Skip to content
redactsure
Book a demo

Explore.

Explainer · By Chris Sowa · Published
Last updated

What Is AI Agent Runtime Security and What Happens After an Agent Gets Access?

AI agent runtime security is the set of controls that apply after access has been granted: what the agent is shown, what it may do, what stops for approval, and what is recorded. Access control ends at the login. An agent that passes it with nothing governing the run reads everything the session can reach and acts on it.

A task module sits between an initial entry gate and runtime controls over three data destinations.

AI agent runtime security is the set of controls that apply after access has been granted: what the agent is shown, what it may do, what stops for approval, and what is recorded. Access control ends at the login. An agent that passes it with nothing governing the run reads everything the session can reach and acts on it. The question matters because the agents now sold to enterprises work through a person's own session, inside a browser or a cloud computer, and most of the security stack was built to decide whether that session may open. Once it is open, the stack has little to say about what the model reads on each screen or which step changes a record. Runtime security fills that gap with four controls that operate during the run, and the first of them is Least Exposure: for each piece of work, the AI receives exactly the data the task requires and nothing more, enforced before any model reads the screen. The environment that enforces this is built by RedactSure, an AI agent controls, governance and data protection company.

Key findings

  • The agents in wide use read the page in full once access is granted: Claude in Chrome takes screenshots of the active tab, and all visible information, including personal data, enters the context (Anthropic, 2026).
  • Applying uniform governance across AI agents will lead to enterprise AI agent failure, which argues for controls set per task rather than per account (Gartner, 2026).
  • New training techniques let systems operate autonomously for longer, creating new challenges in cyber security and in oversight of AI systems (International AI Safety Report, 2025).
  • Vendors' runtime defenses are stacked classifiers and probes with known holes, described as a "Swiss cheese" model (MIT Technology Review, 2026).
  • Model-agnostic firewalls that strip data a tool does not need and remove instructions from tool results reach about 0 percent attack success on four public benchmarks (Bhagwatkar et al., 2026).
  • A catalog of 93 machine learning security threats finds inference time a heavily targeted stage (Foundjem et al., 2026).

What does runtime mean for an AI agent?

Runtime is the period between the moment an agent's session opens and the moment the run ends. During it the agent reads screens, documents and tool results and acts: it fills fields, clicks buttons, submits forms and, in some deployments, moves money. Every control that existed before the session opened, identity, role, permission, network path, has already done its work. Runtime security governs what happens next.

The distinction from access control is one of tense. Access control is a decision made before: may this identity reach this application? Runtime security is a set of decisions made during: what should the model be shown for this task, which actions may the agent take, which must wait for a named person, and what evidence of the run survives. AI agent access control answers the first question; the four runtime questions follow.

Runtime control Question it answers Failure if absent
Exposure What is the model shown on each screen? The model reads the whole page, including values the task never needed
Permission in the run What may the agent do on this screen? Read access becomes write access by default
Approval What stops for a named person? The agent submits, pays or changes a record on its own
Record What was seen, done and approved, and by whom? No one can reconstruct the run

The framing matters because the agent products shipping in 2026 pass the access step easily; Microsoft Copilot Studio's computer-using agent works web and desktop applications through the user interface on a credential (Microsoft, 2026). What it does past the door is where the security question lives.

Why does access control stop at the door?

Identity and access management was designed around a human who opens a record and uses judgment. An agent inherits the same session and permissions, but the judgment is now a model's, and the model reads everything on the screen as input. Least privilege does not reach what the AI sees, because the permission was granted to the person for the whole application, not to the model for one task.

Gartner's May 2026 finding points the same way: uniform governance across AI agents will lead to enterprise AI agent failure, because agents differ and the controls have to differ with them (Gartner, 2026). A single role cannot express the difference between an agent that reconciles invoices and one that drafts outreach under the same credentials. The per-task decision has to be made at runtime, where the task is known.

