Phantom Labs research shows AI Agents are acting beyond intent. BeyondTrust AI Agent Security, now available, stops them. * BeyondTrust Phantom Labs(R) observed 1.28 million shell commands requested from approximately 132,000 prompts in four weeks, averaging nearly 10 commands per prompt * 85% of observed coding-agent users had at least one MCP server invoked, averaging 4.35 servers per connected user, with as many as 36 * Now available on the BeyondTrust Pathfinder Platform, AI Agent Security provides real-time control over individual AI agent actions without restricting the same actions for human users BeyondTrust, the global leader in privilege-centric identity security protecting Paths to Privilege(TM) for human, machine, and agentic identities, today announced the general availability of AI Agent Security on the BeyondTrust Pathfinder Platform, alongside new research from BeyondTrust Phantom Labs(R) revealing the scale of AI agent activity and the expanding connections these agents introduce across enterprise endpoints. Drawing on endpoint telemetry from our True Privilege(R) Graph, Phantom Labs research revealed: * Nearly 10 shell commands requested per prompt. AI coding agents requested approximately 1.28 million shell commands from 132,000 prompts, demonstrating how a single prompt can translate into multiple downstream command requests. This highlights the lack of a direct correspondence between prompt and subsequent command execution. Should an agent attempt to go beyond the intended scope of a prompt, observability and policy enforcement are essential to preventing and mitigating potential security incidents. * 85% of observed coding-agent users had MCP server connections. Among users with coding agents configured, 85% had at least one MCP server configured, averaging 4.35 unique servers per connected user, with one user connected to 36. These connections extend an agent's reach, potentially allowing it to act across multiple platforms with delegated use access. This expands the attack surface because adversaries that can gain access to a user's AI account may be able to act as that user across connected platforms without obtaining separate credentials. When invoked, MCP servers can receive user prompts and influence agent behaviour through their responses. Without visibility into MCP activity, these connections introduce privacy and compliance risks and create opportunities for malicious servers to exfiltrate sensitive data or manipulate agent actions. * About half of agent skill installs arrive bundled in code repositories. In a mid-sized enterprise environment where 60% of AI-active devices ran a coding agent, a typical user with agent skills had approximately two dozen installed, and at least one in seven installed skills was used within four weeks. Agent skills not only influence prompt input and output, but also often contain embedded code. As adversaries actively distribute and poison legitimate skills, organisations without the ability to audit and enforce skill policy may be ceding unknown control over to unapproved and/or compromised skills. BeyondTrust's newest release, AI Agent Security, addresses these challenges by distinguishing AI agent activity from human activity and enforcing what agents are permitted to do at runtime, before unauthorized actions occur, without restricting the permissions employees need to perform their jobs. "AI agents are increasingly acting on behalf of employees, often with the same access as the humans using them," said Marc Maiffret, CTO, BeyondTrust. "That dramatically expands who and what can exercise privilege, and when those agents operate autonomously and at machine speed, organizations need to control that privilege before an action is taken. AI Agent Security separates what the human is permitted to do from what the AI agent is permitted to do, so organisations can embrace the power of AI without assuming that everything a human is permitted to do should also be permitted for their AI agent." Controlling AI Agents before they act. AI Agent Security applies BeyondTrust's Visibility, Intelligence, and Protection framework to agentic AI on the endpoint, giving security teams the context and control to govern AI agents without limiting the access employees need to do their jobs. Rather than relying solely on blocking known commands or detecting risky behaviour after it occurs, BeyondTrust evaluates individual AI agent actions against policy at runtime to determine what an AI agent is permitted to do before an action is taken. * Visibility: Discover AI agents operating across endpoints, including frontier AI tools, internally hosted models, shadow AI, and ephemeral sub-agents, providing a fleet-wide inventory of agentic AI activity. * Intelligence: Distinguish human activity from AI agent activity and capture the context behind agent actions, including the human owner, device, agent session, skills, and MCP activity. * Protection: Enforce policy at runtime across agent actions, providing secure, approved paths to task completion and