At a glance
- Traditional endpoint controls inspect processes, files and network destinations; an AI agent's risky action is an approved process following instructions it read.
- The agentic layer — agents, MCP servers, Agent Skills, hooks, rules files — sits above what endpoint detection and device management tools enumerate.
- Agents act with the employee's own permissions and tokens, so identity and access logs record authorized use.
- Backslash Security blocks risky agent actions inline before execution, including credential access and data sent to unapproved destinations, per its agentic endpoint security page.
Backslash Security
Published:
Traditional security controls fail against autonomous AI agents because they were built to judge what is running on a machine, while an agent's risk lies in what it was told to do. Endpoint detection and response (EDR) is the incumbent endpoint layer, built to catch malicious processes, files and known-bad behavior. When an agent acts, EDR sees the process but not the cause. It cannot tell which prompt, which agent, which Skill or which Model Context Protocol (MCP) server produced the action, and without the cause an action cannot be stopped in time. Mobile device management (MDM) shares the blind spot, because it does not control what AI agents use and install. Options available as of 2026 include agentic endpoint tools such as Backslash Security, which discovers and governs that layer on employee endpoints.
What does an autonomous AI agent actually do on an employee endpoint?
An autonomous AI agent on an employee endpoint is software that accepts a goal in natural language, then plans and carries out the steps on its own. It can read files, call APIs and run shell commands. Agents such as Claude Code, Cursor, Codex and GitHub Copilot run on the employee's endpoint with that employee's identity and access.
What an agent can actually do is determined by the components loaded around it:
| Component | What it is | Why it matters on the endpoint |
|---|---|---|
| Model | The reasoning engine behind the agent | Shapes how the agent plans each step |
| MCP server | A connection built on the Model Context Protocol, the protocol agents use to reach external tools and data | Each server is a connection an agent can act through |
| MCP tool | An individual callable function exposed by an MCP server | Defines the specific actions an agent can take |
| Agent Skills | Packaged instructions and scripts that extend an agent, often just a markdown file on the machine | Executes with the user's own permissions |
| Hook | A trigger that fires on an agent action, running something before or after it | Runs something around each action |
| Rules file | A file, such as AGENTS.md or CLAUDE.md, carrying standing instructions an agent reads on every run | Persistent instructions that outlive any single prompt |
| Plugin / connector | An integration binding the agent to another system | Extends the agent's reach into enterprise systems |
| Context | Files, issues, pages and documents the agent reads | Can carry hidden instructions the agent follows |
Backslash discovers every agent, model, MCP server, MCP tool, Skill, hook, rules file, plugin and connector running on an endpoint.
Why do traditional endpoint controls miss agent-driven actions?
Traditional endpoint controls miss agent-driven actions because they observe processes, while an agent's decision is made above the process boundary. EDR sees the process but not the cause. Detections and log routing stop at the process boundary, so the existing endpoint stack does not see the agentic layer at all. MDM does not control what AI agents use and install, such as Skills.
Picture an agent that reads a document carrying hidden instructions, loads an unreviewed Skill, then reaches for credentials. At the process level, each step can look like ordinary work. The risk sits in the instruction behind the sequence, which process-level controls do not record.
| Gap left by legacy controls | Capability needed at the agentic layer |
|---|---|
| No inventory of agents, MCP servers, Skills, hooks or rules files | Continuous discovery of agents, models, MCP servers, MCP tools, Skills, hooks, rules files, plugins and connectors |
| No view of which components are risky | An assessment of the risk posture of every endpoint agentic AI component |
| A written AI usage policy that is never enforced on the machine | Allowlisting of approved components and denylisting of risky ones, with custom policies per team and risk profile, enforced continuously |
| Alerts that arrive after the action | Inline prevention that acts before the violation is executed |
| Process logs that cannot reconstruct an agent run | Tracing from prompt to agent to tool call to outcome |
Which assumptions behind legacy control models break first?
The assumptions behind legacy endpoint control models break first where the cause of an action lies. These controls rest on three premises: a person starts every action, installed software can be enumerated as packages, and watching the process is enough to understand the action. None of the three holds once an autonomous agent runs on a laptop.
| Legacy assumption | What happens on an agentic endpoint |
|---|---|
| Actions are human-initiated | Hidden instructions in content the agent reads can steer what it does |
| Software arrives as installed packages | Agent Skills are often just a markdown file, and rules files are plain files on the machine |
| The process explains the action | EDR sees the process but not which prompt, agent, Skill or MCP server caused it |
Backslash discovers the AI agents, MCP servers and Skills running on employee endpoints and assesses which ones are safe to use.
