Sysdig has made AI Defense generally available. The new solution evaluates every action taken by an AI agent in real time, regardless of the device. The goal is to stop any unwanted agent actions before problems arise. This involves a fair amount of complexity, because agents don’t always walk the talk. That’s why Sysdig compares what the agent says it’s doing with what the kernel actually sees happening.
Sysdig AI Defense evaluates agent actions before they have a direct impact on the IT infrastructure. Based on an organization’s policies, an action is either allowed, submitted for confirmation, or blocked entirely automatically. Like Sysdig Secure, AI Defense is built on the Falco runtime security engine.
Sysdig’s Threat Research Team highlights the risks involved. For example, they recently discovered JADEPUFFER, a ransomware campaign from this summer in which an AI agent carried out the attack independently. The agent was able to resolve a failed login attempt on its own within 31 seconds. Sysdig also deploys agents itself, but on the defensive side. Sage consists of multiple agents that, according to the company, collectively form an AI cloud security analyst.
Kernel as the source of truth
The new AI Defense solution examines agentic actions on two levels. Within the agent, the harness is responsible for control. This is the framework in which the agent runs, typically consisting of a series of instructions in human-readable language and constraints defined by rules. The information from the harness already provides a great deal of context. For example, it shows which tools, MCP servers, skills, and plugins are being called, and with which arguments. At the kernel level, AI Defense maintains a log that cannot be compromised by a rogue or hijacked agent. According to Sysdig, for every action in an agent log, the kernel observes about seven processes.
“An agent may misreport a tool call, but it cannot rewrite its interactions with the system or the outside world,” says founder and CTO Loris Degioanni. If the log and behavior contradict each other, a detection is triggered. Context also plays a role. Reading a credential for a test environment, for example, is noise, Sysdig explains, but reading the production key is quickly classified as an actual incident. Precision in this area is essential to prevent excessive noise from entering the system, with as many automated methods as possible to prevent incidents before a human needs to review the data.
From inventory to AI costs
Teams are kept informed. For example, they receive a live overview of agents in tools such as Claude Code, Codex, GitHub Copilot, and Cursor. Each of these is linked to a responsible person. Policy is managed through templates, based in part on the OWASP Top 10 for LLM Applications. It initially runs in alert mode. Furthermore, the tool records sessions in immutable audit records and links every model call to an agent, team, and person, ensuring there is always a chain of accountable individuals and solutions.