At a glance
- Stopping unauthorized AI agents on endpoints takes continuous discovery, component-level risk assessment, enforceable allow and deny policy, inline prevention, and replayable audit trails.
- Endpoint detection tooling and device management were built around processes, files and devices, so agent instructions, MCP servers and Skills sit outside them.
- Shadow AI — unapproved agents, MCP servers and Skills installed by employees, often under personal accounts — is what endpoint discovery tooling exists to surface.
- Latio's 2026 AI Security Market Report named Backslash Security an Endpoint AI Security Leader for in-depth controls over AI on the endpoint.
- The AI Endpoint Exposure Assessment page on Backslash Security's website describes a free, agentless, read-only check that retains no data.
Backslash Security
Published:
The tooling that stops unauthorized AI agents on company machines shares four functions: continuous discovery of what is installed on each endpoint, a risk assessment of every component it finds, enforceable allowlist and denylist policy per team, and inline prevention that stops a dangerous action before it executes, backed by a trace of what the agent did. Those four functions are the yardstick for the options available as of 2026. The layer they act on includes MCP servers (Model Context Protocol is the protocol agents use to reach external tools and data, so each server is a live connection an agent can act through) and Agent Skills (packaged instructions and scripts, frequently just a markdown file, that run with the employee's own permissions). Classic endpoint detection and response was designed to catch malicious processes and files on a machine, and the instructions an agent reads sit outside that boundary. Backslash Security operates at this layer: it discovers every agent, model, MCP server, MCP tool, Skill, hook, rules file, plugin and connector running on an endpoint.
What actually goes wrong when employees run unsanctioned AI agents on company machines?
When employees run unsanctioned AI agents on company machines, each agent works with that person's permissions, reads whatever they can read, and acts on their behalf. Failure modes include shadow AI (unapproved agents, models, MCP servers and Skills); sign-ins through personal accounts on enterprise machines; and indirect prompt injection, where hidden instructions in files the agent reads get followed as if the user typed them. Backslash security research found that malicious instructions hidden in a repository's AGENTS.md file could trick OpenAI Codex into silently accessing AWS credentials, npm tokens and Git configuration.
| Do this | But watch out for |
|---|---|
| Approve a short list of agents such as Claude Code, Cursor or GitHub Copilot | Every MCP server bolted onto an approved agent widens its reach. Allowlist connectors, not just agents. |
| Let engineers use Agent Skills, the packaged instructions that extend what an agent can do | A Skill is often just a markdown file that can run shell commands with the user's own permissions. Review Skills before sanctioning them. |
| Accept rules files like AGENTS.md or CLAUDE.md, which carry standing instructions an agent reads on every run | Poisoned text in a rules file can steer the agent. Review changes to them. |
| Keep your existing EDR coverage | Endpoint detection and response sees processes and known-bad files, not what an agent was instructed to do, so agentic activity needs its own telemetry and audit trail. |
Which components run on an employee endpoint?
The components that run on an employee endpoint form what Backslash calls the agentic AI fabric: an interconnected layer in which agents, models, MCP servers, Skills, hooks, rules files and connectors interact, so none is secure in isolation. Each runs with the employee's identity, permissions and network access.
| Component | What it is | Why it matters |
|---|---|---|
| Agent | Software that plans and executes multi-step tasks, such as Claude Code, Cursor, Codex or GitHub Copilot | The actor that takes actions; everything else modifies what it can do |
| Model | The LLM the agent reasons with, from a hosted service or a local runtime | Determines where prompts and file contents travel |
| MCP server | A Model Context Protocol connection through which an agent reaches external tools or data sources | Each server is a live path into systems such as ticketing, databases or Git |
| MCP tool | An individual callable action exposed by an MCP server | The real unit of permission; server-level approval hides tool-level reach |
| Agent Skills | Packaged instructions and scripts extending agent capabilities; often just a markdown file | Executes with the user's permissions and is not an application install |
| Hook | A trigger that fires before or after an agent action | Changes behavior without changing the agent itself |
| Rules file | A file like AGENTS.md or CLAUDE.md carrying standing instructions the agent reads every run | Shapes every session; editable by anyone with write access |
| Plugin / connector | Add-ons binding an agent to an IDE or SaaS account | Extends reach into corporate and personal accounts alike |
| Context | Files, repositories, issues and pages the agent reads during a run | Content the agent ingests can carry instructions it then follows |
Why do traditional endpoint and network controls leave a gap for AI agents?
Traditional endpoint and network controls leave a gap because AI agents introduced a layer between the operating system and the network that existing tooling does not observe. EDR sees the process but not the cause: not which prompt, which agent, which Skill or which MCP server produced an action, and without the cause an action cannot be stopped in time. Detections and log routing stop at the process boundary, and MDM does not control what an agent uses or installs, such as Skills.
This layer is what agentic AI endpoint security covers: securing the agents, MCP servers, Skills, rules and hooks that run on an employee's endpoint with that employee's identity and access. Backslash works there, filling a gap EDR does not cover rather than replacing it.
Which control layers can stop an unauthorized agent, and how do they compare?
Several control layers bear on an unauthorized agent on company machines: network-layer traffic inspection, endpoint detection and response, software allowlisting, agentless-only governance, and endpoint-resident control at the agentic layer. They differ in what they see and where they act.
Evaluation criteria:
- Discovery coverage: can the layer enumerate what is installed, including agents, MCP servers, Agent Skills, hooks and rules files.
- Inline prevention: can it stop an action before execution rather than alert after.
