BeyondTrust announces general availability of AI Agent Security

BeyondTrust has announced the general availability of AI Agent Security on the BeyondTrust Pathfinder Platform, alongside new research from BeyondTrust Phantom Labs revealing the scale of AI agent activity and the expanding connections these agents introduce across enterprise endpoints.

Drawing on endpoint telemetry from our True Privilege Graph, Phantom Labs research revealed:

Nearly 10 shell commands requested per prompt. AI coding agents requested approximately 1.28 million shell commands from 132,000 prompts, demonstrating how a single prompt can translate into multiple downstream command requests. This highlights the lack of a direct correspondence between prompt and subsequent command execution. Should an agent attempt to go beyond the intended scope of a prompt, observability and policy enforcement are essential to preventing and mitigating potential security incidents.

85% of observed coding-agent users had MCP server connections. Among users with coding agents configured, 85% had at least one MCP server configured, averaging 4.35 unique servers per connected user, with one user connected to 36. These connections extend an agent’s reach, potentially allowing it to act across multiple platforms with delegated use access. This expands the attack surface because adversaries that can gain access to a user’s AI account may be able to act as that user across connected platforms without obtaining separate credentials. When invoked, MCP servers can receive user prompts and influence agent behaviour through their responses. Without visibility into MCP activity, these connections introduce privacy and compliance risks and create opportunities for malicious servers to exfiltrate sensitive data or manipulate agent actions.

About half of agent skill installs arrive bundled in code repositories. In a mid-sized enterprise environment where 60% of AI-active devices ran a coding agent, a typical user with agent skills had approximately two dozen installed, and at least one in seven installed skills was used within four weeks. Agent skills not only influence prompt input and output, but also often contain embedded code. As adversaries actively distribute and poison legitimate skills, organisations without the ability to audit and enforce skill policy may be ceding unknown control over to unapproved and/or compromised skills.

BeyondTrust’s newest release, AI Agent Security, addresses these challenges by distinguishing AI agent activity from human activity and enforcing what agents are permitted to do at runtime, before unauthorised actions occur, without restricting the permissions employees need to perform their jobs.

“AI agents are increasingly acting on behalf of employees, often with the same access as the humans using them,” said Marc Maiffret, CTO, BeyondTrust. “That dramatically expands who and what can exercise privilege, and when those agents operate autonomously and at machine speed, organisations need to control that privilege before an action is taken. AI Agent Security separates what the human is permitted to do from what the AI agent is permitted to do, so organisations can embrace the power of AI without assuming that everything a human is permitted to do should also be permitted for their AI agent.”

Controlling AI agents before they act

AI Agent Security applies BeyondTrust’s Visibility, Intelligence, and Protection framework to agentic AI on the endpoint, giving security teams the context and control to govern AI agents without limiting the access employees need to do their jobs. Rather than relying solely on blocking known commands or detecting risky behaviour after it occurs, BeyondTrust evaluates individual AI agent actions against policy at runtime to determine what an AI agent is permitted to do before an action is taken.

Visibility: Discover AI agents operating across endpoints, including frontier AI tools, internally hosted models, shadow AI, and ephemeral sub-agents, providing a fleet-wide inventory of agentic AI activity.
Intelligence: Distinguish human activity from AI agent activity and capture the context behind agent actions, including the human owner, device, agent session, skills, and MCP activity.
Protection: Enforce policy at runtime across agent actions, providing secure, approved paths to task completion and invoking just-in-time or human approval when additional privilege is required.