invoking just-in-time or human approval when additional privilege is required. "AI agents fundamentally change the security equation. These are not just applications accessing data; they can make decisions, invoke tools, take actions, and exercise delegated authority at machine speed," said David Morimanno, Field CTO, Xalient. "That forces security to shift from simply managing access to continuously managing trust. The question is no longer just, 'Does this identity have access?' It is, 'Do we trust this agent to take this action, with this level of authority, in this context, right now?' BeyondTrust AI Agent Security helps bring that trust decision and enforcement closer to the endpoint, giving organisations a way to govern AI-driven actions in real time without slowing down AI adoption." AI Agent Security is generally available now. AI Agent Security is generally available today on the BeyondTrust Pathfinder Platform for Windows and macOS endpoints. Co-developed by Phantom Labs and the team behind BeyondTrust Endpoint Privilege Management (EPM), AI Agent Security extends BeyondTrust's proven endpoint privilege enforcement capabilities to a new class of non-human identities, bringing AI agent visibility and guardrails into the same platform organisations use to understand and secure privilege across their environment. * For more information about AI Agent Security or to request a demo, visit: https://www.beyondtrust.com/products/ai-agent-security * To learn more about identifying, understanding, and controlling AI agent activity, register for the AI Agents Among Us webinar. * For the latest research from BeyondTrust Phantom Labs, visit: https://www.beyondtrust.com/channel/phantom-labs Research methodology. BeyondTrust Phantom Labs(R) analysed endpoint telemetry from AI coding-agent activity against early customer samples, including shell command requests. MCP findings reflect observed coding-agent users on Windows and macOS and include locally configured and plugin-added servers. Shell command figures represent agent-requested commands, not necessarily successful executions. About BeyondTrust. BeyondTrust is the global leader in privilege-centric identity security protecting Paths to Privilege(TM). Identity alone doesn't create risk. Privilege does. As human, machine, and AI agent identities explode across every environment, BeyondTrust is the only company built to discover, control, and secure privilege across all of them from a single platform. Trusted by 20,000+ customers, including 75 of the Fortune 100, and recognised as a multi-category leader by top industry analysts, BeyondTrust reframes identity security from a management problem into a strategic advantage. Learn more at www.beyondtrust.com.

Phantom Labs research shows AI agents are acting beyond intent. BeyondTrust AI Agent Security, now available, stops them. BeyondTrust announced the general availability of AI Agent Security on the BeyondTrust Pathfinder Platform, alongside new research from BeyondTrust Phantom Labs revealing the scale of AI agent activity and the expanding connections these agents introduce across enterprise endpoints. Drawing on endpoint telemetry from our True Privilege(R) Graph, Phantom Labs research revealed: * Nearly 10 shell commands requested per prompt. AI coding agents requested approximately 1.28 million shell commands from 132,000 prompts, demonstrating how a single prompt can translate into multiple downstream command requests. This highlights the lack of a direct correspondence between prompt and subsequent command execution. Should an agent attempt to go beyond the intended scope of a prompt, observability and policy enforcement are essential to preventing and mitigating potential security incidents. * 85% of observed coding-agent users had MCP server connections. Among users with coding agents configured, 85% had at least one MCP server configured, averaging 4.35 unique servers per connected user, with one user connected to 36. These connections extend an agent's reach, potentially allowing it to act across multiple platforms with delegated use access. This expands the attack surface because adversaries that can gain access to a user's AI account may be able to act as that user across connected platforms without obtaining separate credentials. When invoked, MCP servers can receive user prompts and influence agent behavior through their responses. Without visibility into MCP activity, these connections introduce privacy and compliance risks and create opportunities for malicious servers to exfiltrate sensitive data or manipulate agent actions. * About half of agent skill installs arrive bundled in code repositories. In a mid-sized enterprise environment where 60% of AI-active devices ran a coding agent, a typical user with agent skills had approximately two dozen installed, and at least one in seven installed skills was used within four weeks. Agent skills not only influence prompt input and output, but also often contain embedded code. As adversaries actively distribute and poison legitimate