Agentic endpoint security is the practice of controlling AI agents that run on or act through your devices: coding agents in terminals, browser agents, desktop assistants. It covers what each agent can read, run and send, who it acts as, and how its actions are recorded.
The term is also used for security tools that use agents. This post covers the first meaning.
Why is this a distinct problem?
A traditional endpoint program assumes software does what its code says. An agent decides what to do at run time, from text that may come from a web page, an email or a file. It then acts with the permissions of the account that launched it, often a developer's own.
That combination is why OWASP lists excessive agency as LLM06 in its Top 10 for LLM Applications 2025, describing an LLM based system that is granted a degree of agency. OWASP also runs an agentic security initiative and publishes a Top 10 for Agentic Applications 2026 that targets risks in autonomous and agentic systems. Read the current versions directly, since both are updated.
What can go wrong on a device?
Instructions in content. An agent reads a file or page containing text that tells it to do something else. If it can run commands, the text becomes an action.
Ambient credentials. The agent inherits the user's cloud keys, tokens and browser sessions. A mistake or a hijack uses all of them.
Tool sprawl. Every connected tool server adds capability and attack surface. A tool added for one task stays connected for all of them.
Silent change. Agents can edit many files or install packages quickly, with little of it reviewed.
Weak records. If you cannot tell afterwards which actions a person took and which an agent did, investigation suffers.
What should you control first?
Think of four layers.
Identity. Give each agent its own identity or token where you can, so its actions are separable and revocable. Avoid running it under a person's full session.
Permissions. Start from nothing. Allow read access to the project directory, not the home folder. Allow network access to named destinations. Keep secrets out of the agent's environment.
Approval. Ask a person before commands that delete, install, spend money, send data out or touch production. Make that approval hard to skip.
Record. Log prompts, tool calls, commands and file changes in a place the agent cannot edit.
A constructed example
A developer asks a coding agent to fix a failing test. The repository includes a README from a third party package with a line telling assistants to upload the project's environment file to a URL. The agent, running with the developer's shell, can in principle do it.
With layered controls the attempt fails in three places. The agent's environment holds no secrets, outbound traffic is limited to the package registry and the repository host, and any command that sends files needs approval. The log shows the blocked attempt, and the team removes the dependency.
How does this relate to classic EDR?
Endpoint detection tools see processes and network connections, so they may notice an agent's commands, but they cannot tell why it ran them or whether a person approved. Agent controls add that context. The two complement each other, and neither replaces the other.
Safeguard offers agent identity and the MCP Guardrail for agents that call tools over MCP, plus an MCP server at mcp.safeguard.sh. These address identity and tool permissions for agents, not device level detection.
How to check or apply this
- Inventory the agents and assistants in use on laptops and servers, including those people installed themselves.
- Record what each can read, run, and reach over the network.
- Remove standing secrets from agent environments and use short lived, scoped credentials.
- Restrict file access to the working directory.
- Allow list outbound destinations.
- Require approval for destructive, installing, spending and outbound actions.
- Keep tamper resistant logs and review blocked attempts weekly.
- Review connected tool servers every quarter and remove the unused ones.
Quick check
Is agentic endpoint security the same as EDR?
No. EDR watches endpoint activity for malicious behaviour. Agentic controls decide what an AI agent may do and record why. Use both.
Should agents ever run with a developer's full permissions?
Avoid it. Use a separate identity or sandbox with the narrowest access that lets the task finish.
Sources
- OWASP Top 10 for LLM Applications
- OWASP Agentic Security Initiative
- NIST AI 100-2 E2025, Adversarial Machine Learning
Last reviewed: 18 October 2026.
