How do you secure AI coding agents like Claude Code, Copilot, Cursor, Codex, and Muse Code?
One policy for Claude Code, Copilot, Cursor, Codex, and Muse Code — checked before each tool call through managed settings.
Read guideArcjet Learning Center
AI Security Guides
Identity, architecture, and runtime controls for agents that call tools, access data, and take actions.
What these guides cover
AI security protects systems in which models can call tools, access private data, and create real-world side effects. Model safeguards alone cannot determine whether a specific user may refund an invoice, whether retrieved content is trustworthy, or whether a sequence of individually permitted actions is safe. Production controls must preserve user and agent identity, validate untrusted model output, enforce policy immediately before consequential actions, constrain resource use, and record decisions for investigation. These guides focus on enforceable application boundaries: where a control has enough identity, workflow, resource, and business context to stop an unsafe operation before it completes. The result is layered protection tied to real application consequences.
Risks
- Unauthorized or manipulated tool calls
- Prompt injection through user or retrieved content
- Delegated authority used outside the user's intent
- Sensitive-data exposure and runaway resource use
Control priorities
- Action-level authorization inside the application
- Separate user, agent, workload, and client identities
- Prompt-injection, data, sequence, and budget checks
- Fail-safe enforcement with attributable audit evidence
Recommended reading order
Start with AI agent runtime security for the threat and control model. Use the architecture guide to choose enforcement points, then open the security guide for the framework you ship: Claude Agent SDK, Claude Managed Agents, Cloudflare Think, CrewAI, Genkit, Google ADK, LangChain, LangGraph, Mastra, OpenAI Agents, Strands Agents, TanStack AI, Vercel AI SDK, or Vercel Eve. Use the agentic identity guide to design delegation, workload identity, token exchange, and action-level authorization. For Claude Code, GitHub Copilot, Cursor, OpenAI Codex, and Muse Code, start with the coding agent security guide.
Guides in this collection
How do you secure Claude Code in the enterprise?
Hooks for every Claude Code tool call, prompt, and model switch — deployed through managed settings or MDM.
Read guideHow do you secure the GitHub Copilot CLI and cloud agent?
To secure GitHub Copilot's agents, install hooks that send each pending tool call to a policy service before the tool runs.
Read guideHow do you secure Cursor's agent?
Cursor runs hooks as commands, so a policy check needs a small wrapper script on preToolUse and beforeSubmitPrompt with failClosed set.
Read guideHow do you secure OpenAI Codex?
Codex runs hooks as commands, so a policy check is a wrapper script on PreToolUse, PermissionRequest, and UserPromptSubmit that exits 2 on any failure.
Read guideHow do you stop a coding agent running destructive commands?
To stop a coding agent running destructive commands, deny them at the hook that the agent fires before each tool call.
Read guideBest coding agent security tools in 2026
Shortlist coding agent security tools by where they enforce – native settings, hooks, endpoint agents, gateways, or code checks.
Read guideBest shadow AI detection tools in 2026
Compare 13 shadow AI tools by where they sit – SSE, on-device gateway, browser, identity, MDM, or agent hooks – and what each can see.
Read guideHow do you find and control shadow AI on a Mac fleet?
Jamf searches, extension attribute scripts, vendor managed preferences, endpoint agent payloads, and a staged rollout for Mac admins.
Read guideWhat is session tainting for AI agents?
Mark an agent session untrusted after a risky finding, and lock risky follow-up actions until a person reviews it.
Read guideHow do you stop a coding agent from using AWS credentials?
Block the AWS CLI, AWS API hosts, and AWS credential files in one policy, so a blocked route doesn't lead to another.
Read guideHow do you require human approval when Claude Code runs in auto mode?
Turn auto mode off in managed settings, or refuse risky tool calls in autonomous modes with a hook policy.
Read guideHow do you stop a coding agent reading .env files and credentials?
