BeyondTrust made AI Agent Security generally available on Oct. 21, a product that checks each action an AI agent tries on a work computer against company policy before it runs. It’s part of the company’s Pathfinder Platform for Windows and macOS.
The identity security company paired the launch with research from Phantom Labs, its research team.
The researchers observed about 1.28 million shell commands requested by AI agents from roughly 132,000 prompts over four weeks, BeyondTrust said. That’s nearly 10 commands per prompt. The company notes these were requested commands, not necessarily ones that ran.
The team also found that 85% of observed coding-agent users had at least one MCP server configured, with an average of 4.35 each. MCP, the Model Context Protocol, is a standard way to connect agents to outside tools and data. The figures come from early customer samples, so they’re BeyondTrust’s own research rather than an independent study.
The problem it targets
BeyondTrust’s product documentation lays out the gap. An AI agent “runs as the signed-in user, with no identity of its own, so an unmonitored agent can take any action its user can,” it says. Cloud services, code repositories and business apps the person signs in to can’t tell the agent’s actions apart from the person’s.
The documentation says agents are often adopted by developers and other teams to move faster, “often without the security team’s knowledge.” It also points to what it calls citizen developers, employees in areas like marketing or finance who build or use AI tools without a security background.
“AI agents are increasingly acting on behalf of employees, often with the same access as the humans using them,” said Marc Maiffret, BeyondTrust’s chief technology officer.
How it works
The product relies on BeyondTrust’s Pathfinder agent, software installed on each computer to monitor and enforce rules. The documentation stresses that this isn’t an AI agent. It then discovers the AI tools running there, such as Claude Code and OpenAI Codex, along with the MCP servers they connect to and the skills they use.
A policy decides what’s blocked, what’s audited, what needs approval and what’s allowed. The key feature is separation: a company can let an employee keep their own access while limiting what their agent may do, and require approval when the agent needs more privilege, according to BeyondTrust.
The company says the tool stops risky actions before they complete, rather than flagging them afterward. It also produces an audit trail that separates human activity from AI activity.
BeyondTrust’s documentation gives an example of the risk. An agent working for a developer can reach the same production systems, credentials and cloud command-line tools that developer can, such as running a cloud command against a live production account.
The documentation also covers hooks for AI coding tools and a set of BeyondTrust-managed policies that customers can start from. BeyondTrust didn’t publish pricing in its announcement.
Source: BeyondTrust, “BeyondTrust announces general availability of AI Agent Security (press release)”
Additional sources: BeyondTrust Docs, BeyondTrust, “AI Agent Security”
