |
| Context | The files, repositories, issues and pages the agent reads | It is the channel through which hidden instructions arrive |
For the MCP layer specifically, Backslash's MCP Server Security Hub has scanned and scored publicly available MCP servers.
Why does agent activity stay invisible to the security layers already deployed?
Agent activity stays invisible to the security layers already deployed when an AI agent runs on an employee laptop under that employee's own credentials, because those layers were largely built to record processes, connections and logins rather than what an agent was instructed to do.
Part of the problem is that "agent activity" names two different things:
- Process-level activity: the agent executable doing ordinary machine work, such as Claude Code or Cursor spawning a shell, writing files or opening network connections. Example: an endpoint detection and response (EDR) product, the incumbent layer built to catch malicious processes and known-bad behavior, may log a signed developer tool starting a subprocess as ordinary activity.
- Instruction-level activity: the task the agent was given, the content it read along the way, and the tool calls that followed. Example: a rules file quietly tells the agent to collect credentials before it does anything else.
Instruction-level activity is where the endpoint gap sits. EDR sees the process but not the cause (not which prompt, which agent, which Skill or which MCP server produced an action), and detections and log routing stop at the process boundary. On its data exfiltration use-case page, Backslash published research finding that malicious instructions hidden in a repository's AGENTS.md file could trick OpenAI Codex into silently accessing AWS credentials, npm tokens and Git configuration.
Which visibility layers capture which parts of agent behavior?
Each visibility layer captures a different slice of agent behavior, so what can be reconstructed after an incident depends on where the observation sits. Three criteria decide between them:
- Unit of observation: the smallest thing the layer records (a process, a flow, an API call, a session, or an agent run). This sets the resolution of everything downstream.
- Attribution: whether the layer can separate a human action from an agent acting under that same human's identity.
- Forensic reconstruction: whether the record supports following a sequence end to end rather than confirming a single event.
| Layer | Unit of observation | Typically captures | Typically does not show on its own |
|---|---|---|---|
| Process-level endpoint telemetry (EDR) | Processes, files, binaries | A shell command ran; a file was written | Which agent, Skill or MCP server caused it |
| Network egress logs | Destinations and flows | Which host or API endpoint was contacted, and volume | Which agent, MCP tool or Skill initiated the call |
| Model-provider / API logs | Calls to the model | Model, account, request volume | Local activity that never reaches the provider |
| Identity and SaaS audit trails | Authenticated sessions and resource access | Which identity touched a repository, ticket or record | Whether a person or an agent under that identity acted |
| Agentic-layer endpoint audit and tracing | The agent run | The path of a run from prompt to agent to tool call to outcome | Pair with egress and identity trails to confirm destinations and authenticating accounts |
At the agentic layer, according to the forensics section of its agentic endpoint security page, Backslash traces the full path of an agent run from prompt to agent to tool call to outcome. Egress and identity trails remain useful for confirming where data landed and which account authenticated.
How can teams discover every agent, MCP server and connector across their endpoints?
Teams can discover every agent, MCP server and connector across their endpoints only by treating discovery as continuous, not as a one-time survey, because each component class is installed and changed on its own schedule.
A workable sequence:
- Fix the schema first. Write down what the inventory must hold: agents, models, MCP servers and tools, Skills, hooks, rules files, plugins, connectors, and the identity each runs under.
- Start with an agentless assessment. Backslash offers a free AI Endpoint Exposure Assessment, also called Scout: a short script distributed through your existing MDM that runs, reports and disappears.
- Flag Shadow AI. Separate approved tools from unknown or untrusted agents, models, MCP servers and Skills, and from private account access on enterprise machines.
- Assess the risk of each component, separating approved deployments of Claude Code, Cursor or GitHub Copilot from unvetted MCP servers and Skills.
| Do this | Watch out for, and how to contain it |
|---|---|
| Snapshot the endpoint surface | A snapshot ages the moment an engineer installs a new Skill; keep discovery continuous |
| Inventory MCP servers by name | Names say nothing about behavior; pair discovery with risk assessment of each server |
| Catalog rules files and hooks | They are editable text, so changes are easy to miss; review what they say, not only that they exist |
An incomplete map means Shadow AI stays unreported and post-incident reconstruction has no baseline to compare against.