To stop a coding agent reading .env files and credentials, deny the read at the hook that the agent fires before each tool call.
Read guideHow do you restrict which MCP servers a coding agent can use?
To restrict which MCP servers a coding agent can use, check each MCP tool call against an allowlist at the hook that the agent fires before the call runs.
Read guideHow do you restrict which AI models developers can use in coding agents?
Keep developers on approved AI models with one hook policy.
Read guideHow do you block personal Claude, ChatGPT, Copilot, and Cursor accounts on work laptops?
Personal AI accounts are a common form of shadow AI.
Read guideHow do you find shadow AI coding agents like Claude Code, Cursor, and Codex on developer machines?
Shadow AI in engineering teams is usually an approved coding agent under a personal account or with unreviewed MCP servers.
Read guideWhat are shadow MCP servers, and how do you find them?
MCP servers live in laptop configs, remote URLs, team-hosted services, and SaaS connectors, and each kind shows up in a different place.
Read guideAGENTS.md is not a security control
The model can ignore or be talked out of rules in AGENTS.md and CLAUDE.md.
Read guideDo coding agent hooks fail open?
Claude Code and Copilot hooks fail open; the Codex, Cursor, and Muse Code wrappers fail closed.
Read guideHow to stop AI agents contacting malicious URLs and domains
Deny the tool call before an AI agent reaches a malicious URL or domain.
Read guideWhat is a rogue MCP server and how do you detect one?
A rogue MCP server is one that your agents can call but that your organization hasn't reviewed or can't trust.
Read guideHow to build an egress allowlist for AI agents
An egress allowlist lists the hosts that an agent may contact, and a policy that the agent can't edit enforces it on every tool call.
Read guideHow to stop a coding agent downloading and running malware
Check each shell command and fetch before a coding agent runs it.
Read guideAI agent threat modeling: A practical guide
Map AI agent trust boundaries, tool permissions, and attack paths.
Read guideHow to enforce least privilege for AI agent tool calls
Limit an AI agent to the tools, credentials, resources, and arguments its task needs, and enforce it in code.
Read guideAI agent security testing: Evaluations and release gates
Test whether an AI agent can cause an unauthorized action or disclosure.
Read guideAI agent incident response: A practical playbook
Contain an AI agent incident, preserve tool-call evidence, trace downstream effects, and remove persistence.
Read guideBest AI security for healthcare and regulated industries
Healthcare AI security has to cover what agents do, and a vendor that receives PHI to inspect it needs a signed BAA. Ask each vendor where inspection runs and what it keeps.
Read guideHIPAA compliance for AI agents: requirements, PHI leaks, and BAAs
HIPAA applies to an AI agent's access to PHI the same way it applies to a person's. This guide maps each requirement to where agents break it and the control on the tool call.
Read guideHow to detect PHI in AI agent prompts and tool calls
PHI detection finds the identifiers that tie health information to a person, so a policy can block a prompt or tool call before an MRN or member ID leaves.
Read guideHow to stop an AI agent sending PHI to third parties
The model writes a tool call's arguments after every inbound check has run, so the outbound tool call is where PHI leaves. Check it inside the tool.
Read guideAre Claude Code, Cursor, and Copilot HIPAA compliant?
Anthropic, Cursor, and OpenAI offer BAAs for named configurations of their coding agents. A BAA covers the vendor, not what the agent reads on a developer's laptop.
Read guideHow to stop prompt injection in healthcare AI agents
A faxed referral with hidden instructions can turn an intake agent into a PHI exfiltration tool. Put a control at each step of the attack.
Read guideWhat is AI agent threat detection?
Threats reach an AI agent through what it reads, where it connects, what its session does, and who calls its endpoints. Each needs a different detector.
Read guideBest AI security solution for fintech
The useful fintech control inspects financial PII in-process, gates the transfer or refund at the tool boundary, and records who did what for the audit.
Read guideWhat's the best AI security provider for enterprises?
