Is this an agent sandbox?

No. A sandbox constrains what an agent can reach; this records and evaluates what it actually did and what left the device. They solve different halves of the problem, and an organisation running agents seriously ends up wanting both.

Can it stop a runaway agent?

It can refuse an outbound request on an enforceable surface, and it can isolate the device, which cuts all AI traffic within about a minute. It cannot reach into the agent process and halt it mid-loop.

Which agents are covered?

Claude Code is deep capture over OTLP, and Anthropic endpoints are deeply captured through the sensor. Other agents appear in discovery: which device, which destination, how often. The deep-capture set grows vendor by vendor.

What counts as an injected instruction?

Text arriving from outside the operator that reads as a directive to the model: an issue asking it to exfiltrate a file, a page telling it to ignore prior instructions, a tool result carrying a new task. Detection is heuristic, which is why it starts in monitor mode.

Agents /

Nobody watched the hour the agent was running

An agent is a loop: read something, decide, act, repeat. Every input in that loop is text, and text from outside arrives as instruction unless something decides otherwise.

The problem

Delegation is the point. An agent is useful precisely because nobody is reading each step, which is also why nobody notices the step that went wrong until something downstream breaks.

The failure mode is rarely a malicious employee. It is a model that read a page, an issue, a dependency README or a calendar invite carrying instructions, and did what it was told. It had credentials because the task required them.

An hour later the useful question is not whether the agent was compromised in the abstract. It is which files it read, which tools it called, what came back, and what left the machine.

What a run looks like when you can see it

01
The prompt that started it
What was asked, by whom, on which device. The beginning of the chain, and often the only part anyone remembers accurately.
02
Each tool call and its result
In order, with the content of both. A run stops being a black box at exactly the point this sequence is recorded.
03
The content that arrived from outside
Fetched pages, files and tool results are inspected as untrusted input, because they are the vector by which an agent gets new instructions.
04
What left the device
The outbound requests, evaluated against the same guardrails as anything else, on the surface where a request can still be refused or masked.

What you get

A timeline instead of a shrug

The reconstruction an incident review needs, at the point someone asks how a credential reached a log or why a file changed at 2am.

Injected instructions as findings

Instructions arriving inside fetched content are detection content, alertable, and connected to the turns that followed rather than sitting in a separate tool.

Guardrails on the way out

A secret in an agent prompt is caught the same way as a secret in a chat prompt, before the request leaves the device.

A stop button that means something

Isolating the device blocks all AI traffic from it within about a minute, catalog included, until you release it.

What it does not do today

This is not a sandbox. We do not sit between an agent and the filesystem or the shell; that is the job of the agent runtime, and pretending otherwise would be a security claim we cannot keep.
Tool calls are monitor-only. They are emitted mid-stream and can be recorded and alerted on, not refused.
Coverage follows the deep-capture set: Claude Code over OTLP and Anthropic endpoints today. Other agents appear at discovery fidelity.
Detection for injected instructions is young. Run it in monitor mode and measure it before you let it refuse anything.

Frequently asked questions

Is this an agent sandbox?: No. A sandbox constrains what an agent can reach; this records and evaluates what it actually did and what left the device. They solve different halves of the problem, and an organisation running agents seriously ends up wanting both.
Can it stop a runaway agent?: It can refuse an outbound request on an enforceable surface, and it can isolate the device, which cuts all AI traffic within about a minute. It cannot reach into the agent process and halt it mid-loop.
Which agents are covered?: Claude Code is deep capture over OTLP, and Anthropic endpoints are deeply captured through the sensor. Other agents appear in discovery: which device, which destination, how often. The deep-capture set grows vendor by vendor.
What counts as an injected instruction?: Text arriving from outside the operator that reads as a directive to the model: an issue asking it to exfiltrate a file, a page telling it to ignore prior instructions, a tool result carrying a new task. Detection is heuristic, which is why it starts in monitor mode.

Keep reading

MCP security The tools an agent reaches for, and the tokens behind them.
Agentic AI, defined What separates an agent from a chat window.
Shadow AI discovery Which agents are running, and on whose machine.

See it on your own fleet.

One sensor, deployed through your MDM, showing every AI tool in use and what is leaving the device.