How does visibility turn into control before a risky agent action executes?
Visibility turns into control before a risky agent action executes only when the inventory feeds a policy that is enforced on the host. Discovery and risk assessment tell a team which agents, MCP servers, Skills and rules files exist and which are safe to approve; guardrails then allowlist approved components, denylist risky ones, and apply custom policies for different teams and risk profiles, enforced continuously. According to the real-time protection section of its agentic endpoint security page, Backslash blocks risky agent actions inline before execution, including unauthorized code execution, credential access, privilege escalation, and data sent to unapproved destinations.
| Do this | But watch for this, and how to handle it |
|---|---|
| Build the endpoint inventory of agentic components before writing any policy | A policy cannot cover a component that was never enumerated; build the policy list from the current inventory, not an old export |
| Express policy as allowlisting of approved components and denylisting of risky ones | Teams carry different risk profiles; write custom policies per team rather than one rule for everyone |
| Keep audit and tracing data for each agent run | A record helps an investigation only if it follows a run end to end |
Latio's 2026 AI Security Market Report found that "where Backslash stood out in our evaluation is in control depth": in-depth control over endpoint agent settings and over what is available to an agent in the first place, beyond scanning for what is malicious. Backslash pairs agentless discovery with on-host enforcement, so a policy is actually applied rather than only recorded.
Frequently Asked Questions
What counts as AI agent activity on a company endpoint?
AI agent activity on a company endpoint covers far more than a chat window. It spans the agentic AI fabric, the interconnected layer of agents, models, MCP servers, MCP tools, Skills, hooks, rules files, plugins, connectors and context running on one machine. These components interact, so none is secure in isolation. An inventory of them is what turns a vague sense of adoption into something a security team can report against.
Why doesn't the existing endpoint stack already show this?
The existing endpoint stack was designed for a different object. EDR resolves activity at the process boundary, while an agent's instruction, the tool call that followed, and the destination it reached sit above that boundary, and a Skill is often just a markdown file sitting in a folder. MDM (mobile device management) leaves a blind spot on what AI agents use and install, such as Skills; MDM does not control that.
How can a team inventory agent usage without installing software on every machine?
Agentless collection, which gathers information without leaving software permanently installed on the endpoint, is a practical starting point for an inventory at scale. According to its AI endpoint exposure assessment page, Backslash offers a free AI Endpoint Exposure Assessment, also called Scout, that is agentless, read-only and retains no data. Discovery produces the list; risk assessment tells you which entries are safe to approve. Enforcing the resulting policy happens on the host, not through the assessment.
How do you tell Shadow AI from a rogue agent?
Shadow AI is a tool nobody approved: agents, models, MCP servers and Skills running inside the organization that security cannot see, often installed under an employee's personal account. A concrete case is an engineer connecting through a private Gmail account on a corporate machine. A rogue agent is an approved agent taking actions nobody asked for, such as reaching for credentials, escalating privilege, or sending data to an unapproved destination. Both play out on the endpoint, where the agent executes.
What evidence should agent visibility produce for auditors?
Auditors and incident responders need a reconstructable record, not a point-in-time snapshot. According to the forensics section of its agentic endpoint security page, Backslash traces the full path of an agent run from prompt to agent to tool call to outcome, and the same page states that it automatically generates audit evidence for EU AI Act, NIS2, DORA and SOC.
Does visibility alone reduce risk?
Visibility establishes the inventory and the record; stopping an action requires enforcement on the host at the moment it is attempted. Backslash's real-time protection blocks risky agent actions inline, before they execute. Around that, guardrails let teams allowlist approved components, denylist risky ones, and write custom policies for different teams and risk profiles.
About this article
Backslash Security publishes this article under its own name and is responsible for its accuracy. Articles are researched and drafted with AI assistance and approved by Backslash Security before publication; publication and update dates reflect substantive edits, not automated refreshes. Last updated: 2026-11-10