AI agents call tools, run code, and use credentials on their own. Monitoring them means following those actions into the workloads and cloud accounts they touch.
For many, the appeal of an AI agent is that you can hand it a job and walk away. Give one a support ticket, and it pulls the customer’s records, runs code to find the fault, updates the database, and emails a fix, all without waiting for anyone to sign off. That independence is what makes agents worth deploying. It also means the agent is editing customer data and executing interactions on its own, so security teams need a clear record of what is actually happening.
That record is within reach. AI security platforms can monitor runtime threats from agents, but only if they’re enabled to track three areas: the instructions an agent receives and the responses it produces, what it executes inside its workload, and what assets it reaches through cloud identities and APIs. Wiz connects those layers through its Security Graph, combining agentless cloud visibility with Wiz Sensor for activity inside workloads.
Why security concerns are slowing AI agent rollouts
Nearly two in three organizations surveyed by McKinsey named security and risk concerns as their biggest obstacle to scaling agentic AI, and only about 30% had well-developed practices for governing AI strategy, oversight, and autonomous agents.
The concern makes sense once you look at how agents work. An agent chooses its own steps toward a goal, using whatever tools and access it has been given. Say an agent is summarizing a customer email, and the email includes a hidden line telling it to forward the customer list to an outside address. An agent might treat that line as a legitimate command, leaking sensitive data.
Agents can also cause damage with no attacker involved. An agent trying to fix a problem may decide the quickest solution is to delete a critical resource, and if its access allows that, nothing stops it. After an incident like that, the first questions are what the agent had access to and what it actually changed. Security teams need real-time monitoring tools that can answer both.
Reading what agents say only goes so far
Model inputs and outputs remain a necessary starting point. These interactions can expose attempts to override instructions, extract sensitive information or produce unsafe responses. Several security tools have been built to protect this aspect of AI systems.
NVIDIA NeMo Guardrails is an open-source toolkit for programmable input and output checks, including controls around tool calls. AI security platform HiddenLayer’s agentic runtime capabilities, introduced in March 2026, can piece together the steps an agent took during a session and block unsafe tool calls. AI governance tool Zenity provides runtime protection against unsafe agent behavior on platforms including OpenAI AgentKit and Microsoft Copilot Studio.
These capabilities extend beyond scanning conversation text. Still, a transcript alone cannot establish what ran on a host or which files changed. Agents can also make their own conversations harder to read. In one simulation, agents working together developed a shared shorthand that made their transcripts difficult for people to interpret. In systems where many agents work together, transcripts may become increasingly harder to monitor, whether by people or by security tools. That’s one more reason to track what processes they actually run.
Watching what agents do inside their workloads
Alarmingly few organizations can track what their agents actually do. In one recent survey of security and technology professionals, only 12.5% said they could consistently trace everything an agent did, including its hand-offs to other agents and the tools and APIs it called.
Within Wiz, visibility into live workload activity comes from Wiz Sensor, an opt-in monitoring agent installed on the workloads where AI agents run. It observes processes, file activity and network connections. Agentless cloud discovery solutions and model logs do not supply that same view inside a running workload.
Consider a situation where an agent calls one of its tools to run a script, and the script quietly opens a connection that eventually allows an attacker to send commands to the agent’s server. Matching that activity to the agent’s logged instructions shows whether it was doing its job or acting on an attacker’s orders.
How Wiz connects the three layers
Wiz introduced its AI Application Protection Platform, or AI-APP, in March 2026. It maintains a dynamic inventory of the AI applications and agents a company uses, whether they’re built on Amazon Bedrock, Azure AI or Google Vertex AI, regardless of whether those systems are accessed as SaaS subscriptions or developed in-house. Runtime detection draws on model activity, workload execution and cloud records, including identity use, API calls and infrastructure changes.
Wiz is also testing agent-intent detection, currently in private preview for Wiz Defend customers who run agents on Amazon Bedrock. It reads the instructions, recorded reasoning and tool calls in Bedrock’s model logs, looks for actions that drift from the agent’s assigned task, and connects what it finds to activity in the cloud and on the workload.
