Phantom Labs research finds coding agents requested 1.28 million shell commands in four weeks, while widespread MCP connections and embedded agent skills expand enterprise security risks.
AI agents are becoming an increasingly powerful part of enterprise workflows, but their ability to translate a single prompt into multiple actions is creating a new security challenge: ensuring they do not exceed their intended scope.
BeyondTrust has announced the general availability of AI Agent Security on its Pathfinder Platform, introducing runtime controls designed to govern individual AI agent actions without restricting the permissions employees need to do their jobs.
The launch is backed by research from BeyondTrust Phantom Labs, which analysed endpoint telemetry from AI coding-agent activity in early customer environments. Over four weeks, the researchers observed approximately 1.28 million shell command requests associated with around 132,000 prompts, averaging nearly 10 command requests per prompt. The company cautions that these figures represent requested commands, not necessarily successfully executed commands.
The findings highlight the gap between what a user asks an AI agent to do and the sequence of actions the agent may subsequently request. This makes visibility and policy enforcement important safeguards against unintended or unauthorised activity.
The research also found that 85% of observed coding-agent users had at least one Model Context Protocol (MCP) server configured. Connected users averaged 4.35 servers, with one user linked to as many as 36. These integrations can extend agents across multiple platforms, but may also create opportunities for unauthorised access, data exposure and manipulation if an account or connected service is compromised.
“AI agents need their own privilege controls, separate from the permissions of the humans they serve.” — Marc Maiffret, CTO, BeyondTrust
Agent skills present another concern. According to Phantom Labs, roughly half of skill installations arrive bundled within code repositories. Such skills can influence agent behaviour and contain executable code, making unverified or compromised components a potential route for abuse.
Marc Maiffret, CTO of BeyondTrust, said AI agents increasingly operate with access similar to that of their human users. He argued that organisations need to control agent privileges before actions occur, rather than assume that permissions granted to an employee should automatically extend to the employee’s AI tools.
AI Agent Security applies BeyondTrust’s visibility, intelligence and protection framework to endpoint-based AI activity. It discovers agents, including internally hosted models, shadow AI and sub-agents; distinguishes machine-driven actions from human activity; and captures context such as the agent’s owner, session, skills and MCP connections.
The platform evaluates agent actions against policy at runtime and can enforce approved workflows or invoke just-in-time access and human approval when additional privileges are required.
Available now for Windows and macOS endpoints, the solution was co-developed by Phantom Labs and the team behind BeyondTrust Endpoint Privilege Management. It extends endpoint privilege controls to AI agents, giving security teams a way to govern automated activity while preserving legitimate employee access.
As enterprises move from AI experimentation towards autonomous workflows, the ability to identify which agent is acting, what it can access and whether each action is authorised is becoming a critical part of enterprise security.