The capability trend widens the gap. The International AI Safety Report's first key update finds that new training techniques let systems operate autonomously for longer periods, widening the work they can do and creating new challenges in cyber security and in oversight of AI systems themselves (International AI Safety Report, 2025). A longer autonomous run is a longer period in which the login decision is the only decision in force.

Vendors acknowledge the limit. Copilot Studio's access control for computer use "only prevents the model from taking actions on websites or applications that aren't in the allow list. It doesn't stop the model from opening them" (Microsoft, 2026). What the agent reads once a page is open, and what it does there, are runtime questions the allow list does not answer.

What is the agent shown once it is inside?

The first runtime control is exposure, and the published designs provide little of it. Claude in Chrome takes screenshots of the active tab, and all visible information, including personal data, enters the context; Anthropic's guidance is to "avoid opening the extension while viewing sensitive information or documents" (Anthropic, 2026). Dots see webpage text and document content in connected apps (OpenAI, 2026). Muse reads the page in full inside its secure VM (Meta, 2026). AgentCore Browser hands the model screenshots and the DOM (AWS, 2026). In every case the model receives the page as the person would see it.

That is the exposure OWASP names Sensitive Information Disclosure, LLM02, where a model reveals or is given access to data it should not have (OWASP, 2025). A claims screen carries the claimant's Social Security number and bank details beside the reserve amount the task is about; the screenshot delivers all of it.

Bhagwatkar and colleagues give the exposure control an evidence base with two model-agnostic firewalls at the agent-tool boundary: a Tool-Input Firewall that strips data a tool call does not need, and a Tool-Output Firewall that removes instructions from tool results; the pair reaches about 0 percent attack success on AgentDojo, Agent Security Bench, InjecAgent and tau-Bench with little utility loss (Bhagwatkar et al., 2026). The principle is minimization, and applied to the screen it puts the exposure control before the model reads, which is what render-layer tokenization does when it replaces identifiers with consistent tokens such as SSN_001 and ACCT_001 at the point where the screen is rendered.

Vendors already accept that logic for one value. Dots' secure sign-in submits credentials "without exposing them to the model's context" (OpenAI, 2026), and Muse uses surrogate tokens for credentials the agent cannot read (Meta, 2026). The password is kept out because the model does not need it. The runtime question is why that reasoning stops at the password and not at the account number on the next screen.

What may the agent do, and what stops for a person?

The second and third runtime controls govern action. OWASP's LLM06, Excessive Agency, describes the failure: an agent with more functionality, permission or autonomy than the task needs takes damaging actions on unexpected or manipulated input (OWASP, 2025). AI agent action governance covers the policy design; the runtime question is which mechanism enforces it while the agent works.

The current products enforce it with the vendor's own model. Dots' Custom Rules set what a dot may do on its own and what needs approval; Auto-review checks planned actions against those rules, and OpenAI adds "always review consequential work" (OpenAI, 2026). Claude in Chrome defaults to "Automatically approve" with a pause on risky actions, judged by a classifier (Anthropic, 2026). Copilot Studio emails a reviewer when the agent detects potentially harmful instructions (Microsoft, 2026).

The weakness in a model-based gate is the one MIT Technology Review identifies in model refusal: it is treated as a primary safety mechanism and is far from foolproof, and the layers vendors stack, system prompts, classifiers, probes on internal activations, form a "Swiss cheese" in which each layer has holes (MIT Technology Review, 2026). Anthropic reports attack success under 0.08 percent in internal testing of its Chrome classifiers (Anthropic, 2026), a strong number and still a probability, not a stop.

Approval mechanism Who or what decides Can it be talked past?
Model refusal or action classifier The vendor's model or a classifier on its outputs Yes, at a known non-zero rate
Standing rule ("always allow" after first approval) The user, once, in advance Never asked again
Named person per consequential action A person, at the moment of the action, on the record No; the action does not run without the approval

The last row is a guardrail the agent cannot reason around, and it is what Supervised Delegation means: a named person grants the access, chooses the applications, confirms what is tokenized, can watch and pause the run, and approves every consequential action, on the record.

