How do you secure AI coding agents like Claude Code, Copilot, Cursor, and Codex?
One policy for Claude Code, Copilot, Cursor, and Codex — checked before each tool call through managed settings.
Read guideArcjet Learning Center
AI Security Guides
Identity, architecture, and runtime controls for agents that call tools, access data, and take actions.
What these guides cover
AI security protects systems in which models can call tools, access private data, and create real-world side effects. Model safeguards alone cannot determine whether a specific user may refund an invoice, whether retrieved content is trustworthy, or whether a sequence of individually permitted actions is safe. Production controls must preserve user and agent identity, validate untrusted model output, enforce policy immediately before consequential actions, constrain resource use, and record decisions for investigation. These guides focus on enforceable application boundaries: where a control has enough identity, workflow, resource, and business context to stop an unsafe operation before it completes. The result is layered protection tied to real application consequences.
Risks
- Unauthorized or manipulated tool calls
- Prompt injection through user or retrieved content
- Delegated authority used outside the user's intent
- Sensitive-data exposure and runaway resource use
Control priorities
- Action-level authorization inside the application
- Separate user, agent, workload, and client identities
- Prompt-injection, data, sequence, and budget checks
- Fail-safe enforcement with attributable audit evidence
Recommended reading order
Start with AI agent runtime security for the threat and control model. Use the architecture guide to choose enforcement points, then open the security guide for the framework you ship: Claude Agent SDK, Claude Managed Agents, Cloudflare Think, CrewAI, Genkit, Google ADK, LangChain, LangGraph, Mastra, OpenAI Agents, Strands Agents, TanStack AI, Vercel AI SDK, or Vercel Eve. Use the agentic identity guide to design delegation, workload identity, token exchange, and action-level authorization. For Claude Code, GitHub Copilot, Cursor, and OpenAI Codex, start with the coding agent security guide.
Guides in this collection
How do you secure Claude Code in the enterprise?
Hooks for every Claude Code tool call, prompt, and model switch — deployed through managed settings or MDM.
Read guideHow do you secure the GitHub Copilot CLI and cloud agent?
To secure GitHub Copilot's agents, install hooks that send each pending tool call to a policy service before the tool runs.
Read guideHow do you secure Cursor's agent?
Cursor runs hooks as commands, so a policy check needs a small wrapper script on preToolUse and beforeSubmitPrompt with failClosed set.
Read guideHow do you secure OpenAI Codex?
Codex runs hooks as commands, so a policy check is a wrapper script on PreToolUse, PermissionRequest, and UserPromptSubmit that exits 2 on any failure.
Read guideHow do you stop a coding agent running destructive commands?
To stop a coding agent running destructive commands, deny them at the hook that the agent fires before each tool call.
Read guideHow do you stop a coding agent reading .env files and credentials?
To stop a coding agent reading .env files and credentials, deny the read at the hook that the agent fires before each tool call.
Read guideHow do you restrict which MCP servers a coding agent can use?
To restrict which MCP servers a coding agent can use, check each MCP tool call against an allowlist at the hook that the agent fires before the call runs.
Read guideHow do you restrict which AI models developers can use in coding agents?
Keep developers on approved AI models with one hook policy.
Read guideHow do you block personal Claude, ChatGPT, Copilot, and Cursor accounts on work laptops?
Personal AI accounts are a common form of shadow AI.
Read guideAGENTS.md is not a security control
The model can ignore or be talked out of rules in AGENTS.md and CLAUDE.md.
Read guideDo coding agent hooks fail open?
Claude Code and Copilot hooks fail open, and the Codex and Cursor wrappers fail closed.
Read guideHow to stop AI agents contacting malicious URLs and domains
Deny the tool call before an AI agent reaches a malicious URL or domain.
Read guideWhat is a rogue MCP server and how do you detect one?
A rogue MCP server is one that your agents can call but that your organization hasn't reviewed or can't trust.
