The Field Guide

AI Agent Security

AI agent security is the practice of knowing — and controlling — what every AI agent on your machine can actually reach. Not what it's supposed to do. What it can do: the secrets it can read, the files it can write, the MCP servers and skills it pulls in, the network it can call, the schedule it runs on, the prompts that can redirect it, and the paths from one agent into another.

An AI coding agent isn't one program. It's a process with your shell environment, your API keys, your repo, a stack of installed extensions, and a model that will do what it's convincingly asked to do. That's a large reach, assembled quietly, mostly invisible to you.

This is the field guide to that reach. Start with the surfaces below, then go as deep as you need.

Permissions Supply chain Egress Schedule Cross-agent Prompt injection Secret Key Secrets — free in Dryx

The seven surfaces every AI agent on your Mac touches. The copper path is one blast radius: a secret an agent can read, plus a route off the machine.

Why now

Why this is a category now, and wasn't two years ago

For decades, security assumed one enforcer watching one process from the outside. AI agents broke that. An agent asked politely to do something harmful will usually do it. An agent told to ignore its own guardrails often will. And the tool watching from outside can't see what's happening inside the agent's reasoning.

The market noticed the same week the breaches did. In 2026, Palo Alto Networks acquired Koi — naming the category Agentic Endpoint Security — for roughly $400M, a deal that closed in April 2026, aimed at the cloud and the enterprise endpoint.1 Security researchers reported around 200,000 MCP servers exposing remote code execution; the vendor confirmed it was by-design and declined to patch.2 A supply-chain breach turned a single over-broad OAuth grant into a master key.3

What's still missing is the seat below all of that: the developer workstation, offline, where the agent actually runs. That's the gap this guide is about.

The surfaces

The seven surfaces of agent exposure

Every AI agent on your machine touches the same seven surfaces. Map them and you've mapped your blast radius.

01 Secrets Free

The API keys, tokens, and credentials in your environment and config files that an agent can read.

02 Permissions

What the agent is allowed to write, run, and delete; the scopes it was granted and never gave back.

03 Supply chain

The MCP servers, skills, and extensions it pulls in, and who actually published them.

04 Egress

Where it can send data: which endpoints, which domains, over which protocol.

05 Schedule

What runs unattended, on a cron or a hook, when you're not watching.

06 Prompt injection

The path where text the agent reads becomes instructions the agent follows.

07 Cross-agent

The routes from one agent into another, where one agent's reach quietly becomes another's.

Dryx compiles all seven into one signed picture, then scores it. Provenance and risk are two different axes: a trusted publisher can still hold a live token and be your top finding. 'Trusted' is not 'safe.'
How it differs

Why app security and cloud security don't cover this

App security

App security asks: is this binary safe to run? It signs and sandboxes the program. But your agent is signed and sandboxed — and then it reads a poisoned README and exfiltrates a key. The danger isn't the binary. It's what the trusted binary was talked into doing.

Cloud posture management

Cloud posture management asks: are my cloud resources configured correctly? Useful — but it watches the cloud, not the laptop where the agent reads your .env and spawns an MCP server at 2am. The agent's real reach lives on the workstation.

AI agent security

AI agent security sits between them, at the action boundary, where the agent actually acts. The defense isn't one wall — it's three independent roles that have to agree: Operator + Agent + Authority Anchor. Any one can be fooled; the other two still come back with the right answer. That's the AI Security Triad, and it's the frame the rest of this guide builds on.

Read the frame: The AI Security Triad →  ·  See the mechanism: the gate reads the action, not the argument →

Read the guides

Start with the question you came with

Three guides, written answer-first. Each one teaches the surface, then shows you where to see it on your own machine.

Coming next

Clusters to build next

Planned spokes off this guide, in rough build priority — each one maps to a surface or a term in the Dryx vocabulary, so the set covers the whole picture.

  1. 01 What is the Authority Anchor MCP? The 7 tools your agent can callThe agent-visible dryx-authority-anchor server and its seven read-only tools: get_overview, get_posture, list_findings, analyze_skill_or_mcp, check_mcp_server, check_action_allowed, report_reasoning.
  2. 02 Ghost Agents: orphaned AI configs still holding access on your MacAgents and configs you forgot you installed that still hold scopes and secrets.
  3. 03 Over-permissioned AI agents: the OAuth scopes you never gave backThe Permissions surface; the over-broad-grant-becomes-master-key story; how to audit accumulated scope.
  4. 04 Agent egress: where can your AI agent send your data?The Egress surface; verifying offline-ness with Little Snitch / loopback-only IPC; what 'your workspace never leaves your machine' actually means.
  5. 05 Cross-agent exposure: when one AI agent becomes a path into anotherThe Cross-Agent surface; how reach chains across Claude Code, Cursor, Codex and shared MCP servers.
  6. 06 What runs when you're not watching: AI agent schedules, hooks, and cronThe Schedule surface; unattended execution as exposure; what Action Guard observes.
  7. 07 Action Guard explained: Off, Observe, EnforceThe three Action Guard states; what each does; the honest scope (Enforce is direct-download-only / notarized helper; Mac App Store users get the taught reflex plus passive monitoring).
  8. 08 Deterministic vs. probabilistic: why an AI safety layer can't be ground truthWhy the Authority Anchor must be deterministic and offline; covers more, never thinks more.
  9. 09 AI agent security vs. EDR, CSPM, and LLM guardrailsA comparison cluster; the open developer-workstation seat below Agentic Endpoint Security. See Compare.

Coming soon. Each becomes a spoke off this guide — answer-first, dated, and linked back here.

Sources

  1. Palo Alto Networks' acquisition of Koi, naming the "Agentic Endpoint Security" category, announced in 2026 and closed April 2026.
  2. Security researchers reported large numbers of MCP servers exposing remote code execution; the vendor characterized the behavior as by-design. Reported industry event.
  3. A supply-chain breach in which an over-broad OAuth grant functioned as a master key. Reported industry event.

Reading about exposure is one thing.

Dryx inspects the AI agents already on your Mac and shows you the picture — secrets first, free. No dashboard to read. No alert to triage. The reach is just on the screen.