What should be recorded during the run?

The fourth runtime control is the record, which makes the other three checkable. Copilot Studio's February 2026 update added "session replay with screenshots, timestamped action logs, run summaries, and resource tracking," exportable and integrated with Purview, with retention from 7 days to indefinite (Microsoft, 2026). AgentCore's session recording captures DOM changes, user actions, console logs and network events to the customer's own S3 bucket (AWS, 2026).

Two problems follow. The first is that a session replay with screenshots is a second copy of every real value the agent saw: a new store of identifiers with its own access list and retention question. A record built from tokenized screens does not carry that cost, which is why the AI Control Record is defined as every screen the agent saw as tokens, every action, every approval with a name, exported to the customer's own monitoring.

The second problem is whose record it is. Paris, Moon and Guo argue that technical verification schemes for AI claims rest on unexamined assumptions and contain fallacies a dishonest developer could exploit (Paris et al., 2026). A vendor's assurance that its agent behaved is not evidence the organization can inspect; the record has to land in its own systems. Foundjem and colleagues reach a related conclusion from the threat side: inference time is heavily targeted, and continuous monitoring is needed rather than one-time assessment (Foundjem et al., 2026). That is only possible if every run leaves a record the security team owns, the argument of How Do You Audit What an AI Agent Saw and Did?.

How does runtime security hold up against prompt injection?

Prompt injection is the attack runtime security exists to survive, because it arrives through content the agent reads during the run, not through the login. OWASP ranks it first in the 2025 Top 10 (OWASP, 2025). Greshake and colleagues showed that instructions embedded in content an LLM-integrated application retrieves can turn the application against its user (Greshake et al., 2023). Microsoft's AI Red Team taxonomy places injection among failures that arise from the agent's interaction with its environment (Microsoft AI Red Team, 2025).

The vendors' answers are detection. Dots combine "model safeguards with tool restrictions, checks before actions, and monitoring" (OpenAI, 2026). Claude in Chrome screens content with one classifier and actions with another (Anthropic, 2026). Each tries to recognize the attack. Bhagwatkar and colleagues find that the public benchmarks have flawed metrics, implementation bugs and weak attacks, and that attack success in one setting fell from 70 percent to 9.25 percent when a forced injection was removed (Bhagwatkar et al., 2026). A near-perfect detection score deserves a question about its benchmark.

The four runtime controls answer injection without needing to recognize it. If the model was never shown the identifiers, a successful injection collects tokens, which is the finding of What Does Prompt Injection Get From a Token-Only Agent?. If the consequential action stops for a named person, an injected instruction to pay or submit reaches a person who declines it. If the record holds every screen and action, the attempt is visible afterwards. Detection remains a useful layer; the runtime controls do not fail when it does.

Where does RedactSure sit?

RedactSure is built as the runtime environment for AI co-workers working across an organization's applications, with no per-application integration and no change to user permissions. Exposure: every sensitive value chosen by policy is replaced by a consistent token at the render layer before any model reads the screen, and the model receives the task's fields with identifiers as tokens. Permission and approval: the Planner sets which values are tokenized and what the agent may do on each screen; a named person confirms that policy before the run and approves every payment, submission and record change while it runs, under Supervised Delegation. Real values resolve only at approved destinations at the moment of an approved action. Record: every screen as tokens, every action and every approval lands in the AI Control Record and exports to the customer's own SIEM.

The environment runs in the customer's cloud with keys the customer holds and is model agnostic, so the model can change without moving the controls. Prompt injection that succeeds against a RedactSure agent collects tokens, and the consequential action still stops for a named person. Deployments are in pilot. Everyone else controls where data can go. RedactSure controls what the AI can see.