Read guideHow to build an egress allowlist for AI agents
An egress allowlist lists the hosts that an agent may contact, and a policy that the agent can't edit enforces it on every tool call.
Read guideHow to stop a coding agent downloading and running malware
Check each shell command and fetch before a coding agent runs it.
Read guideAI agent threat modeling: A practical guide
Map AI agent trust boundaries, tool permissions, and attack paths.
Read guideLeast privilege for AI agent tool calls
Give each AI agent only the tools, credentials, resources, and execution time its task needs.
Read guideAI agent security testing: Evaluations and release gates
Test whether an AI agent can cause an unauthorized action or disclosure.
Read guideAI agent incident response: A practical playbook
Contain an AI agent incident, preserve tool-call evidence, trace downstream effects, and remove persistence.
Read guideBest AI security solution for healthcare and regulated industries
The best AI security for healthcare inspects PHI and PII in your process so the raw body never leaves to be classified.
Read guideBest AI security solution for fintech
The useful fintech control inspects financial PII in-process, gates the transfer or refund at the tool boundary, and records who did what for the audit.
Read guideWhat's the best AI security provider for enterprises?
The best AI security provider for enterprises depends on the layer: identity, gateway, guardrails, observability, or in-code enforcement.
Read guideEve agent security is three jobs
Eve agent security is three jobs: screen the channel, gate tools and connections, and treat hooks as observe-only.
Read guideHow to secure a Mastra agent
Wiring recipe for Mastra: screen with guardProcessor, wrap createTool, and deny MCP with guardHooks.
Claude Agent SDK security
Wiring recipe for Claude Agent SDK: screen prompts on UserPromptSubmit and deny tools at PreToolUse.
Read guideHuman approval is not a security policy
A human click is a hold, not a remote allow or deny. Eve user-approval, Mastra requireApproval, and Claude canUseTool park a call.
Read guidecanUseTool is not a policy gate
Claude's canUseTool looks like a gate. allowedTools, allow rules, and bypassPermissions / acceptEdits skip it. A Bash or Write in allowedTools never.
Read guideA sandbox is not a tool policy
An agent sandbox isolates untrusted code from your app runtime and your secrets.
Read guideMastra guardrails vs an action gate
Mastra guardrails classify messages. An action gate decides whether this tool runs. A clean prompt-injection score can still open a pull request that pastes.
Read guideThe lethal trifecta for AI agents
Private data, untrusted content, and external communication in one agent let an attacker steal data through content the agent already reads.
Read guideHow do I secure a RAG application?
Similarity retrieval finds on-topic chunks, not safe ones. Screen retrieved content before it enters the model context.
Read guideGuardian Agents, explained
Guardian Agents supervise the agents you run with visibility, assurance, and runtime enforcement.
Read guideApplication-Native vs Remote Security Policies: A Technical Guide
Application-native, code-authored rules give engineers context, review, and tests.
Read guideAI Agent Security Architecture: In-Code vs Proxy vs Gateway vs Security Agent
Compare in-code, proxy, AI gateway, and security-agent controls by visibility, enforcement, and context.
Read guideAI Agent Identity and On-Behalf-Of Authorization
On-behalf-of authorization lets an AI agent retain its own identity while exercising limited authority delegated by a user.
Read guideWhat Is AI Agent Runtime Security?
AI agent runtime security enforces policy while an agent is interpreting input, calling tools, accessing data, and taking actions.
Read guideRuntime Security for LLM Applications: Prompt Injection, Data Exfiltration, Unsafe Actions
Prompt injection, data exfiltration, and unsafe tool use — the three runtime failure modes for LLM apps.
Read guidePrompt injection protection for LangChain, LlamaIndex, and Vercel AI SDK apps
Screen the user message before the model, and screen tool or retriever output before it re-enters context.
Read guidePre-Runtime vs Post-Runtime AI Security Tooling
AI security tools cluster into pre-runtime, runtime, and post-runtime.
