Sysdig ships AI Defense to govern AI agent actions
November 5: Help Net Security adds general availability, named coding-agent coverage, a seven-process kernel ratio, and a 31-second JADEPUFFER self-repair claim.
Sysdig AI Defense is generally available, monitoring agent actions and allowing, holding, or blocking them before completion.
Sysdig has made Sysdig AI Defense generally available to govern agentic AI at runtime. It monitors every agent action from origin to completion on endpoints and in cloud environments at the kernel level, and can allow, hold for human review, or block risky actions before they finish. Agents can be traced to an accountable human, with a live inventory of agents and models and immutable audit logs the agent cannot change. Policies start in alert mode and can later move to enforcement, including templates mapped to frameworks such as the OWASP Top 10 for LLM Applications. Sysdig says coverage includes Claude Code, Codex, GitHub Copilot, and Cursor, and that the product complements existing endpoint and red-team tools.
- Generally available for endpoints and cloud environments.
- Can allow, hold, or block an action before completion.
- Kernel monitoring; Sysdig says about seven processes per logged action.
- Immutable audit logs; agents traced to an accountable human.
- Policies start in alert mode and can move to enforcement.
- Named coverage includes Claude Code, Codex, GitHub Copilot, and Cursor.
What each outlet adds
beyond the shared facts- SecurityWeekHuman accountability, live inventory, and OWASP-mapped policy templates.
- Help Net SecurityGeneral availability, named platforms, process ratio, and JADEPUFFER claim.
- Vendors
- Sysdig
- Products
- AI DefenseSysdig AI Defense
- Malware
- JADEPUFFER
Coverage
oldest first · one row per article · UTCSysdig adds runtime security and governance for AI agents
Sysdig AI Defense monitors every action an AI agent takes and blocks risky ones in real time before completion.
Sysdig AI Defense adds runtime guardrails for AI agents
It can allow, hold, or block an agent action before it finishes and keeps a kernel record the agent cannot change.