AI Security
Policies, rollout, and limits for securing Claude Code, GitHub Copilot, Cursor, and OpenAI Codex.
Coding agents run shell commands, read and write files, fetch URLs, and call MCP servers with the developer's credentials, on a laptop or in a vendor's cloud sandbox. None of that traffic passes through an AI gateway or a network proxy, and instructions in AGENTS.md or CLAUDE.md are read by the model rather than enforced. The enforcement point is the hook each agent fires before a tool call or prompt, installed by an administrator through managed settings or MDM so that a developer without administrator access can't remove it. A policy on that hook can deny destructive commands, reads of credential files, unreviewed MCP servers, disallowed models, and high-risk destinations. OpenTelemetry and the Claude Compliance API add visibility across the organization without enforcing.
Start with the coding agent security guide for the enforcement model and each vendor's limits. Then open the guide for the agent you deploy: Claude Code, GitHub Copilot, Cursor, or OpenAI Codex. Use the policy guides for destructive commands, secrets, MCP servers, and models, and read the fail-open guide before you rely on a hook for enforcement.
To secure AI coding agents, check each tool call and prompt against a policy before the agent acts, and install that check through managed configuration that developers can't remove. Arcjet runs one policy across Claude Code, GitHub Copilot, Cursor, and OpenAI Codex through the hooks each agent fires, while OpenTelemetry and the Claude Compliance API add visibility without blocking.
Read guideTo secure Claude Code in the enterprise, deploy hooks through managed settings so every session sends each tool call, prompt, and model switch to a policy service before it runs. Arcjet answers those hooks from the edge with the same policy you use for GitHub Copilot, Cursor, and OpenAI Codex, and records every session in the Arcjet Console. This guide covers where the managed settings file lives, lockdown keys, cloud sessions, allowed models, and the OpenTelemetry and Claude Compliance API backstop.
Read guideTo secure GitHub Copilot's agents, install hooks that send each pending tool call to a policy service before the tool runs. The Copilot CLI and cloud coding agent accept HTTP hook entries and enforce tool-call denials. Arcjet decides each of those tool calls from the edge with the same policy you use for Claude Code, Cursor, and OpenAI Codex. Pair it with other controls where GitHub limits the hooks: prompt denials, model restrictions, and VS Code agent mode.
Read guideCursor runs hooks as commands, so a policy check needs a small wrapper script on preToolUse and beforeSubmitPrompt with failClosed set. With Arcjet, that wrapper applies the same policy you run on Claude Code, Copilot, and Codex before each tool call, and every decision appears in the Arcjet Console. Deploy it through enterprise MDM or Team hooks so that developers can't remove it, and commit it to the repository for cloud agents.
Read guideCodex runs hooks as commands, so a policy check is a wrapper script on PreToolUse, PermissionRequest, and UserPromptSubmit that exits 2 on any failure. With Arcjet, that wrapper applies the same policy you run on Claude Code, Copilot, and Cursor before each tool call, and every decision appears in the Arcjet Console. Deliver it through managed requirements and set allow_managed_hooks_only so developers can't disable it.
Read guideTo stop a coding agent running destructive commands, deny them at the hook that the agent fires before each tool call. Arcjet does this with one policy for Claude Code, Copilot, Cursor, and Codex, installed through managed settings and decided before the shell runs anything. This guide shows the starter Rego policies for rm -rf, sudo, force pushes, and CI workflow edits, the spellings to test, and how to roll out in dry run.
Read guideTo stop a coding agent reading .env files and credentials, deny the read at the hook that the agent fires before each tool call. Arcjet does this with one credential-access policy that covers Read, Grep, Glob, and shell commands in Claude Code, Copilot, Cursor, and Codex. This guide shows the starter policy, how to screen prompts, and what to pair it with.
Read guideTo restrict which MCP servers a coding agent can use, check each MCP tool call against an allowlist at the hook that the agent fires before the call runs. Arcjet enforces one allowlist across Claude Code, Copilot, Cursor, and Codex, held in a published policy that the agent can't widen. This guide shows the allowlist policy, how to restrict individual tools, and what to pair it with.
Read guideAn allowed-models policy reads the model a coding agent reports in its hooks and denies the action when the model isn't on an exact-match list. With Arcjet, one policy blocks the switch on Claude Code and prompts and tool calls on Codex and Cursor, and dry run shows which models developers use first. Copilot hooks carry no model, so pair the policy with vendor settings.
Read guidePersonal AI accounts are a common form of shadow AI. They use the same domains as enterprise tiers, so a hostname block can't separate them, and hooks and audit feeds on your tenant never see them. Each vendor offers a tenant header, plan hostname, or device policy that your gateway or MDM applies to refuse the personal path. Once personal accounts are refused, Arcjet runs every remaining session on a managed device under one policy and records it in the Arcjet Console.
Read guideAGENTS.md and CLAUDE.md can't enforce security rules, because the model weighs them as context and injected text, a misread rule, or an edited file can defeat them. A hook policy is enforced outside the model by the agent's own process. Arcjet hook policies are the enforced counterpart to an instruction file: one policy for Claude Code, Copilot, Cursor, and Codex, decided before the tool runs, while instruction files remain the right place for conventions.
Read guideClaude Code and GitHub Copilot HTTP hooks let an action through on a timeout or error, except Claude Code's PreModelSwitch, while the OpenAI Codex and Cursor command wrappers deny on any failure. Fail-open is a vendor design choice, so on those agents the policy service's availability and latency set how strong enforcement is. Arcjet evaluates at the edge in over 300 data centers to keep decisions inside the timeout, fails closed on Codex and Cursor, and reconciles hook decisions against OpenTelemetry and Claude Compliance API activity.
Read guide