The best AI security provider for enterprises depends on the layer: identity, gateway, guardrails, observability, or in-code enforcement.
Read guideEve agent security is three jobs
Eve agent security is three jobs: screen the channel, gate tools and connections, and treat hooks as observe-only.
Read guideHow to secure a Mastra agent
Wiring recipe for Mastra: screen with guardProcessor, wrap createTool, and deny MCP with guardHooks.
Claude Agent SDK security
Wiring recipe for Claude Agent SDK: screen prompts on UserPromptSubmit and deny tools at PreToolUse.
Read guideHuman approval is not a security policy
A human click is a hold, not a remote allow or deny. Eve user-approval, Mastra requireApproval, and Claude canUseTool park a call.
Read guidecanUseTool is not a policy gate
Claude's canUseTool looks like a gate. allowedTools, allow rules, and bypassPermissions / acceptEdits skip it. A Bash or Write in allowedTools never.
Read guideA sandbox is not a tool policy
An agent sandbox isolates untrusted code from your app runtime and your secrets.
Read guideMastra guardrails vs an action gate
Mastra guardrails classify messages. An action gate decides whether this tool runs. A clean prompt-injection score can still open a pull request that pastes.
Read guideThe lethal trifecta for AI agents
Private data, untrusted content, and external communication in one agent let an attacker steal data through content the agent already reads.
Read guideHow do I secure a RAG application?
Similarity retrieval finds on-topic chunks, not safe ones. Screen retrieved content before it enters the model context.
Read guideGuardian Agents, explained
Guardian Agents supervise the agents you run with visibility, assurance, and runtime enforcement.
Read guideApplication-Native vs Remote Security Policies: A Technical Guide
Application-native, code-authored rules give engineers context, review, and tests.
Read guideAI Agent Security Architecture: In-Code vs Proxy vs Gateway vs Security Agent
Compare in-code, proxy, AI gateway, and security-agent controls by visibility, enforcement, and context.
Read guideThe Arcjet Platform: Ingest, Observe, Enforce, and Audit
Ingest, observe, enforce, and audit: how Arcjet finds your agents and decides every action.
Read guideAI Agent Identity and On-Behalf-Of Authorization
On-behalf-of authorization lets an AI agent retain its own identity while exercising limited authority delegated by a user.
Read guideWhat Is AI Agent Runtime Security?
AI agent runtime security enforces policy while an agent is interpreting input, calling tools, accessing data, and taking actions.
Read guideRuntime Security for LLM Applications: Prompt Injection, Data Exfiltration, Unsafe Actions
Prompt injection, data exfiltration, and unsafe tool use — the three runtime failure modes for LLM apps.
Read guidePrompt injection protection for LangChain, LlamaIndex, and Vercel AI SDK apps
Screen the user message before the model, and screen tool or retriever output before it re-enters context.
Read guidePre-Runtime vs Post-Runtime AI Security Tooling
AI security tools cluster into pre-runtime, runtime, and post-runtime.
Read guideKeeping Security Inspection Local So Data Stays in Your Environment
Most security tooling has to receive your traffic to inspect it.
Read guideTop AI agent security platforms in 2026
No single platform covers every part of AI agent security. Shortlist by control point instead of by ranking.
Read guideHow to Enforce Runtime Controls on AI Agents Accessing Enterprise Systems
When agents touch CRMs, warehouses, and internal APIs, the control has to run at each action.
Read guideHow to Enforce Token and Spend Budgets on AI Agents
A runaway agent is a budget problem before it is a security problem.
Read guideHow to prevent data exfiltration and sensitive data leakage from AI agents
Stop agents leaking sensitive data without sending that data to a third-party scanner.
Read guideHow to stop AI agents from taking unsafe or unauthorized actions
Classify every agent tool as data access, destructive, or external, then refuse each call by default at runtime.