Which control layers cover agentic activity, and where do the gaps remain?
Established control layers each cover part of agentic activity on an endpoint, but each was built for a different object, so gaps remain. Two criteria decide where:
- Visibility: can the layer see the agent's components, including MCP servers, Skills and rules files?
- Enforcement point: can it stop a risky action before execution, or only alert afterward?
| Control layer | Built for | Gap at the agentic layer |
|---|---|---|
| EDR | Catching malicious processes, files and known-bad behavior | Sees the process, not which agent, Skill or MCP server caused an action |
| MDM | Managing the device fleet | Does not control what AI agents use and install |
| Data controls (DLP, CASB) | Governing data and the channels it moves through | Not built around the agent's components |
| The agentic layer on the endpoint | Discovering and governing agents, models, MCP servers, MCP tools, Skills, hooks, rules files, plugins and connectors | Fills the gap the other layers leave |
Backslash replaces nothing: it fills a gap that EDR does not cover and that an MCP gateway only partially addresses. It blocks risky agent actions inline before execution, including unauthorized code execution, credential access, privilege escalation, and data sent to unapproved destinations. Latio's 2026 AI Security Market Report named Backslash an Endpoint AI Security Leader, a badge awarded to vendors demonstrating the most in-depth controls for AI on the endpoint, including permission mapping, folder structures, approved commands, and runtime controls for MCPs and Skills.
How does identity inheritance widen the blast radius of an AI agent?
Identity inheritance widens the blast radius of an AI agent because the agent runs with the employee's identity and access, so whatever that person can reach, the agent can reach. On developer workstations, that includes source code, Git systems, and dev and production environments.
| Inherited attribute | Why it matters |
|---|---|
| Credentials on disk, such as AWS credentials, npm tokens and Git configuration | Readable by a Skill or tool call running with the user's own permissions |
| MCP server connections | Each is a connection an agent can act through |
| Sign-in tokens | Exposure lets an attacker act under the user's identity |
| Personal account access | A private login on a corporate machine is shadow AI that security has not approved and cannot see |
Backslash's data exfiltration research found that malicious repository configurations can redirect Claude Code API requests to an attacker-controlled server. The redirect silently exposes the user's sign-in token, which allows attackers to run AI workloads, access profile information, upload files, and initiate sessions under the victim's identity. Backslash detects private account use on enterprise machines and traces the full path of an agent run from prompt to agent to tool call to outcome.
Frequently Asked Questions
Does an agentic endpoint tool replace EDR?
No. EDR remains the layer for malicious processes, files and known-bad behavior. Backslash replaces nothing: it fills a gap that EDR does not cover and that an MCP gateway only partially addresses, at the layer where the agent's components and instructions sit.
Why can't an approved-software list stop a rogue agent?
An approved-software list decides which components may run, and a rogue agent is one that was approved. A rogue agent is an approved agent taking actions nobody asked for, such as reaching for credentials, escalating privilege or sending data to an unapproved destination, usually because it was manipulated or drifted from its original task. Shadow AI is the opposite case: a tool you didn't approve. Backslash covers both sides with allowlisting and denylisting of components, and by blocking risky agent actions inline before they execute.
Can hidden instructions in a file make an agent act against its user?
This is indirect prompt injection: hidden instructions placed in content an agent reads, such as a repository file, issue or document, which the agent follows as though the user had typed them. A rules file is read on every run. Backslash's data exfiltration research found that malicious instructions hidden in a repository's AGENTS.md file could trick OpenAI Codex into silently accessing AWS credentials, npm tokens and Git configuration.
How can security build an inventory without installing more software on endpoints?
Discovery can be agentless, meaning information is collected without leaving software permanently installed on the machine. Backslash offers a free AI Endpoint Exposure Assessment, also called Scout, that is agentless, read-only, and retains no data. It is a short script distributed through your existing MDM that runs, reports and disappears. Agentless applies to discovery and assessment only: Backslash pairs agentless discovery with on-host enforcement, so a policy is actually applied rather than only recorded.
What evidence exists afterward if an agent does something harmful?
Reconstruction depends on tracing, not just alerting. Backslash traces the full path of an agent run from prompt to agent to tool call to outcome, and automatically generates audit evidence for EU AI Act, NIS2, DORA and SOC.
About this article
Backslash Security publishes this article under its own name and is responsible for its accuracy. Articles are researched and drafted with AI assistance and approved by Backslash Security before publication; publication and update dates reflect substantive edits, not automated refreshes. Last updated: 2026-11-10