Summary

• Sysdig AI Defense is generally available for macOS and Windows, combining agent activity with operating-system monitoring and policy enforcement.
• In one customer's deployment, Sysdig observed approximately seven underlying processes for every logged agent tool call.
• The platform can alert, require approval, or block selected actions, but its effectiveness depends on monitoring coverage and appropriately configured policies.

Cybersecurity company Sysdig has launched runtime security controls for artificial intelligence agents, allowing organisations to compare what automated systems report doing with the operations their tools actually execute.

Sysdig AI Defense became generally available for macOS and Windows on 4 November, extending the company’s existing monitoring technology towards AI assistants that execute commands, access files, use external services, and interact with production infrastructure.

The platform combines information from an agent’s execution framework with operating-system telemetry, providing a record of tools, processes, credentials, and associated users. Security teams can define policies that permit activities, request confirmation, or intervene when an action exceeds an approved boundary.

The release addresses a developing operational problem: an AI agent may be authorised to complete work on behalf of an employee, but the systems executing that work can have access to considerably more information and infrastructure than the immediate task requires.

Agent logs do not capture every operation

AI agents commonly operate through frameworks that manage language-model requests, tools, and the steps required to complete a task. Those frameworks can record which tools were selected and the arguments passed to them.

However, a single tool call may trigger several operating-system processes. Asking a coding assistant to execute a script can involve a command interpreter, additional utilities, file access, network activity, and other operations that do not appear individually in the agent’s own activity record.

Sysdig’s approach combines those records with lower-level telemetry gathered while the work executes. By observing processes and their interactions with the operating system, the platform is intended to provide additional evidence about actions performed through an agent’s tools.

Research accompanying the launch examined AI agent activity across more than 300 employee devices at one software company during a month-long deployment.

For every tool call recorded in the participating agents’ logs, Sysdig observed approximately seven underlying processes. The company’s research also found that 82% of credential-file reads visible to its operating-system sensor were absent from the agent logs.

These observations illustrate the difference between an application’s record of its requested operations and the more detailed activity visible elsewhere in the system.

However, the figures describe one customer environment. They cannot be generalised into an industry-wide ratio, and the absence of an operation from an agent log does not establish that the activity was malicious.

Agent frameworks are designed for application execution rather than necessarily providing comprehensive forensic records. An operating-system sensor serves a different purpose, and combining both perspectives can give investigators more context than either provides alone.

Security policies move into execution

Sysdig AI Defense is designed to evaluate an agent’s actions against organisational policies, including the resources available through its credentials and the potential consequences of the operation.

A command reading ordinary files in a test environment may be acceptable, while an attempt to retrieve production administrator credentials could require immediate intervention.

Administrators can begin with policies operating in alert mode, gathering information about activity before enabling more restrictive controls.

Once enforcement is configured, the platform can block selected tool calls, pause activity for approval, or terminate processes that trigger relevant rules.

The distinction between those mechanisms is important. Preventing an action before execution differs from stopping a process after it begins, and the effectiveness of either approach depends on the precise activity and monitoring conditions.

Policy enforcement also requires decisions about legitimate work. A rule that prevents every automated file operation could undermine ordinary development or administration, while permissions that are too broad may allow dangerous activity to proceed.

Organisations therefore need to define acceptable access according to the purpose of an agent, the systems involved, and the responsibility of the person authorising the work.

Sysdig’s product also monitors Model Context Protocol servers, skills, plugins, and other extensions used by agent frameworks. These connections can expand the tools and information an agent can access after its initial configuration.

For example, adding a new external tool may introduce access to a database or cloud service that the agent could not previously reach. The resulting change in permissions may be material even when the agent’s original task remains the same.

Employee adoption creates visibility gaps

The early deployment also identified substantial use of AI tools outside conventional software engineering teams, including employees who had installed assistants or connected services independently.

That pattern creates difficulties for organisations relying exclusively on centrally approved applications. Employees may use AI tools to automate tasks involving financial records, internal documents, or operational systems without those connections appearing in established software inventories.

In the company examined by Sysdig, more than 60% of tool calls ran without an individual approving each operation at the point of execution. Some were screened through an agent’s automated permission mechanism, while others operated with interactive prompts disabled.

Such arrangements can be useful for repetitive tasks, but the level of acceptable autonomy depends on what the tools can access and change.

An agent restricted to a development environment presents different risks from one that can alter production infrastructure or retrieve sensitive company information.

Sysdig aims to identify active agents and associate them with the accounts and employees responsible for their use. This inventory can also support expenditure monitoring by connecting model calls and costs to departments and users.

However, complete visibility depends on deployment coverage and access to the relevant telemetry. Monitoring an employee workstation does not automatically provide a complete record of every operation taking place within an unrelated external service.

Evidence supports incident investigation

Runtime monitoring can help security teams reconstruct a sequence of actions when an automated process behaves unexpectedly or an incident affects systems accessed through an AI agent.

Sysdig combines records of the agent’s instructions with information about processes and associated policies, enabling investigators to examine what was attempted, what executed, and which controls were applied.

Loris Degioanni, founder and chief technology officer of Sysdig, described the difference between application logs and execution evidence: “An agent can misreport a tool call, but it can’t rewrite its interactions with the system or the external world”.

Operating-system telemetry can provide evidence independent of an agent’s self-reported history, although the reliability of that evidence still depends on collection, storage, integrity protections, and the completeness of monitoring.

These records may become useful during compliance reviews, particularly where automated systems have access to financial information, customer records, or production technology.

For European organisations, employee monitoring and the collection of activity associated with identifiable users also require attention to privacy, lawful processing, and internal governance.

Technical monitoring cannot replace decisions about which agents should be authorised in the first place. An action may comply with a configured security policy while still producing an incorrect commercial or operational outcome.

Likewise, recording approval does not guarantee that the person providing it had sufficient information to assess the consequences of the proposed action.

Sysdig’s existing cloud security products provide a foundation for monitoring infrastructure, while AI Defense extends the emphasis towards the activity of agents using employee devices and connected systems.

The company describes support for following activity into Linux and Kubernetes environments, although the launch’s explicit general availability statement concerns macOS and Windows. The supported scope of individual integrations should therefore be confirmed for each prospective deployment.

The product introduces additional ways to identify and constrain automated actions, but commercial results will depend on how effectively organisations deploy sensors, configure policies, and investigate the evidence collected.

As AI assistants acquire permission to operate more business systems, those operational controls will become part of the wider question of how organisations delegate work without losing the ability to establish what their software actually did.