Agent Detection and Response (ADR): A Practical Guide
Agent Detection and Response (ADR) monitors, warns on, and blocks unsafe AI coding agent actions at runtime. Here's how it works, what it detects, and how it differs from EDR.
Gensee journal
Ideas from
inside the system.
Research, engineering, and practical use cases for securing the work AI agents do.
AI Agent Runtime Monitoring: A SOC Operations Guide
A practical, SOC-focused guide to AI agent runtime monitoring: building behavior baselines, choosing alert thresholds that matter, and running triage from detection to resolution.
AI Agent Runtime Policy Design: A Practical Guide
A concrete guide to AI agent runtime policy design: process, file, network, and credential primitives, an observe-to-block promotion path, exception handling, and one policy across multiple coding agent harnesses.
AI Agent Runtime Security: The Systems Guide
A category guide to AI agent runtime security: a precise definition, where it sits relative to prompt filters, gateways and sandboxes, the enforcement and performance trade-offs that are real, and the questions that separate vendors.
AI Agent Runtime Tracing: What It Is and Why It Matters
AI agent runtime tracing correlates kernel-level process, file, and network activity with LLM intent, closing a blind spot that logs and LLM observability traces can't reach alone.
AI Agent Security Vendors Compared by Defense Layer
AI agent security vendors are compared here by the six layers they actually occupy, from prompt guardrails to session-spanning runtime defense, so buyers know what each layer can and cannot see.
AI Coding Agent Evaluation Framework for Enterprises
A seven-dimension AI coding agent evaluation framework enterprises can use to score capability, permissions, sandboxing, auditability, and runtime defense before rollout.
Auditing MCP Tool Calls: What to Record and Why
A practical guide to auditing MCP tool calls: what fields to record per call, where to capture them across client, gateway, and runtime layers, and why a tool's declared result isn't proof of its effect.
What Claude Code Can Reach on a Developer Laptop
A concrete, source-verified answer to what Claude Code can read, write, and connect to on a developer machine as of September 2026, which defaults widen that reach, and the settings that close it.
Claude Code Security Guide: Permissions, Sandbox, and Evidence
A maintained guide to Claude Code's native security controls as documented in September 2026: six permission modes, the Seatbelt and bubblewrap sandbox, protected paths, credential handling, managed settings, and the evidence enterprise teams still have to build themselves.
Codex Security: What It Scans and Where It Stops
Codex Security scans code and validates vulnerabilities before deployment, but it doesn't govern what a coding agent does at runtime. Here's what it covers, where it stops, and what closes the gap.
Cursor Security for Enterprise AI IDEs
A deployment-focused guide to Cursor security as of September 2026: agent reach across files, terminal, network and MCP, the three Run Modes, sandbox platform requirements, Privacy Mode, and the enterprise controls that hold.
Cursor vs Codex Security: A Date-Stamped Comparison
A factual comparison of Cursor and Codex security as of September 2026: execution environments, approval models, network defaults, platform requirements, classifier limits, and what each vendor says its guardrails do not cover.
Enterprise AI Agent Runtime Security Checklist
A phased, checkbox-style checklist covering coverage, policy, enforcement modes, evidence, SIEM integration, and rollout for enterprise AI coding agent runtime security.
Enterprise Security for Coding Agents
A decision hub for securing coding agents across an enterprise: who owns the risk, how agent identity differs from service identity, why standing privilege is the wrong default, what evidence to require, and how to evaluate vendors.
MCP Permission Design: Scoping Tools the Right Way
A practical breakdown of MCP permission design: scoping tools and operations, separating read from write, token scoping, consent UX, and why runtime enforcement matters more than declaration.
MCP Security Best Practices for Coding Agents
A technical guide to MCP security best practices for enterprise coding-agent environments, covering server vetting, tool poisoning defense, token scoping, and runtime verification.
Observe, Warn, Block: Choosing Enforcement Modes
How to choose between observing, warning and blocking for AI coding agent runtime controls: what each mode costs, the confidence thresholds that make blocking survivable, failure handling, and a rollout sequence with the metrics to watch.
Runtime Defense for AI Coding Agents: What It Takes
AI coding agents like Claude Code, Codex, and Cursor execute shell commands and push branches autonomously. Here's what runtime defense looks like concretely at the laptop, repository, and CI runner.
Runtime Forensics for AI Coding Agents Explained
Runtime forensics reconstructs what AI coding agents did across a full session and across sessions, closing the gap left by built-in approval logs in Codex and Claude Code.
Runtime Security Benchmark for Coding Agents: A Methodology
A reproducible methodology for benchmarking runtime security tools for AI coding agents, covering detection coverage, false positives, latency overhead, and evidence completeness.
Runtime Security vs PR Review: Closing the Coverage Gap
PR review only sees the diff an agent proposes; runtime security sees what happened during the session. Here's why enterprise teams need both.
Runtime Security vs Sandboxing for AI Coding Agents
Sandboxing contains where agent code can run; runtime security governs what it does across a whole session. Here's why enterprise AI coding agent deployments need both.
