Palo Alto, CA – [Insert Date] – The enterprise landscape is undergoing a seismic shift as Artificial Intelligence (AI) agents rapidly move from experimental labs to the core of production environments. Over the past two years, businesses have aggressively embraced AI, empowering agents to interact with critical systems, including production code, sensitive internal databases, customer support tickets, and financial ledgers. However, this rapid adoption has outpaced security infrastructure, creating a new and significant vulnerability. The non-deterministic and broadly capable nature of these AI agents makes them susceptible to manipulation, leading to unexpected or malicious behavior that can escalate into operational liabilities, fundamentally transforming AI risk from a mere chatbot hallucination to a tangible threat to business continuity.
Traditional security measures, such as software containers and prompt-level guardrails, are proving insufficient against these evolving threats. Furthermore, legacy endpoint security solutions, designed for conventional system processes and user access, were not built to secure AI agents that operate with real user permissions. This emerging security blind spot demands a new paradigm. Just as Palo Alto Networks pioneered Extended Detection and Response (XDR) to unify security across network, identity, and cloud, the company is now extending this comprehensive protection to secure AI agents within the enterprise.
The Rise of Agentic Endpoints: A New Attack Surface Emerges
The modern endpoint has transformed dramatically. Once a relatively controlled execution environment, it has evolved into a complex ecosystem populated by AI coding agents, AI co-pilots, Machine Control Plane (MCP) servers, and personal AI agents. These entities often possess direct access to sensitive data and critical enterprise systems, allowing them to bypass traditional security controls and operate within previously unseen blind spots.
The danger becomes acute when an AI agent encounters untrusted input, connects to a compromised enterprise application, or executes an unauthorized command. In such instances, a tool designed for productivity transforms into an active risk vector. The combination of real user permissions and the inherently non-deterministic behavior of AI agents presents security teams with a compounding set of challenges that extend far beyond simple prompt injection attacks.
The proliferation of "shadow AI" further exacerbates this problem. Employees are increasingly adopting personal AI agents and browser-based tools that bypass IT oversight, creating an unmanaged and unmonitored landscape of AI applications across endpoints. Simultaneously, sophisticated adversaries are actively exploiting connected systems to manipulate these agents. By poisoning the external data sources, databases, or Software-as-a-Service (SaaS) applications that an agent relies upon, attackers can indirectly alter its behavior without ever directly interacting with the AI model itself. Without robust, hard boundaries, an AI agent can be easily tricked into escalating host privileges, bypassing local containers, or executing arbitrary system commands. In essence, the agent escapes its intended operational sandbox and becomes an unwitting insider threat, capable of causing significant damage.
The threat is not theoretical. Recent security incidents have underscored the alarming reality of these vulnerabilities. In the ClawHavoc supply chain attack, adversaries targeted AI agents by uploading hundreds of malicious skills to the OpenClaw marketplace. Once installed, these rogue skills breached runtime isolation, granting remote attackers direct command-line access on the host system. Unit 42 research has also demonstrated how AI agents can be manipulated into revealing secret system prompts or sensitive information through indirect data poisoning originating from connected applications. Furthermore, agents have been shown to bypass system and access controls when tricked into issuing unauthorized API calls or executing system tools under the guise of legitimate user permissions. The rise of shadow AI, where ungoverned and unmonitored agents deployed by employees silently inherit elevated system privileges without IT visibility, further compounds these risks.
Cortex XDR One: A Unified Defense for the Agentic Era
Recognizing the nascent risks associated with agentic AI, Palo Alto Networks has proactively developed a comprehensive solution. The company’s InfoSec team identified and deployed Koi, an early-stage startup focused on securing AI agentic endpoint behavior, even before Koi was publicly available. Impressed by Koi’s innovative capabilities, Palo Alto Networks acquired the company, integrating its expertise and technology to offer direct protection to its customers.
This integration has culminated in Cortex XDR One, a groundbreaking platform that unites the power of Cortex XDR with Cortex Agentic Endpoint Security (AES). This synergy provides a single user interface and sensor for centralized visibility, management, and investigation of both traditional system processes and the burgeoning AI agents operating within enterprise environments. Cortex XDR One is engineered to enforce layered security across an agent’s entire execution path, controlling its actions at the source, establishing hard boundaries at the operating system level, and detecting rogue behavior through an AI-driven defense layer.
An Emerging Security Blind Spot: The Expanding Endpoint Ecosystem
The evolution of endpoints from simple computing devices to complex ecosystems hosting AI agents, co-pilots, and personal assistants with access to highly sensitive data necessitates a fundamental rethinking of security. These AI artifacts can readily circumvent traditional security measures, creating critical blind spots for security teams.
When an agent ingests untrusted input, connects to a compromised enterprise application, or executes an unauthorized command, it transforms from a productivity enhancer into a significant risk vector. The combination of real user permissions and the unpredictable nature of AI behavior presents security teams with a formidable challenge that transcends simple prompt injection vulnerabilities.
The widespread adoption of personal AI agents and browser tools by employees, often bypassing IT oversight, has led to the pervasive spread of "shadow AI" across endpoints. This creates an unmanaged and unmonitored attack surface. Concurrently, attackers are actively exploiting connected systems to manipulate these agents. By poisoning the external data sources, databases, or SaaS applications that an agent relies on, adversaries can indirectly alter its behavior without ever directly compromising the AI model itself. Without robust, hard boundaries, an agent can be easily manipulated into escalating host privileges, circumventing local containers, or executing arbitrary system commands. In essence, the agent escapes its intended operational sandbox and becomes an unwitting insider threat, capable of causing significant damage.