Read guideKeeping Security Inspection Local So Data Stays in Your Environment
Most security tooling has to receive your traffic to inspect it.
Read guideHow to Enforce Runtime Controls on AI Agents Accessing Enterprise Systems
When agents touch CRMs, warehouses, and internal APIs, the control has to run at each action.
Read guideHow to Enforce Token and Spend Budgets on AI Agents
A runaway agent is a budget problem before it is a security problem.
Read guideHow to Prevent Data Exfiltration Through AI Agents
Stop agents leaking sensitive data without sending that data to a third-party scanner.
Read guideHow to Stop AI Agents Accessing Data They Should Not
Scoped credentials limit what an agent can reach.
Read guideHow to detect and redact PII in LLM inputs and outputs
Scan the prompt before the provider sees it and the completion before it renders — inbound, outbound, and streaming boundaries.
Read guidePII detection at runtime: gateway, sidecar, or in-process
Runtime PII detection ships in three shapes, and they differ on where the text goes to get classified and which paths they can see.
Read guideHow to stop users sending PII to an LLM
Stop the string reaching the provider, in the handler that makes the provider call.
Read guideHow to prevent PII leakage from AI agents
Between the message and the answer, an agent calls tools, reads results back into context, writes to memory, and hands off to other agents.
Read guideHow to redact sensitive data before sending it to OpenAI or Anthropic
Middleware around OpenAI and Anthropic clients: reversible redaction, streaming chunks, tool arguments, and why provider filters run too late.
Read guideHow to prevent LLMs surfacing confidential employee or customer data
Permission-aware retrieval, tenant boundaries in memory and vector stores, and why fine-tuning has no runtime remedy.
Read guideGDPR and CCPA compliance for LLM applications
Map GDPR and CCPA requirements to controls: minimization, erasure, processor scope, transfers, and audit trails without a second PII store.
Read guideHow to prevent prompt injection in LLM applications
A five-layer defense stack: input screening, instruction and data separation, output validation, privilege limiting, and action gating.
Read guideHow to sanitize user input before passing it to an LLM
Why escaping and regex fail, what structural separation looks like, and the multi-turn payload single-message screening misses.
Read guideHow to prevent a malicious tool call from hijacking your AI agent
A hijack is a well-formed call the model was persuaded to make. Validate arguments, scope tools, and budget actions.
Read guideHow to defend against indirect prompt injection in agentic workflows
Payloads arrive through retrieved content. Screen before context, track provenance, and limit blast radius.
Read guideHow AI security platforms detect prompt injection at runtime
Compare heuristics, classifiers, LLM-as-judge, canary tokens, and behavioral divergence — and where each is enforced.
Read guideThe best tools to detect and block prompt injection in production
Arcjet, Lakera Guard, Azure Prompt Shields, LLM Guard, Rebuff, and Guardrails AI compared for production.
Read guideBest AI security tools for developers
The best tools are the ones you call in the handler before the provider or tool runs — not a dashboard after the refund.
Read guideHow to Add Human Review and Approval Gates to AI Agent Actions
Some agent actions should not execute without a human.
Read guideProducing Compliance Evidence for AI Agent Activity
Auditors do not want your system prompt.
Read guideHow to Secure an MCP Server or AI Agent Tool Calls
MCP tools have no HTTP front door. How to add budgets, injection detection, and data controls where the.
Read guideAnatomy of an Agent Incident: Three Permitted Actions, One Fraud
Correctly scoped tools can still enable fraud — the question is the sequence of calls, not any single tool.
Read guideHow do I add guardrails to an AI agent that calls external APIs?
Enforce on the outbound HTTP call, inside the tool that makes it.
Read guideRuntime security for LLM applications: prompt injection, data leakage, and output validation
A chat route is a user string, then retrieved context, then a completion.