Methodology and limitations

This page is a definitional synthesis. It rests on vendor documentation read as of October 13, 2026: Anthropic's Claude in Chrome safety guidance, OpenAI's dots safety write-up, Meta's Muse safety post, Microsoft's Copilot Studio computer use documentation and February 2026 update, and AWS's AgentCore Browser documentation, all cited as vendor documentation. Standards sources are the OWASP Top 10 for LLM Applications 2025 (LLM01, LLM02, LLM06). Research sources are Greshake et al. (2023, preprint), Bhagwatkar et al. (2026, preprint), Foundjem et al. (2026, peer-reviewed), Paris et al. (2026, peer-reviewed, cited from its summary page), the International AI Safety Report's first key update (2025) and Microsoft's AI Red Team taxonomy (2025, whitepaper). Industry sources are Gartner's May 2026 press release and MIT Technology Review's October 2026 reporting.

No product was tested, no agent was run, and no benchmark result reported here is the page's own. Statements about each vendor describe what its documentation says as of the reading date; vendor features change, and the page carries its date and is revised when the sources change. The claims screen example describes a kind of work, not any organization; no customer or prospect is described. Statements about RedactSure are limited to the design facts the company publishes.

Whether a given set of runtime controls meets an organization's obligations for a given workflow is a determination for its counsel, its assessor and its security and compliance officers, not for the page. The frameworks cited set out questions and practices; they do not certify any product.

What the record shows

Runtime security governs an agent after the login succeeds, and the login now succeeds easily. The agents shipping in 2026 read the page in full, decide most actions with the vendor's own model or classifier, and record the run as screenshots that copy every value the agent saw. Without runtime controls, the decision made at the door is the only decision in force for as long as the agent runs. The test is to take one completed run and ask four questions: what the model was shown on one screen, what it was permitted to do there, which action waited for a named person, and what record the organization holds without the vendor. A design that answers only the first has an access policy, not runtime security.

Frequently asked questions

What is the difference between AI agent runtime security and access control?

Access control decides whether an identity may reach an application, before the session opens. Runtime security governs the session itself: what the model is shown, what the agent may do, which actions stop for a named person, and what is recorded. An agent can pass every access check and still read what the task never needed.

Does an allow list of applications count as runtime security?

Only partly. An allow list limits where an agent may act; Microsoft's Copilot Studio documentation notes that its access control does not stop the model from opening sites outside the list. What the agent reads on an allowed page and what it does there are runtime questions the list does not answer.

Why is a model's refusal or action classifier not enough on its own?

Because a classifier is a model judging a model, with a non-zero failure rate; MIT Technology Review calls vendors' layered safety mechanisms a "Swiss cheese" with holes in each layer. A consequential action should also stop for a named person, so a bypass reaches a person rather than the application.

What should a runtime record contain?

Every screen the agent saw, every action it took and every approval with the name of the person who gave it, held in the organization's own systems so a reviewer can read it without the vendor. A record built from tokenized screens avoids a second copy of every real value.

How does runtime security change what prompt injection can do?

Injection arrives through content the agent reads during the run, bypassing the login. Runtime controls limit the damage without recognizing the attack: a model shown tokens leaks tokens, an action that waits for a named person reaches someone who declines it, and the record makes the attempt visible afterwards.

Which runtime control should an organization put in place first?

Exposure, because a value the model has already read cannot be unread. Decide per task what the model is shown, enforce it before the model reads the screen, then add named approval on consequential actions and a record the organization owns.

Book an AI Agent Security Review →

Bring your hardest questions.

Bring one sensitive workflow and the decisions your team needs to keep in its hands.

Book a demo

About the author

Christopher Sowa
Chris SowaCo-Founder, President and Chief Commercial Officer, RedactSure

Chris Sowa is a founder of RedactSure and a former CEO of an AI company; he started it years before ChatGPT existed. He previously led AI at Accenture, served as Global VP of Strategy & Innovation at Schneider Electric, was CCO of Sovos, and spent more than a decade at Oracle, with earlier roles at SAP and IBM.

Book a demo

Book a demo

Having trouble? Open the booking page or email us.