# Sysdig AI Defense: Runtime Security for Coding Agents, MCP and Tool Calls

Sysdig's new product checks agent actions against company policy and keeps records outside the agent. Its early findings also show why a tool-call log is only part of the picture.

By Paras Madan | 2026-11-05


Sysdig made AI Defense generally available on November 4, with macOS and Windows availability named in its launch announcement. The product brings runtime monitoring and policy enforcement to AI agents, including coding tools that read local files, run commands and use a person's cloud credentials.

The important shift is where the check happens. A company can approve a coding assistant and still need to decide whether a particular upload, credential read or infrastructure change should proceed. Sysdig is trying to put that decision closer to the action.

## What Sysdig AI Defense does

The [launch announcement](https://www.sysdig.com/press-releases/sysdig-launches-sysdig-ai-defense-bringing-runtime-security-to-every-action-ai-agents-take) describes a combination of operating-system telemetry and instrumentation inside the agent's harness. The system connects observed activity with the tools, arguments, targets and identity involved in a session.

Sysdig names Claude Code, Codex, Cursor and GitHub Copilot among the supported agent platforms. Its inventory also covers MCP servers, skills and plugins, including tools installed outside an organization's approved setup.

For a security team, those connections are the useful part. A process name alone may not explain why a file was opened. An agent's explanation may not show everything the process did. Comparing the two can make an investigation more specific than either record on its own.

## Confirming, blocking and stopping actions

Sysdig's [product explanation](https://www.sysdig.com/blog/introducing-sysdig-ai-defense) distinguishes three enforcement responses. Confirm asks the developer to approve a tool call. Block refuses the call before it runs. Kill process terminates a process when it starts.

Those controls operate at different points. Stopping a tool call before execution and terminating an already-starting process should not be treated as the same guarantee. A pilot should check which response applies to each action, including work that launches additional processes.

Sysdig says policies can begin in alert mode before a team enables enforcement. That creates room to find rules that interrupt legitimate work, but it also means observing an event is different from preventing it.

A practical first policy might cover an unapproved destination for a file upload. Test both the prohibited case and a legitimate transfer, then check what the developer sees, how an exception is requested and what evidence remains. These are evaluation steps, not tests performed for this article.

## What the early deployment actually shows

Sysdig's [early-access report](https://www.sysdig.com/blog/a-first-look-under-the-hood-of-ai-agents) describes one software company's activity over one month. It reports seven kernel-observed processes for every tool call recorded by the agents, and says agent logs lacked an entry for 82% of observed credential-file reads.

The seven-to-one ratio does not mean seven malicious actions occurred for every tool call. A single call can start several processes. It shows that the two records describe different levels of activity.

The launch blog says this deployment covered about 300 machines and kept every policy in alert mode throughout the month. The results are therefore evidence about visibility in one organization, not a measured prevention rate or a representative survey of all companies using agents.

That distinction matters when evaluating security products. Discovering more activity is valuable, but buyers still need to establish whether the right actions are stopped without making ordinary work impractical.

## Privacy, access and rollout questions

Sysdig says prompts and agent replies are not collected by default, while file edits and tool results are removed before data leaves the machine. Activity records go to the customer's Sysdig tenant in the selected region. This is not a claim that no telemetry leaves the device.

The [product page](https://www.sysdig.com/platform/ai-defense) also describes spending attribution by team and person, and records of policies and approvals. Those records deserve their own access controls and retention decisions, because an audit trail can reveal how people and systems work even without full conversation text.

The launch offers a 14-day trial. Before a rollout, confirm coverage for the actual operating systems, agent versions and remote environments in use, then agree on ownership of alerts and exceptions.

The useful outcome is a dependable account of what an agent did and a tested way to stop the actions a company has ruled out. That requires clear policies and realistic evaluation alongside the monitoring software.

I'm Paras. I work at the intersection of AI, engineering and distribution.

I help technical founders explain AI security products clearly, with the evidence and limits that buyers need.

[Book a 30-minute call](https://cal.com/paras-madan/30min).