Read guideWhich runtime security tools integrate with LangChain or AutoGPT?
Compare runtime security integration points for LangChain, LangGraph, CrewAI, AutoGPT, and Vercel AI SDK.
Read guideHow do I prevent an AI agent from taking irreversible actions?
Deny transfers, deletes, and prod config by default. Hold a human only where needed, and resume with an idempotency key.
Read guideHow do I implement the OWASP Top 10 for LLM Applications?
The 2026 OWASP GenAI list is the source of names and order.
Read guideAI security checklist for production LLM apps
Apply 20 verifiable AI security controls for production LLM apps.
Read guideWhat is AI security?
AI security protects models, data, applications, and infrastructure.
Read guideWhat changes for application security when your app calls an LLM?
Four surfaces appear when a handler calls a model.
Read guideContent moderation for AI applications
Screen user prompts before AI-generated content, including image prompts.
Read guideHow do I limit what actions an AI agent is allowed to take?
A tool list names functions the model can call. Least privilege also covers objects, arguments, and how often.
Read guideHow do I prevent an AI agent from leaking system prompt content?
Screen the request that asks for it, screen the response that carries it, and keep anything that would hurt you out of the prompt.
Read guideHow do I add guardrails to production AI workflows?
Content guardrails label text. Action gates allow or deny operations. Most libraries only do the first job.
Read guideWhich AI security platforms support MCP server security?
MCP support can mean four different things. Sort vendors by which side of the connection they sit on.
Read guideWhat are the best tools for securing agentic AI workflows?
Pick tools by the boundary they reach. Most stacks leave tool arguments and tool results uncovered.
Read guideWhat's the best AI security platform for data privacy and threat detection?
Detection wants to inspect content; privacy wants it to stay put. Platforms that claim both often send your data away.
Read guideWhat's the best AI security software for SaaS companies?
Multi-tenancy, subprocessor obligations, and per-plan behavior separate a SaaS requirement from a general one.
Read guideWhat's the best AI security tool for startups and small teams?
For a small team, the right tool is one engineer can install in an afternoon — and that still runs in six months.
Read guideWhich AI security company has the best protection for cloud workloads?
Cloud workload protection secures compute. AI application security secures what the model does inside it.
Read guideClaude Agent SDK security guide
Secure Claude Agent SDK applications in TypeScript and Python with prompt screening, tool policies, resource authorization, and isolated sessions.
Read guideClaude Managed Agents security guide
Secure Claude Managed Agents with inbound screening and custom-tool policies.
Read guideCloudflare Think security guide
Secure Cloudflare Think agents with inbound screening and beforeToolCall policy.
Read guideCrewAI security guide
Secure CrewAI with kickoff screening, tool-call hooks, resource authorization, and standalone tool wrappers.
Read guideGenkit security guide
Secure Genkit with inbound screening, authored-tool wrappers, and middleware.
Read guideGoogle ADK security guide
Secure Google ADK in TypeScript and Python with inbound screening and before-tool policies.
Read guideLangChain security guide
Apply runtime security to LangChain JavaScript and Python agents.
Read guideLangGraph security guide
Secure LangGraph JavaScript agents with input screening and ToolNode policies.
Read guideMastra security guide
Secure Mastra messages, authored tools, MCP capabilities, and memory.
Read guideMicrosoft Agent Framework security guide
Secure Microsoft Agent Framework for Go with inbound and tool policies.
Read guideOpenAI Agents security guide
Secure OpenAI Agents SDK applications in JavaScript and Python.
Read guideStrands Agents security guide
Secure Strands Agents in JavaScript and Python with prompt screening and tool policies.
Read guideTanStack AI security guide
Secure TanStack AI with prompt screening and server-side tool policies.
Read guideVercel AI SDK security guide
Secure Vercel AI SDK tools and application actions with policy checks.
Read guideVercel Eve security guide
Secure Vercel Eve channels, tools, and connections.
Read guide