Investigating what an agent did usually means piecing together alerts from multiple layers. An alert from the model layer can show that an agent may have been manipulated, without showing what it did next. An alert from the workload can flag a suspicious process, without saying which agent was behind it or what cloud permissions it had. Wiz’s Security Graph connects these signals with the relevant identity, exposure and accessible data, helping analysts assess the incident’s reach.
Response happens within the platform. Where Wiz Sensor is deployed, configured Runtime Response Policies can terminate malicious processes, while Wiz Defend provides cloud detection and response. Guardrails can operate alongside these capabilities.
Agent monitoring, layer by layer
The table below breaks agent monitoring into four layers, with examples of the approaches used at each. Coverage can overlap across products.
| Layer | What gets monitored | What it can catch | Example approaches |
| Model inputs and outputs | Prompts, responses, retrieved content | Prompt injection, data leakage, unsafe outputs | NVIDIA NeMo Guardrails, HiddenLayer, Zenity, Wiz model-layer detection |
| Agent intent | Recorded reasoning and tool calls in model invocation logs | Tool calls that diverge from the assigned task | Wiz agent-intent detection (Amazon Bedrock, private preview), HiddenLayer session reconstruction |
| Workload execution | Processes, files and network activity when tools run | Reverse shells, unexpected processes and connections | Wiz Sensor |
| Cloud identity and APIs | Credentials, API calls, infrastructure changes | Suspicious use of an agent’s cloud identity | Wiz Defend cloud detection and response |
Putting agent monitoring into practice
Monitoring agents across all three layers can sound like a big project, especially when many teams are still working out how many agents they have and what each one can access. A manageable place to begin is a single agent that already touches a business system. Follow one of its tasks from the instruction it received to the changes it made, and check whether your records line up at each step.
Once that first test works, four practices extend it to the rest of your agents:
- Inventory every agent and the tools and credentials it can use.
- Give each agent its own identity with the least access it needs.
- Monitor tool execution inside the workload alongside the conversation.
- Link each alert to the cloud identity and data involved before deciding what action to take.
Run the test twice: once with an authorized task and once with a simulated attack, such as a planted instruction like the one in the customer email described earlier. Comparing the two shows what authorized and out-of-scope activity look like for that agent. The normal run gives security teams a baseline, so automated responses don’t block legitimate work, and the simulated attack reveals which signals point to a problem actually.
FAQs
Q.1 Can AI security platforms detect runtime threats?
Yes. Wiz combines model, workload, and cloud signals to investigate agent activity. NeMo Guardrails protects model interactions and can control tool use. Wiz Sensor records execution inside monitored workloads, adding evidence of what happened after a tool was called.
Q.2 Do all AI security systems monitor workloads during runtime?
No. Many inspect only prompts and responses. Seeing what agents do inside workloads requires a sensor running on those workloads, and following their actions further means tracking activity in the cloud accounts they reach.
Q.3 Is Wiz an AI guardrail tool?
No. Wiz detects and responds to threats across model, workload, and cloud layers. Guardrails can filter inputs and outputs and enforce tool-call controls. They can work alongside Wiz, constraining actions while runtime monitoring investigates activity across the surrounding systems.
Q.4 What does Wiz Sensor add to AI agent security?
Wiz Sensor records process, file, and network activity and supports terminating malicious processes through response policies. It is an opt-in monitoring agent for Linux and Windows, using eBPF on Linux and a thin kernel driver on Windows.
The bottom line
AI security platforms can monitor agents at runtime today, with the right telemetry in place. That monitoring becomes useful when a security team can follow a tool call through to its effects and connect those effects to the permissions and data involved. Before granting an agent more autonomy, teams should be able to reconstruct its actions across the systems it can reach.
Related: 8 Best Wiz Code Alternatives for AI-Powered Code Security in 2026