Read guideHow to Stop AI Agents Accessing Data They Should Not
Scoped credentials limit what an agent can reach.
Read guideHow to detect and redact PII in LLM inputs and outputs
Scan the prompt before the provider sees it and the completion before it renders — inbound, outbound, and streaming boundaries.
Read guidePII detection at runtime: gateway, sidecar, or in-process
Runtime PII detection ships in three shapes, and they differ on where the text goes to get classified and which paths they can see.
Read guideHow to stop users sending PII to an LLM
Stop the string reaching the provider, in the handler that makes the provider call.
Read guideHow to prevent PII leakage from AI agents
Between the message and the answer, an agent calls tools, reads results back into context, writes to memory, and hands off to other agents.
Read guideHow to redact sensitive data before sending it to OpenAI or Anthropic
Middleware around OpenAI and Anthropic clients: reversible redaction, streaming chunks, tool arguments, and why provider filters run too late.
Read guideHow to prevent LLMs surfacing confidential employee or customer data
Permission-aware retrieval, tenant boundaries in memory and vector stores, and why fine-tuning has no runtime remedy.
Read guideGDPR and CCPA compliance for LLM applications
Map GDPR and CCPA requirements to controls: minimization, erasure, processor scope, transfers, and audit trails without a second PII store.
Read guideHow to prevent prompt injection in LLM applications
A five-layer defense stack: input screening, instruction and data separation, output validation, privilege limiting, and action gating.
Read guideHow to sanitize user input before passing it to an LLM
Why escaping and regex fail, what structural separation looks like, and the multi-turn payload single-message screening misses.
Read guideHow to prevent a malicious tool call from hijacking your AI agent
A hijack is a well-formed call the model was persuaded to make. Validate arguments, scope tools, and budget actions.
Read guideHow to defend against indirect prompt injection in agentic workflows
Payloads arrive through retrieved content. Screen before context, track provenance, and limit blast radius.
Read guideHow AI security platforms detect prompt injection at runtime
Compare heuristics, classifiers, LLM-as-judge, canary tokens, and behavioral divergence — and where each is enforced.
Read guideThe best tools to detect and block prompt injection in production
Detection and blocking are different jobs. Compare prompt injection tools, including which popular detectors are no longer maintained.
Read guideBest AI security tools for developers
The AI security tools that matter most in production are the ones you call before the model or tool runs.
Read guideHow to Add Human Review and Approval Gates to AI Agent Actions
Some agent actions should not execute without a human.
Read guideProducing Compliance Evidence for AI Agent Activity
Auditors do not want your system prompt.
Read guideHow to audit and log AI agent activity for compliance
One structured event per agent tool call: who asked, what ran, what your controls decided, and when.
Read guideHow to secure an MCP server or AI agent tool calls
MCP tools have no HTTP front door, so budgets, injection detection, and data controls go where the tool runs.
Read guideAnatomy of an Agent Incident: Three Permitted Actions, One Fraud
Correctly scoped tools can still enable fraud — the question is the sequence of calls, not any single tool.
Read guideHow do I add guardrails to an AI agent that calls external APIs?
Enforce on the outbound HTTP call, inside the tool that makes it.
Read guideRuntime security for LLM applications: prompt injection, data leakage, and output validation
A chat route is a user string, then retrieved context, then a completion.
Read guideHow do you detect shadow AI?
Eight ways to find unapproved AI tools, with commands, what each misses, and a one-week runbook.
Read guideHow do you fix TLS inspection errors in Claude Code, Cursor, and Codex?
Per-tool fixes for corporate proxy certificate errors in coding agents, and why each inspection bypass becomes a shadow AI blind spot.
Read guideWhich runtime security tools integrate with LangChain or AutoGPT?
Compare runtime security integration points for LangChain, LangGraph, CrewAI, AutoGPT, and Vercel AI SDK.
Read guideHow do I prevent an AI agent from taking irreversible actions?