Runtime Tracing: Processes, Files, Network, Effects
An instrumentation guide for AI agent runtime tracing: the four domains worth capturing, how to build causal correlation rather than a timeline, cross-session lineage, the record schema auditors ask for, and SIEM export.
Sidecar Architecture for Agent Runtime Security
A technical assessment of the sidecar pattern for AI agent runtime security: what running beside the agent buys you, the four coverage limits inherent to interception, deployment trade-offs, and where the pattern ends.
How to Build a Threat Model for AI Coding Agents
A practical, step-by-step method for threat modeling AI coding agents like Claude Code, Codex, and Cursor, covering assets, trust boundaries, entry points beyond prompt injection, and capability composition.
Five Days, One Data Leak: Company Notes to Personal WhatsApp
How permitted company-data access becomes a multi-day AI disclosure risk when Obsidian notes mix work, public research, and a side job before a WhatsApp summary.
Legal AI Citation Verification: Finding a Case Is Only the First Step
How legal AI workflows can combine case research, citation verification, client-matter boundaries, and controlled document sharing.
AI Agents in Finance: Reconcile the Invoice Without Changing the Payee
Separate invoice reconciliation from payment authority with scoped records, controlled corrections, duplicate-action checks, and reviewable evidence.
Agent Detection and Response for Customer Support: From Order Tracking to Refunds
Apply ADR to support agents handling order tracking, delivery exceptions, and refunds, with customer scope, action limits, and connected evidence.
One AI Assistant, Two Contexts: Keeping Company Data Out of Personal Projects
Keep work and personal AI tasks separate across files, credentials, persistent context, cloud agents, and output destinations.
When an AI Agent Changes a Production Schedule: Controlling Manufacturing Workflows
Scope manufacturing agents to approved lines, work orders, and application actions, with checks for stale evidence, retries, and consequential changes.
AI-Powered Onboarding Without Overexposing Employee Data
Design HR onboarding agents around employee-specific records, approved fields, limited sharing, and a clear boundary between access requests and approvals.
When a Sales Agent Turns a Draft Into a Commitment
Control sales-agent research, CRM updates, pricing, discounts, and outbound proposals by separating account access from authority to make commitments.
Securing Healthcare Scheduling Agents: Patient Context, Permissions, and Messages
Scope healthcare scheduling agents to the right patient, appointment, approved intake fields, and communication destination across administrative workflows.
Agentic AI Security for Long-Horizon Coding Agents
AI coding agents like Claude Code, Codex, and Cursor create risk across entire sessions, not single prompts. Here's the control framework that closes the gap.
Cursor Security Review: Is It Safe for Production Code?
A security-engineering evaluation of Cursor security covering SOC 2 compliance, Privacy Mode, and the prompt injection and long-horizon risks compliance alone can't stop.
Forking Live Agent Workspaces, Blog 5: Integrating Live Workspace Forks into Agent Workflows
How request capture, host-owned cloning, identity rebinding, evidence, parallel comparison, and one-use approval turn workspace fork into an agent workflow.
Inside Eight Autonomous-Agent Runs: A Detailed Trace Analysis of Two Boundary Crossings
What activity, service semantics, persistence, and independent evidence reveal about two authority-bearing paths and their operation gates.
Four Conditions Behind OpenAI’s Agent Incident and How Gensee Crate Breaks the Chain
OpenAI’s incident and eight controlled Gensee Crate trials reveal a compounding systems chain—and the control points that can interrupt it.
Securing Coding Agents, One Operation at a Time
A systems architecture for binding agent intent, authority, execution, evidence, and accepted output around one bounded operation.
Reproducing the OpenAI–Hugging Face Package-Service Escape—and Releasing the Full Traces
A controlled, partial reproduction of the first Artifactory escape—with an animated successful run and open traces from eight blind trials.
From Ambient Privilege to Operation-Scoped Authority
How Gensee narrows authority across execution space and time with exact leases, multiple execution paths, and attested promotion.
Forking Live Agent Workspaces, Blog 4: Merge, Promote, Roll Back, or Discard
Why live workspace convergence needs different rules for files, process memory, GUI state, local services, and external effects.
Forking Live Agent Workspaces, Blog 3: GUI and Network Forking
How TClone brings the compositor inside each branch, isolates write-hot display state, reconnects TCP sessions, and draws a hard line around external side effects.
Forking Live Agent Workspaces, Blog 2: Files and the Page Cache
Why Btrfs snapshots can share disk blocks while duplicating file data in RAM, and how TClone applies CoW to the Linux page cache.
AP-006: Capability Composition in AI Coding Agents
AP-006 explains why individually legitimate files, shell commands, tools, memory, credentials, and network actions can compose into unapproved workflow-level authority.
Deep Dive: How an OpenAI Agent Breached Hugging Face—and How We Defend What Comes Next
A 17,600-action intrusion reveals how agent containment failed—and points toward forked environments, forensic replay, and full-stack provenance.
Forking Live Agent Workspaces, Blog 1: Process Trees, Memory, and CoW
How TClone captures a live Linux process graph, reconstructs threads and resources with CRIU, and shares memory pages across sibling containers.