- After-the-fact reconstruction: does it retain a trace from prompt through tool call to outcome.
| Control layer | What it sees | Where it fits |
|---|---|---|
| Network-layer traffic inspection | Agent traffic at the network layer | Environments where deploying endpoint software is difficult |
| Endpoint detection and response | The process, not the cause behind it | Malicious processes, files and known-bad behavior |
| Software allowlisting | Which software may run on the endpoint | Stopping software from running at all |
| Agentless-only governance | An inventory, with nothing deployed on the endpoint | Visibility, with policy recorded rather than applied |
| Endpoint-resident agentic-layer control | Which agent, Skill or MCP server caused an action | Blocking risky agent actions inline before execution, with a prompt-to-outcome trace |
Backslash sits in the last row: it pairs agentless discovery with on-host enforcement, so a policy is actually applied rather than only recorded, and it complements EDR and allowlisting rather than replacing them. Latio's evaluation found that "where Backslash stood out in our evaluation is in control depth."
What criteria should a security team use to evaluate an agent control tool?
The criteria a security team applies to an agent control tool are best fixed in writing before the first demo, so every option is measured against the same requirements. A workable checklist covers seven areas:
- Continuous discovery, not a point-in-time scan. The inventory has to reach agents, models, MCP servers, MCP tools, Agent Skills, hooks, rules files such as AGENTS.md or CLAUDE.md, plugins and connectors.
- Risk assessment of what is found. A name in a list is not a verdict; ask what the tool reports about the risk posture of each component it discovers.
- Policy governance. Allowlisting of approved components, denylisting of risky ones, and custom policies that differ for an engineering group and a finance group, enforced continuously.
- Prevention at the moment of action. Ask whether the control can stop a risky action inline, before it executes, or only report it afterward.
- Forensic reconstruction. Investigators and auditors need a retrievable record of what an agent did, not an alert count.
- Coverage of all employees and all endpoints. Developer workstations are the sharpest case, not the boundary; unsanctioned tools and personal-account logins can appear anywhere in the workforce.
- Discovery versus enforcement. Agentless discovery means collecting information without permanently installing software, and it describes discovery only; ask separately how a policy is applied on the host rather than only recorded.
Latio's 2026 AI Security Market Report concludes that Backslash is "one of the most complete options available," with coverage spanning the full agentic surface from Claude Code and Cursor to the MCP servers and Skills running on top of them.
How do you roll out controls for AI agents without blocking legitimate work?
Roll out controls for AI agents on employee machines in stages: discover, assess, govern, enforce inline, then reconstruct. Target all employees and endpoints; developer workstations, perhaps the most sensitive group of users, are a natural first group.
What should the opening sequence look like?
- Discover read-only. Inventory what employees run: agents, models, MCP servers, Skills, hooks, rules files, plugins and connectors. Backslash's free AI Endpoint Exposure Assessment is agentless, read-only and retains no data.
- Assess before you restrict. Review the risk posture of each discovered component before writing policy.
- Publish policy per team. Allowlist approved components, denylist risky ones, and assign different risk profiles to engineering and finance.
- Enforce on the host. Backslash pairs agentless discovery with on-host enforcement, so a policy is actually applied rather than only recorded; risky agent actions are blocked inline before execution, including unauthorized code execution, credential access, privilege escalation, and data sent to unapproved destinations.
- Keep the record. Backslash traces the full path of an agent run from prompt to agent to tool call to outcome, and automatically generates audit evidence for EU AI Act, NIS2, DORA and SOC.
Philip Walsh, Head of Security Engineering at Happy Returns, put the goal this way: "Backslash gave us a live picture of the AI our engineers were already running, and a way to govern it without slowing anyone down."
Frequently Asked Questions
What counts as an unauthorized AI agent running on a company machine?
Two different things get called unauthorized, and they need different controls. The first is shadow AI: AI tools, agents, MCP servers and Skills running inside the organization that security has not approved and cannot see, often installed by an employee under a personal account. The second is a rogue agent: a tool you did approve, taking actions nobody asked for, such as reaching for credentials, escalating privilege or sending data to an unapproved destination.
Why don't EDR and MDM stop unauthorized AI agents?
EDR, or endpoint detection and response, is built to catch malicious processes, files and known-bad behavior on a machine. EDR sees the process but not the cause: not which prompt, agent, Skill or MCP server produced an action. Mobile device management governs devices and installed applications, but a Skill, a hook that fires on an agent action, or a rules file dropped into a user directory is not an application install.
How do we inventory AI agents without installing more software on every endpoint?
Start agentless, collecting information without leaving software permanently installed on the endpoint. Backslash's free AI Endpoint Exposure Assessment, also called Scout, is agentless, read-only and retains no data: a short script distributed through your existing MDM that runs, reports and disappears. Backslash also operates the free Skills Security Scanner, which scans AI agent Skills for security risks, and publishes Claw-Hunter, an open-source tool for discovering and assessing OpenClaw risks.
How does an approved AI agent turn into a risk?
Usually through content it reads. Prompt injection means hidden instructions placed in a file, repository, issue, web page or document that the agent follows as though the user had typed them; the indirect variant matters most on the endpoint, because the agent reaches the poisoned content on its own. Repository configuration is a natural carrier: Backslash security research discovered that malicious repository configurations can redirect Claude Code API requests to an attacker-controlled server, silently exposing the user's sign-in token, allowing attackers to run AI workloads, access profile information, upload files, and initiate sessions under the victim's identity.
About this article
Backslash Security publishes this article under its own name and is responsible for its accuracy. Articles are researched and drafted with AI assistance and approved by Backslash Security before publication; publication and update dates reflect substantive edits, not automated refreshes. Last updated: 2026-11-10