The threat landscape is already evolving rapidly. The ClawHavoc supply chain attack, for instance, targeted AI agents by introducing hundreds of malicious skills to the OpenClaw marketplace. Once installed, these rogue skills breached runtime isolation, granting remote attackers direct command-line access on the host system. Unit 42 research has further demonstrated how AI agents can be tricked into revealing secret system prompts or sensitive information through indirect data poisoning originating from connected applications. Additionally, agents have been shown to bypass system and access controls when manipulated into issuing unauthorized API calls or executing system tools under the guise of legitimate user permissions. The rise of "shadow AI"—ungoverned, unmonitored agents deployed by employees that silently inherit elevated system privileges without IT visibility—further compounds these risks.
Cortex XDR One: Comprehensive Protection from a Single Platform
Cortex XDR One offers a unified security experience, integrating Cortex XDR and Cortex Agentic Endpoint Security through a single user interface and sensor. This provides organizations with centralized visibility, management, and investigation capabilities.
From sanctioned AI agents to the pervasive shadow AI, Cortex XDR One equips security teams with a real-time inventory of every AI artifact present on an endpoint the moment it appears. This comprehensive visibility into all agent activity across the enterprise empowers security teams to control which packages, extensions, agents, and AI artifacts are permitted for installation and use. For instance, a Chief Information Security Officer (CISO) can assess which AI coding agents are actively being utilized by engineering teams and make informed decisions regarding the productivity impact versus the potential security risks of removing access to a specific agent.
Securing the modern endpoint demands a unified defense that spans both the AI agent lifecycle and the underlying operating system. Cortex XDR One delivers this comprehensive protection, from the initial software installation to live execution. Within the agent layer, it enforces runtime guardrails to help prevent prompt injections and destructive commands. Simultaneously, at the operating system layer, Cortex XDR One continuously monitors runtime process chains to block zero-day exploits and living-off-the-land attacks in real time, all without impacting performance. To further enhance these defenses, optimized small language models run directly on the endpoint sensor, guarding against evasive, fileless threats even when offline and without transmitting sensitive code to the cloud. By stitching together cross-domain telemetry into clear, end-to-end attack chains, Cortex XDR One dramatically reduces false positives, by up to 95%, and drives automated remediation within minutes.
Ultimately, consolidating this critical security telemetry onto a single sensor eliminates fragmented point solutions and establishes a powerful operational foundation. This empowers Cortex XSIAM (Security Operations) with the essential data required to effectively govern AI risk across the entire enterprise.
Flexible Deployment: Standalone Agentic Security or Native Integration
Cortex Agentic Endpoint Security (AES) is specifically designed to govern AI tools, MCP servers, and agentic workflows running on hosts. Organizations have the flexibility to deploy AES alongside their existing third-party Endpoint Detection and Response (EDR) environments by utilizing the targeted Cortex sensor.
However, for organizations seeking to streamline operations, AES and XDR can be seamlessly integrated natively within Cortex XDR One. By unifying agentic defense and Extended Detection and Response into a single sensor and platform, Cortex XDR One bridges the gap between traditional host security and emerging AI risks, delivering unparalleled visibility, management, and real-time investigation capabilities.
Setting a New Baseline for Endpoint Security
The era of standalone EDR is rapidly becoming obsolete. Just as XDR evolved beyond siloed endpoint detection and response to encompass network, identity, and cloud security, the protection of the modern enterprise now necessitates native capabilities for autonomous AI workloads. EDR solutions that lack integrated agentic security are fundamentally incomplete and represent a legacy approach. Disconnected point solutions fail to provide visibility into OS execution, while bolt-on EDR offerings struggle to correlate an agent’s prompt and tool context with subsequent system behaviors. Relying solely on traditional EDR for AI agent security is akin to deploying a bird of prey to guard a flock; it might offer some protection, but it will likely only intervene after the wolf has already attacked.
Cortex XDR One establishes a new benchmark for endpoint security, offering unmatched visibility and preemptive control across both the operating system and AI layers within a single, unified sensor.
Scaling Enterprise AI with Confidence: The Role of Managed Services
While Cortex XDR One provides robust standalone protection, security leaders grappling with this complex new attack surface can further augment their team’s capabilities with Unit 42 MDR (Managed Detection and Response). Unit 42 now includes Managed Agentic Endpoint Security, combining the telemetry from Cortex XDR One with elite threat intelligence. Unit 42 experts deliver proactive threat hunting, in-depth incident investigation, and expert AI risk governance to bolster overall enterprise resilience.
Securing the Agentic Frontier: A Pivotal Transition
As organizations accelerate their adoption of AI agents, security teams face a pivotal transition. The rapid expansion of agentic capabilities across enterprise endpoints demands a security posture that treats AI agents with the same rigor and control as traditional system processes.
By unifying agentic endpoint defense and XDR into a single sensor and platform, Cortex XDR One sets a new standard for endpoint security in the agentic era. Whether deployed independently or bolstered by the expertise of Unit 42, Cortex XDR One empowers security leaders with the critical visibility and control needed to eliminate shadow AI, enforce operational guardrails, and confidently accelerate their AI transformation initiatives. The future of enterprise security lies in embracing these new technologies while ensuring robust and proactive defense mechanisms are in place to mitigate evolving risks.
