Agentic AI security
Agentic AI security for coding agents, MCP servers and AI tools
AI agents read code, call tools, run commands and act with your developers' credentials. PexLens treats them like the privileged identities they are: we verify what they are built from, watch how they change and enforce policy on what they can reach.
Why agents are different
An agent is a service account that writes its own instructions
A chatbot answers questions. An agent acts: it opens files, edits code, runs terminals, calls APIs through MCP servers and plugins, and sometimes pushes changes. If one is compromised, the attacker inherits every one of those abilities.
That makes agentic AI a supply chain problem as much as a model problem. Agents are assembled from extensions, packages, plugins and tool servers, each of which can be tampered with, updated maliciously or abandoned.
The attack surface
Where agentic AI breaks
Compromised agent components
A malicious update to an AI extension, plugin or package turns a trusted agent into a foothold, as the October 2026 Claude Code extension incident in Cursor's marketplace showed.
MCP servers and tool poisoning
Tool descriptions and responses can carry hidden instructions, and a rogue MCP server can expose data or actions the agent should never have.
Prompt injection through content
Repositories, issues, web pages and documents can steer an agent towards attacker goals.
Excessive permissions
Agents often inherit a developer's Git identity, cloud sessions and secrets, so a single compromise reaches far beyond the IDE.
How PexLens helps
Verify, monitor and constrain every agent component
Inventory
See which AI assistants, extensions and agent components are installed on developer machines.
Verify
Analyse each component for malicious code, publisher and provenance changes, and risky permissions before install.
Monitor drift
Re-check new versions for new capabilities, network destinations or persistence behaviour.
Enforce
Block, quarantine, allow with monitoring or require approval, by policy.
A practical model
Five questions that define an agent's blast radius
- What can it read?
- What can it write or change?
- What credentials can it access or infer?
- What systems can it connect to?
- What actions can it trigger?
Answer these for every agent and integration, then put policy in front of the risky ones. PexLens gives security teams the inventory, evidence and enforcement to do it.
FAQ
Agentic AI security: common questions
What is agentic AI security?
Agentic AI security protects autonomous AI agents that act on their own, such as coding agents and tool-using assistants, by controlling what they are built from, what they can access and what actions they can take.
What is MCP and why does it matter for security?
The Model Context Protocol (MCP) connects AI agents to tools and data sources. Each MCP server extends what an agent can do, so a malicious or compromised server, or a poisoned tool description, can expose data or trigger unintended actions.
What are the main security risks of AI coding agents?
The main risks are compromised extensions or MCP servers, malicious or non-existent packages suggested by the model and then installed, over-broad credentials and tokens, and actions taken without human review.
How does PexLens secure AI agents?
PexLens inventories AI assistants and agent components on developer machines, analyses them for malicious behaviour and risky changes before and after install, and enforces policy to block, quarantine, monitor or require approval.
Can PexLens stop an AI agent from installing a malicious package?
Yes. When package installs are routed through the PexLens Proxy, requests made by an AI agent are checked against the same intelligence and policies as a developer’s, and malicious packages are blocked before installation.
Is agentic AI security different from prompt injection protection?
Prompt injection is one attack against agents. Agentic AI security also covers compromised components, excessive permissions, persistence and the reach of the credentials an agent can use.
Does PexLens cover AI coding assistants?
Yes. PexLens treats AI coding assistants and their extensions like any other component that enters the developer environment, and checks them for risky behaviour and changes.
Related
More on AI security
Adopt AI agents without blind trust
See how PexLens verifies and constrains the agents your developers use.