skills, organizations without the ability to audit and enforce skill policy may be ceding unknown control over to unapproved and/or compromised skills. BeyondTrust's newest release, AI Agent Security, addresses these challenges by distinguishing AI agent activity from human activity and enforcing what agents are permitted to do at runtime, before unauthorized actions occur, without restricting the permissions employees need to perform their jobs. "AI agents are increasingly acting on behalf of employees, often with the same access as the humans using them," said Marc Maiffret, CTO, BeyondTrust. "That dramatically expands who and what can exercise privilege, and when those agents operate autonomously and at machine speed, organizations need to control that privilege before an action is taken. AI Agent Security separates what the human is permitted to do from what the AI agent is permitted to do, so organizations can embrace the power of AI without assuming that everything a human is permitted to do should also be permitted for their AI agent." Controlling AI agents before they act. AI Agent Security applies BeyondTrust's Visibility, Intelligence, and Protection framework to agentic AI on the endpoint, giving security teams the context and control to govern AI agents without limiting the access employees need to do their jobs. Rather than relying solely on blocking known commands or detecting risky behavior after it occurs, BeyondTrust evaluates individual AI agent actions against policy at runtime to determine what an AI agent is permitted to do before an action is taken. * Visibility: Discover AI agents operating across endpoints, including frontier AI tools, internally hosted models, shadow AI, and ephemeral sub-agents, providing a fleet-wide inventory of agentic AI activity. * Intelligence: Distinguish human activity from AI agent activity and capture the context behind agent actions, including the human owner, device, agent session, skills, and MCP activity. * Protection: Enforce policy at runtime across agent actions, providing secure, approved paths to task completion and invoking just-in-time or human approval when additional privilege is required. "AI agents fundamentally change the security equation. These are not just applications accessing data; they can make decisions, invoke tools, take actions, and exercise delegated authority at machine speed," said David Morimanno, Field CTO, Xalient. "That forces security to shift from simply managing access to continuously managing trust. The question is no longer just, 'Does this identity have access?' It is, 'Do we trust this agent to take this action, with this level of authority, in this context, right now?' BeyondTrust AI Agent Security helps bring that trust decision and enforcement closer to the endpoint, giving organizations a way to govern AI-driven actions in real time without slowing down AI adoption." AI Agent Security is generally available now. AI Agent Security is generally available today on the BeyondTrust Pathfinder Platform for Windows and macOS endpoints. Co-developed by Phantom Labs and the team behind BeyondTrust Endpoint Privilege Management (EPM), AI Agent Security extends BeyondTrust's proven endpoint privilege enforcement capabilities to a new class of non-human identities, bringing AI agent visibility and guardrails into the same platform organizations use to understand and secure privilege across their environment. David Marshall is the founder of VMblog.com, one of the industry's longest-running independent publications covering modern data center technologies. What began as a focus on virtualization and cloud computing has expanded to cover the full spectrum of enterprise IT, including AI, security, and DevOps, making VMblog a trusted destination for vendor news, technology analysis, and industry commentary.Beyond publishing, David has spent his career at the intersection of technology and business, inventing, marketing, and launching a number of successful software companies and products, and building a reputation as a skilled marketing executive in the enterprise IT space.David is also a published author, having written two well-regarded books on virtualization and served as technical editor for two "For Dummies" titles covering virtualization and cloud computing. He co-founded CloudCow.com, a publication focused on cloud computing, and has been named a VMware vExpert every year since 2009, one of the longest continuous honoree streaks in the program's history.Connect with David on LinkedIn: https://www.linkedin.com/in/davidmarshall/

