Sysdig's AI Defense Watches What Your Agents Actually Execute

> Sysdig says AI Defense is generally available for macOS and Windows as of November 4, giving security teams a way to watch what AI agents do and step in when they cross a line. The runtime security and governance product inspects agent behavior from the employee workstation all the way to the cloud resources those agents can reach with borrowed credentials.

AI agents stopped just answering questions a while ago. A coding agent now reads files, calls tools, spins up processes and rewrites infrastructure — sometimes all from one logged action. Sysdig's pitch is that a single tool call in the agent's own log can hide a lot: the company says it observed roughly seven underlying processes for each action it recorded, a company finding rather than a universal ratio.

The product works on two fronts. Instrumentation inside the agent's harness — the framework running it — captures calls to tools, Model Context Protocol servers, skills and plugins, arguments and targets included. Operating-system telemetry then supplies a separate record of the processes those calls actually produce. That split matters when an agent's account is incomplete or has been compromised, or when a connection or skill gets added mid-session and quietly widens what the agent can do.

Context and authority get layered on top. Reading a file is one thing if the credential behind it touches a test box and quite another if it administers production. AI Defense builds an action graph tying the event sequence to the accountable person, the agent's stated task and the resources in reach. Policies can start in alert mode, then move to enforcement — blocking unvetted tools and connections, stopping risky credential access, holding an action for human approval or terminating a process that slipped past an earlier control.

Sysdig ties the launch to its cloud-native runtime security pedigree and to Falco, the open-source project it originally created. Falco's documented job is watching Linux kernel events and plugin sources, enriching them with container and Kubernetes context, then firing rules into alerts. That heritage explains the emphasis on observed execution over an AI's own narrative — though Falco itself shouldn't be confused with the commercial blocking and governance features in AI Defense.

The release names Claude Code, Codex, GitHub Copilot and Cursor as environments it wants to inventory and trace back to a human owner, and ships policy templates mapped to the OWASP Top 10 for LLM Applications with developer exception paths. Session records show which policy applied, what was allowed or blocked and who signed off on an exception — no post-incident archaeology required. Sysdig also says the product links model calls to the agent, team and person responsible, even when traffic skips a centralized AI gateway, which could help separate pricey model use on routine chores from work that deserves something beefier.