AI Agent Security: Airlock Digital Adds Command-Level Controls

What Airlock Digital announced

Airlock Digital has built its business on application allowlisting, the practice of deciding which software may run on a machine. It now wants to control what that software does after it starts running, at least when the software is an AI agent. At Black Hat USA 2026 the company introduced Agentic AI Control & Governance, an extension of its application control product. The new layer records AI agent behavior at the level of individual commands and sessions, manages policy centrally, and governs in real time what trusted agents may do on endpoints.1 Airlock says customers should get general availability in the third quarter of 2026.18

According to the company, the product does four things. It discovers AI applications automatically. It manages policies for both trusted applications and trusted agents, with version control and granular admin permissions. It checks each agent command against policy as it happens and sends the decision back to supported agents so they can change course. And it keeps a searchable record of sessions, commands, files, policy decisions, risk activity, token usage and cost.110 The product page names Microsoft Copilot, Claude and Codex as the platforms where Airlock will enforce endpoint policy independently. It also lists credential exposure as something the dashboard tracks.2

Nearly all of the coverage so far is the company's own press release, republished through CyberNewswire and GlobeNewswire on trade sites and wire aggregators.3579 At CSO Online it ran as sponsored content, and TechRound marked it as a paid release.410 No independent outlet has tested the product yet, and nothing below should be taken as confirmation that it works as described. What the announcement does show is how one long-standing prevention vendor reads the AI agent threat, and that reading deserves a close look.

The core idea: agents are a second layer of trust

The main argument comes from co-founder and chief product officer David Cottingham. Traditional endpoint security answers one question: is this software allowed to run? Cottingham says agentic AI adds a second one: what is a trusted agent allowed to do once it is running?910 He also points out that agents behave differently from ordinary programs. When an agent is blocked, it doesn't stop. It looks for another route to its goal.9 Airlock's answer is to tell agents where their limits are, so they can adjust and stay within policy, instead of blocking them over and over.39

The product page puts it more bluntly: agents adapt and replan when blocked, often with nobody watching.2 The company's blog post title, which says agents behave more like employees than applications, makes the same point.58

This is the most interesting part of the announcement, and the most debatable. Classic allowlisting works because it is binary: a hash or publisher is trusted or it isn't. An agent built on Claude Code or Codex is a trusted binary by any normal measure, yet it can run arbitrary shell commands, open files and call APIs based on whatever it reads. Airlock is betting that the trust decision has to shift from the executable to the individual action.

Why the agent attack surface fits this approach

The wider research on agent risk largely supports that bet. The OWASP Top 10 for Agentic Applications 2026 lists agent goal hijacking, tool misuse, identity and privilege abuse, agentic supply-chain weaknesses, unexpected code execution and memory poisoning among its categories. Each one is tied to a real incident, such as EchoLeak or a GitHub MCP exploit.11 Several of these risks share a pattern: the agent is authorized, but it gets manipulated into misusing its authority. That is the gap a binary execution control cannot close.

One security analysis says agents running for users often hold more privileges than those users, which makes the agent a built-in path to privilege escalation. The same analysis warns that the flaw sits in the model's decisions, not in code that can be patched.16 It recommends restricting what agents can do before they act, through allowlists of tools and actions, because that gives predictable security around unpredictable behavior.16 Another guide makes the same structural point. Model-level guardrails such as system prompts and safety filters help but are not enough, and real defense comes from controls at the execution layer, such as action allowlists and sandboxing.18

The endpoint is also where visibility is weakest. Cyberhaven says local agents work at the operating-system level through filesystem and accessibility APIs. Their activity never crosses a network boundary where a proxy or SIEM could inspect it.19 The firm reports that enterprise use of endpoint AI-native apps grew 509% year over year, and use of coding assistants grew 357%.19 An AI-gateway vendor makes a similar point: coding agents and desktop apps often call model providers directly and skip gateway controls completely.14

The numbers behind the urgency

Airlock's case for urgency rests on an April 2026 Cloud Security Alliance report. It found that 82% of organizations had unknown AI agents in their environments, and 65% had an AI agent-related security incident in the previous year.16 The product page adds IBM's 2025 figure of a $4.63 million average breach cost for organizations with high levels of shadow AI.2

These numbers match other industry surveys. A Kiteworks forecast found that 63% of organizations cannot enforce purpose limits on their agents, and 60% cannot stop a misbehaving agent once it is running.18 Readers should still keep in mind that vendors chose these statistics to support a product pitch. They show a real governance gap, but they don't show that any one tool closes it.

Where the industry agrees and where it splits

The industry broadly agrees on two things: blocklisting won't work, and least privilege has to reach agents. Cyberhaven argues that banning one agent today does nothing about the next tool a developer installs tomorrow.19 Airlock's own materials make a similar point, saying signatures and blocklists fail against agents that adapt.2 OWASP-aligned guidance lists least-privilege tool scoping, human approval for high-impact actions, and monitoring as baseline controls.14

The split is over where enforcement should sit. Cyberhaven puts discovery, workflow monitoring and data lineage at the center.19 Gateway vendors want agent traffic routed through a central policy engine.14 Others, including Zenity, Noma Security, Palo Alto Networks' Prisma AIRS and HiddenLayer, describe runtime enforcement at agent decision points, MCP server policies or native agent hooks.14 Airlock is coming at the problem from execution control. Its argument is that platform-native controls only govern their own ecosystems, while an endpoint layer can apply the same policy across platforms.1

That cross-platform claim is real progress if it holds up. Most enterprises won't standardize on a single agent vendor, and a separate policy surface for each AI platform repeats the fragmentation that drove allowlisting adoption in the first place.

The open questions

Three concerns stand out.

Cooperative feedback assumes the agent behaves. Sending policy decisions back to the agent so it can adapt works well for an agent that is doing its job and simply hits a limit. A hijacked agent is a different case. Prompt injection, memory poisoning or a compromised tool can all turn an agent's goals against the user.11 Feedback won't stop that agent. Only hard enforcement will. Airlock does describe blocking commands in real time, and its dashboard shows blocked commands.2 Buyers should still check that enforcement holds regardless of how the agent responds.

Command-level policy covers only part of the threat model. Many agent attacks never produce a suspicious shell command. EchoLeak, for example, exfiltrated data through a chain of auto-fetched content and an allowlisted proxy.11 Governing commands, files and resources on an endpoint is valuable. It does not replace egress controls, credential scoping and input filtering, which the broader guidance treats as complementary layers.1115

Coverage depends on what counts as "supported." The feedback loop applies to supported agents, and the product page names three platforms.12 Cyberhaven's warning about a constant flow of new tools suggests coverage will always trail adoption.19 Airlock's base allowlisting may make up for some of that by stopping unapproved agent applications from running at all, which the company presents as preventing shadow AI from spreading.2

The takeaway

Airlock's announcement points to a real change in endpoint security. The question used to be whether a piece of software could be trusted. Now it is what trusted software should be allowed to do on a given day. This is the right problem to work on. Agents run with real credentials, act faster than people can review, and treat a block as something to route around. Allowlisting individual actions, in addition to binaries, is a reasonable way to bring prevention-first thinking to software that doesn't behave like ordinary software.

The product's strategy looks sound: deny by default, govern independently of the vendor, and record each agent action as evidence. What it actually delivers is still unproven, and the coverage so far comes from the company alone. Before general availability, the useful test is whether Airlock's controls hold when an agent has been turned against its owner, not just when a well-behaved agent hits a limit.