Google warns china-linked hackers exploited BeyondTrust zero-day. Google says China-linked hackers exploited a critical BeyondTrust zero-day. See affected versions, patch guidance, and what defenders should check now. Oct 16, 2026 eSecurity Planet content and product recommendations are editorially independent. Esecurityplanet may make money when you click on links to its partners. Learn More BeyondTrust customers have more than a patching problem on their hands. A suspected China-linked espionage group exploited a critical Remote Support flaw as a zero-day, then gained root access, attempted to harvest stored credentials, and accessed downstream systems, according to Mandiant. Google warned that ARMORY CASTLE exploited CVE-2026-102764 in late August and could broaden attacks now that the bug is public. BeyondTrust rates the flaw critical at 9.3 and says Remote Support versions 26.2.3 and earlier are affected. SaaS customers were patched by Oct. 9, while self-hosted customers need to verify that BT26-05-RS has been installed. China-linked hackers turned remote support into root access. Reuters reported that Google and Mandiant tied the August exploitation to ARMORY CASTLE, a suspected China-linked threat group. Successful exploitation gave the attackers access to credentials, allowed arbitrary file uploads, and opened the door to control of the affected host. The Hacker News, citing Mandiant, reported that the attackers deployed the SAWFLY PHP webshell and escalated privileges to root. They also tried to harvest credentials from BeyondTrust's native secrets database and changed Remote Support permissions to access downstream systems. The attackers later deployed the BARECLAW tunneler and deleted system, web server, and application logs to make detection harder. For defenders, the concern is not limited to the appliance itself. Remote Support is designed to give administrators access to other endpoints, so a compromised server can become a route into systems already trusted by the organization. CVE-2026-102764 affects Remote Support 26.2.3 and earlier. BeyondTrust said CVE-2026-102764 is an improper origin validation flaw in an internal messaging component. Under the right conditions, a remote attacker can use it to perform file operations on an affected appliance. The company rates the vulnerability critical, with a CVSS v4.0 score of 9.3. All Remote Support versions through 26.2.3 are affected. BeyondTrust said it had applied the patch to all SaaS customers by Oct. 9. Self-hosted customers running versions 24.3.1 through 26.2.3 should apply BT26-05-RS or verify that automatic updates installed it. Customers on older releases must upgrade before applying the patch. BeyondTrust also recommends a precautionary patch for self-hosted Privileged Remote Access appliances because they share affected code. The company said testing had not identified a way to exploit the vulnerability in that product Patching is only the first step. Google warned that public disclosure could lead to broader opportunistic exploitation, making exposed BeyondTrust appliances a higher-priority target. Infosecurity Magazine noted that organizations with suspected exposure should preserve telemetry before making changes and may need to rebuild appliances when compromise is confirmed or cannot be ruled out. For security teams, installing BT26-05-RS closes the vulnerability but does not undo activity that may have already occurred. ARMORY CASTLE demonstrated that attackers could use a compromised Remote Support appliance to obtain privileged credentials, establish persistence, and reach systems managed through the platform. An organization therefore needs to determine whether the appliance was exploited before the patch was installed. Security teams should prioritize three actions: * Verify patch status: Confirm that self-hosted Remote Support appliances have received BT26-05-RS. Systems running versions older than 24.3.1 need to be upgraded before the patch can be applied. * Hunt for compromise: Review privilege changes, missing logs, altered proxy or startup settings, suspicious administrator permissions, and signs of SAWFLY or BARECLAW. Teams should also examine whether unexpected remote sessions or file transfers occurred. * Contain affected systems: Restrict appliance traffic, end active support sessions, rotate exposed credentials, and rebuild from a clean patched image when compromise is confirmed or cannot be ruled out. The risk can extend beyond the Remote Support appliance itself. The product can broker privileged access to other endpoints, so stolen credentials or persistent administrator access could give attackers a path into additional systems even after the original vulnerability is patched. For organizations that had an internet-facing appliance running an affected version during the exploitation window, the safer response is to treat patching and compromise assessment as separate tasks. Confirm the fix first, then determine whether attackers gained access before it was installed and whether credentials, sessions, or downstream systems also need remediation. Kezia Jungco is a staff writer with five years of hands-on experience testing and analyzing generative AI platforms, chatbots, and NLP tools. She writes in-depth coverage for both enterprise and consumer audiences, focusing on artificial intelligence, data analytics, CRM solutions, cloud infrastructure, cybersecurity, and emerging tech trends. Her work appears in TechRepublic, eWEEK, Datamation, TechnologyAdvice, and Selling Signals.