Deny transfers, deletes, and prod config by default. Hold a human only where needed, and resume with an idempotency key.
Read guideHow do I implement the OWASP Top 10 for LLM Applications?
The 2026 OWASP GenAI list is the source of names and order.
Read guideAI security checklist for production LLM apps
Apply 20 verifiable AI security controls for production LLM apps.
Read guideWhat is AI security?
AI security protects models, data, applications, and infrastructure.
Read guideWhat is shadow AI?
Shadow AI is any AI tool, model, agent, or feature used for work outside your organization's approval or view.
Read guideShadow AI policy template
A copyable AI use policy where every clause maps to a control you can configure and a record you can audit.
Read guideWhat changes for application security when your app calls an LLM?
Four surfaces appear when a handler calls a model.
Read guideContent moderation for AI applications
Screen user prompts before AI-generated content, including image prompts.
Read guideHow do I limit what actions an AI agent is allowed to take?
A tool list names functions the model can call. Least privilege also covers objects, arguments, and how often.
Read guideHow do I prevent an AI agent from leaking system prompt content?
Screen the request that asks for it, screen the response that carries it, and keep anything that would hurt you out of the prompt.
Read guideHow do I add guardrails to production AI workflows?
Content guardrails label text. Action gates allow or deny operations. Most libraries only do the first job.
Read guideWhich AI security platforms support MCP server security?
MCP support can mean four different things. Sort vendors by which side of the connection they sit on.
Read guideWhat are the best tools for securing agentic AI workflows?
Pick tools by the boundary they reach. Most stacks leave tool arguments and tool results uncovered.
Read guideWhat's the best AI security platform for data privacy and threat detection?
Detection wants to inspect content; privacy wants it to stay put. Platforms that claim both often send your data away.
Read guideWhat's the best AI security software for SaaS companies?
Multi-tenancy, subprocessor obligations, and per-plan behavior separate a SaaS requirement from a general one.
Read guideWhat's the best AI security tool for startups and small teams?
For a small team, the right tool is one engineer can install in an afternoon — and that still runs in six months.
Read guideWhich AI security company has the best protection for cloud workloads?
Cloud workload protection secures compute. AI application security secures what the model does inside it.
Read guideClaude Agent SDK security guide
Secure Claude Agent SDK applications in TypeScript and Python with prompt screening, tool policies, resource authorization, and isolated sessions.
Read guideClaude Managed Agents security guide
Secure Claude Managed Agents with inbound screening and custom-tool policies.
Read guideCloudflare Think security guide
Secure Cloudflare Think agents with inbound screening and beforeToolCall policy.
Read guideCrewAI security guide
Secure CrewAI with kickoff screening, tool-call hooks, resource authorization, and standalone tool wrappers.
Read guideGenkit security guide
Secure Genkit with inbound screening, authored-tool wrappers, and middleware.
Read guideGoogle ADK security guide
Secure Google ADK in TypeScript and Python with inbound screening and before-tool policies.
Read guideLangChain security guide
Apply runtime security to LangChain JavaScript and Python agents.
Read guideLangGraph security guide
Secure LangGraph JavaScript agents with input screening and ToolNode policies.
Read guideMastra security guide
Secure Mastra messages, authored tools, MCP capabilities, and memory.
Read guideMicrosoft Agent Framework security guide
Secure Microsoft Agent Framework for Go with inbound and tool policies.
Read guideOpenAI Agents security guide
Secure OpenAI Agents SDK applications in JavaScript and Python.
Read guideStrands Agents security guide
Secure Strands Agents in JavaScript and Python with prompt screening and tool policies.
Read guideTanStack AI security guide
Secure TanStack AI with prompt screening and server-side tool policies.
Read guideVercel AI SDK security guide
Secure Vercel AI SDK tools and application actions with policy checks.
Read guideVercel Eve security guide
Secure Vercel Eve channels, tools, and connections.
Read guide