AP-005: Package Supply Chain in AI Coding Agents
AP-005 explains why AI coding agents move software supply-chain risk upstream: package selection itself becomes the first external-trust decision.
Inside Kimi K3's AgentENV: Can It Really Fork in 100 ms?
Follow AgentENV's Firecracker dirty-memory path, see what its 100-millisecond snapshot claim measures, and compare its real scaling with TClone's direct copy-on-write approach.
AP-004: Credential Harvesting in AI Coding Agents
AP-004 explains how legitimate debugging, deployment, CI, and infrastructure tasks can lead coding agents toward credentials, tokens, kubeconfigs, and authenticated tool state.
Forking Live Agent Workspaces, Blog 0: Choosing the Right System Boundary
Git branches files, fork() branches one process, and VMs branch machines. Blog 0 explains why a live container is a useful boundary for branching coding-agent workspaces.
AP-003: Repository Recon in AI Coding Agents
AP-003 explains how coding agents build a Repository Mental Model from source, manifests, CI, deployment, infrastructure, and secret references before later actions.
AI Has Moved the First Trust Decision
HalluSquatting shows why AI coding agents move dependency selection upstream, turning model reasoning into the first software supply-chain trust decision.
15 Questions Every Engineering Team Should Answer Before Deploying AI Coding Agents
A practical 15-question checklist for engineering teams deploying AI coding agents, covering runtime isolation, authorization, visibility, enforcement, recovery, and governance.
AP-002: Intent Drift in AI Coding Agents
AP-002 explains how AI coding agents can turn task progress into permission, expanding from source edits into registry, signing, publishing, or deployment authority.
The Real Security Story Behind the First Reported Agentic Ransomware
JadePuffer shows why the key agentic ransomware risk is control-plane compression: agents can observe, diagnose, retry, and continue destructive workflows at runtime.
AP-001: Multi-Step Data Exfiltration in AI Coding Agents
AP-001 explains how retrieval, synthesis, recomposition, and outbound sharing can turn normal coding-agent actions into workflow-level data exfiltration.
Claude Code Prompt Steganography Shows Why Agent Security Needs Runtime Evidence
A newly revealed Claude Code prompt-steganography issue shows why coding-agent trust needs runtime evidence, attribution, provenance, and deeper host-level controls.
What Is Agent Defense and Response? A Practical Guide to AI Agent Security
Agent Defense and Response explained for developers, founders, and small teams: permissions, prompt injection, tool misuse, least privilege, logs, and recovery.
Claude Fable 5 Shows Why AI Agent Security Is Becoming Runtime Security
Claude Fable 5 is a reminder that agent security is moving beyond prompts into runtime visibility, attribution, process lineage, tool execution, and long-horizon provenance.
Open-Sourcing Gensee Crate
Runtime safety for coding agents that goes deeper into system events, tool calls, skills, and memory, and longer across requests and sessions where risk emerges as a chain.
AI Agent Safety Ecosystem Map
A practical map of the AI agent safety stack: where agentic systems create risk, which layers reduce that risk, and why runtime control becomes the missing layer as agents start taking real actions.
Memory Poisoning Attacks on Long-Horizon AI Agents
As AI agents gain persistent memory across sessions, attackers have found a new vulnerability: memory poisoning. Learn what it is, real attack examples including credential harvesting and slow trust exploits, and defense strategies for security teams.
Multi-Session Agent Safety: When Persistent Memory Goes Wrong
Beyond security attacks, long-horizon AI agents face safety challenges from accidental failures: context drift, state inconsistency, session boundary confusion, and cascade failures. Here's how to design safer multi-session experiences with recovery patterns and UX guardrails.
Beyond prompt injection: Meta's Instagram AI exploit and CVE-2026-2256
Two recent incidents — Meta's AI-powered Instagram support exploit and CVE-2026-2256 in ModelScope's ms-agent — show that AI agent security is a cross-layer execution problem. Defense in depth, real-time safeguards, prevention before execution, and rollback are what work.
AI Agent Security: Risks, Defenses, and ADR
The real risks individuals and businesses face when they rely on AI agents, the layered defenses that work, and what ADR (Agent Detection and Response) is — the agent-economy counterpart to EDR. In production, credential exposure leads, not prompt injection.
The Glass Wall Shatters: A Professor's Reflection on the ICLR 2026 Breach
Dec 2, 2025
A professor's perspective on the OpenReview data breach, AI-generated peer reviews, and the future of scientific validation in the age of AI.
Databricks Agent Bricks vs. AWS AgentCore vs. Gensee
July 31, 2025
An in-depth comparison of three leading platforms for building and deploying the next generation of AI agents.
Agent Auto-Tuning with Cognify Pt.2
March 13, 2025
Dive deeper into the technical secret sauce behind Cognify's efficient and effective autotuning: the AdaSeek algorithm.
Agent Auto-Tuning with Cognify Pt.1
March 12, 2025
Is it possible to autotune a 4-step gen-AI workflow's generation quality with a budget of $5 and 30 minutes instead of $168K and weeks?
No posts match your search.