For most of the past two years, the pitch for AI agents was about what they could do: write the code, file the ticket, book the meeting, clear the inbox. This week the pitch changed. Within a single day, 21 October 2026, three of the biggest names in security and computing announced products built around one idea: agents need a leash, and it has to be built into the software, the endpoint and even the chip.
NVIDIA launched the OpenShell Reference Architecture at GTC Berlin. SentinelOne unveiled Singularity Agentic Detection and Response (ADR) at its OneCon conference. BeyondTrust made its AI Agent Security product generally available and published endpoint research showing how far agents already reach inside companies. Put them side by side and you get a fairly clear picture of where agent deployment is headed, and what you should be doing about it right now, even if you only run a single coding agent on your laptop.
Why agent security suddenly became the main story
The core problem is simple. A chatbot answers a question. An agent acts. It runs shell commands, calls tools, connects to services through MCP (Model Context Protocol) servers, and installs “skills” that bundle prompts and code. Every one of those connections is borrowed authority. When the agent can act as you across your email, repos and cloud console, anyone who can steer the agent can effectively act as you, too.
BeyondTrust’s Phantom Labs research puts numbers to this. Over four weeks of endpoint telemetry, the team observed about 1.28 million shell commands requested from roughly 132,000 prompts, which works out to nearly 10 commands per prompt. In other words, one sentence typed by a human can fan out into a whole script’s worth of actions that the human never reads.
The research also found that 85% of observed coding-agent users had at least one MCP server configured, averaging 4.35 servers per connected user, with one user connected to 36. And in a mid-sized enterprise environment, about half of agent skill installs arrived bundled inside code repositories. That last point matters: you can pick up an agent skill, with embedded code, simply by cloning a project.
NVIDIA wants the guardrails in silicon
NVIDIA’s answer is the most ambitious, because it spans the entire stack. The OpenShell Reference Architecture builds on NVIDIA’s open-source OpenShell secure runtime and pairs it with three layers of hardware: Vera Rubin systems for model inference, Vera CPUs for running agent harnesses and tool use, and BlueField-4 DPUs running a security framework called NVIDIA Sentry.
The interesting part is Sentry. According to NVIDIA, it monitors agent behavior out of band, from a separate processor, and enforces policy “in silicon.” If an agent tries to move outside its software boundary, NVIDIA says Sentry quarantines and stops it in milliseconds. Jensen Huang summed up the design as agents that “think on Rubin, act on Vera and be governed on BlueField.”
The partner list is long. NVIDIA says model builders including Anthropic, Google, Meta, OpenAI and Perplexity can run agents on OpenShell infrastructure, and that security vendors such as 1Password, CrowdStrike, Okta, Palo Alto Networks and Zscaler are integrating support. ServiceNow announced general availability of ServiceNow Arc, a long-running personal agent whose actions are enforced by OpenShell. NVIDIA says the reference architecture is available now.
For most readers, the takeaway isn’t to go buy a BlueField DPU. It’s that the industry’s biggest infrastructure company now treats “contain the agent” as a first-class hardware requirement, not an afterthought.
SentinelOne treats agents like a new kind of endpoint
SentinelOne’s Singularity ADR comes at the problem from the security operations side. Its pitch is that you can’t govern what you can’t see, so the product starts with an inventory of every agent, tool, skill, connector and MCP server across endpoints, SaaS and cloud, sanctioned or not, along with the permissions each one holds.
From there it layers on the things security teams already expect for laptops and servers: allow and block policies, approval workflows for high-risk tools, and in-line prevention aimed at prompt injection, jailbreaks, credential exfiltration and tool poisoning. Two features stand out. “Intent drift detection” flags the gap between what an agent was asked to do and what it actually did. “Agent containment” can stop one agent mid-action while the rest of a workflow keeps running.
SentinelOne says coverage extends beyond MCP gateways into Salesforce Agentforce, Microsoft Copilot Studio, OpenAI ChatGPT workspace agents and Anthropic Claude managed agents. The product is available now in early access.
BeyondTrust splits agent privileges from human ones
BeyondTrust’s angle is privilege. Its AI Agent Security product, now generally available on the Pathfinder Platform for Windows and macOS, is designed to control individual agent actions without restricting the same actions for the human user. Your developer can still run a risky command by hand; the coding agent acting on their behalf may not.
That distinction sounds subtle, but it addresses one of the biggest headaches in agent deployment. Today, most agents simply inherit their user’s full permissions. Treating the agent as its own identity, with its own narrower rights, is the same principle of least privilege that security teams have pushed for human accounts for decades.
What all three agree on
Read the three announcements together and the consensus is striking:
- Visibility first. Every vendor starts with discovering which agents, MCP servers and skills exist. Shadow agents are now treated the way shadow IT was a decade ago.
- Agents are separate identities. An agent should not silently inherit everything its user can do.
- Enforcement happens at runtime. Reviewing a policy document isn’t enough; something has to watch actions as they happen and be able to stop them.
- The intent gap is the real risk. The dangerous moment is when an agent’s actions drift from what the human asked for, whether because of a bug, a poisoned tool or an injected instruction.
The practical takeaway: a 15-minute agent audit
You don’t need an enterprise contract to apply these lessons. If you use Claude Code, Codex, Cursor or any agent with tool access, try this checklist today:
- List your MCP servers. Open your agent’s config and count them. Remove any you don’t recognize or haven’t used in a month. BeyondTrust’s average was more than four per user; fewer is safer.
- Check where your skills came from. Look for skill or rules folders inside repos you’ve cloned. Read any that contain scripts before letting an agent load them.
- Turn on command approval. Most coding agents let you require confirmation for shell commands, at least for anything that deletes files, pushes code or touches the network. With roughly 10 commands per prompt in the wild, auto-approve-everything is a real exposure.
- Give agents their own, narrower credentials. Use scoped API tokens with read-only access where possible, rather than your personal admin keys.
- Sandbox risky work. Run experimental agents in a container, VM or separate machine, so a bad action hits a disposable environment instead of your main one.
- Keep logs. Save agent session logs, so if something odd happens you can reconstruct what was asked versus what was done.
The agent era isn’t slowing down. But this week made it clear that the next phase is about trust, not just capability. The companies building the plumbing have decided agents need boundaries. It’s worth drawing a few of your own.
Related on powerhumans: how to build your own AI agent with n8n · create an AI agent without code · why humans must stay in control of high-stakes AI
Update, 24 October: The same tension is now playing out in open-weight models. Read how Kimi K3.1 Pro’s makers removed cyber-related training data before its open release.
Update, 25 October: The labs are now leashing their own models too. Read why OpenAI now trains its AI models with no internet access after one slipped online through a DNS loophole.
Leave a Reply