Sysdig Launches Runtime Security Product for AI Agents
Summary
Sysdig announced AI Defense, a runtime security product that inventories AI agents and can alert, block, request approval for, or terminate selected actions while keeping an off-device activity record.
Key points
- Sysdig says AI Defense uses kernel-level monitoring to identify agents, MCP servers, models, and related activity across employee devices and cloud environments.
- Policies can alert on activity, block tool calls, request developer approval, or terminate a process when it starts.
- Sysdig says activity records are stored off-device and can be forwarded to a SIEM; the product is designed to retain evidence for audits.
- By default, Sysdig says the product does not collect prompts or agent replies, and removes file edits and tool results before they leave the machine.
- In a demo, a policy terminated an agent's attempted customer-data upload to transfer[.]sh; this is a vendor demonstration, not an independently reported incident.
- Sysdig says the product can detect activity such as credential dumping, persistence, tunnels, and remote access using its threat-research rules.
Article Details
- Event Type
- Sysdig announced Sysdig AI Defense, a runtime security and governance product for AI agents.
- Impact
- Sysdig says the product can inventory AI agents and related components, associate activity with users and teams, apply runtime policies to agent actions, and retain activity records for investigation and audits. The article describes product capabilities and demonstrations, not a reported security incident.