AI Agent Runtime Security: The Complete Enterprise Guide (2026)

AI agent runtime security inspects and enforces policy on agent activity during execution — prompts, tool calls, memory access, inter-agent messages — instead of scanning configurations before deployment. Core controls: inline inspection, tool-call firewalling, session-level enforcement and kill switches.

Runtime is where AI agent security got real, and where the market consolidated. In roughly thirteen months, four of the nine credible runtime vendors were acquired — Lakera by Check Point for a reported $300 million, CalypsoAI by F5 for $180 million, Prompt Security by SentinelOne for roughly $159 million per SentinelOne's quarterly filing, and Aim Security by Cato Networks for an undisclosed sum. The independents that remain raised mega-rounds in the same window: $125 million for Zenity, $100 million each for Noma Security and HiddenLayer. Markets do not consolidate around hypothetical problems. Here is what runtime security does, the incidents that made it urgent, and how to compare the providers left standing.

What is runtime security for AI agents?

Build-time controls answer the question "is this agent configured safely?" Runtime security answers a different one: "is this agent behaving safely, right now, on this specific request?" It sits in the execution path and classifies every prompt in, every output out, every tool or MCP call, every memory read and write, and every message between agents — then blocks, redirects or redacts before the action completes.

Gartner's AI TRiSM framework treats this as one of four operational layers, alongside infrastructure security, information governance and enterprise AI governance. Per Gartner's framing, AI runtime inspection and enforcement "provides automated monitoring and control across all AI events to proactively detect and remediate threats like data leakage or policy violations." Gartner went further in February 2026 with its first Market Guide for Guardian Agents — supervisory agents blending governance and runtime controls, unpacked in our guardian agents explainer. The analyst world now treats runtime enforcement as a distinct budget line, not a feature of something else.

The practical distinction that matters for buyers, as one vendor evaluation guide from Linx Security puts it, is runtime enforcement versus governance-only: does a tool block a dangerous agent action, or just log and score it? A surprising number of products marketed as "agent security" do only the latter. Our CISO playbook for securing agents in production walks through where each control type belongs.

Why did build-time controls stop being enough?

Three incidents from 2025 settle the argument. Each involved systems that would have passed a posture review the morning of the attack.

EchoLeak (CVE-2025-32711, CVSS 9.3). Disclosed in June 2025 by Aim Security's research team, EchoLeak was a zero-click indirect prompt injection against Microsoft 365 Copilot: a single crafted email caused Copilot to access internal files across OneDrive, SharePoint and Teams and exfiltrate them to an attacker's server, via what the researchers called an "LLM Scope Violation." No user clicked anything. Microsoft patched it server-side with no confirmed in-the-wild exploitation — but it was the first characterised zero-click exploit against an AI agent, and no configuration scanner could have flagged the triggering email.

ForcedLeak (CVSS 9.4). Reported by Noma Security in July 2025, ForcedLeak chained an indirect prompt injection through Salesforce Agentforce's Web-to-Lead description field with a CSP bypass through an expired Salesforce-allowlisted domain — purchasable for $5 — to exfiltrate CRM data. Salesforce enforced Trusted URLs for Agentforce in September 2025. The general lesson — agent inputs arrive from places you do not control — recurs in our piece on tool poisoning.

The Salesloft Drift breach. In August 2025, the threat actor UNC6395 stole OAuth tokens from the Drift AI chatbot integration and ran queries across customer Salesforce orgs; Google assessed that more than 700 organisations may have been potentially impacted, including Cloudflare, Google, Palo Alto Networks and Zscaler. Attackers harvested AWS keys, Snowflake tokens and passwords from support-case text. Not a prompt injection — but the canonical demonstration that an AI integration is a privileged supply chain, and that only something watching activity in real time catches the abuse of a legitimately issued credential.

When an agent goes wrong, it goes wrong at machine speed. Our post-mortem of the nine-second database delete makes the case in miniature: by the time a human reads the alert, the transaction history is the incident report.

How does runtime enforcement actually work?

Four mechanisms recur across the market, usually in combination.

• Inline inspection. A proxy, gateway or API sits between the application and the model and classifies every request and response before it proceeds. Palo Alto's Prisma AIRS API Intercept is a representative example — an API that, in the company's words, protects models from prompt injection, data leaks and unsafe outputs.
• Tool-call firewalling. Policy enforcement at the MCP and tool layer. Lasso Security publishes an open-source MCP Gateway — "a plugin-based gateway that orchestrates other MCPs" — and its partnership with Portkey embeds its detection engine in the gateway request pipeline to identify adversarial patterns before they reach high-permission tools.
• Prompt injection defence. Classifier and intent-analysis engines run on inputs and on retrieved context, since EchoLeak-style attacks arrive through documents and emails, not just the user's prompt box.
• Session control and kill switches. Blocking or redirecting a specific action mid-run. Zenity describes "deterministic enforcement for agents that prevent them from performing actions or invoking tools that are deemed risky… inline, in real time." HiddenLayer's Agentic Runtime Security, per TechCrunch's coverage of its September 2026 raise, "is designed to flag and stop manipulation, tool misuse, and unauthorized actions as they happen." A tenant-wide kill switch — the ability to halt an agent or a whole class of agents instantly — is the control auditors now ask about first.

The threat taxonomy underneath all of this is now standardised. OWASP published its Top 10 for Agentic Applications in December 2025, with contributions from hundreds of practitioners: goal hijack, tool misuse, identity and privilege abuse, agentic supply chain vulnerabilities, unexpected code execution, memory and context poisoning, insecure inter-agent communication, cascading failures, human-agent trust exploitation and rogue agents. Its architectural principle — "Least Agency," granting agents only the minimum autonomy required — is the design stance every runtime product enforces mechanically. Inter-agent communication (ASI07) deserves particular attention as multi-agent systems spread; see our analysis of A2A trust and inter-agent prompt injection.

How do you compare AI agent runtime security providers?

Last verified: September 5, 2026. Two honesty notes before the table. First, nearly every latency and detection figure in this market is vendor-self-reported and unaudited — including ours. Second, almost nobody publishes pricing. Treat both as evaluation findings in their own right.

Read the empty cells as information. When a vendor selling millisecond-path enforcement will not name a latency number, your proof-of-concept should produce one.

What should be on your evaluation checklist?

• Latency and false-positive rate you can leave on full-time. The best framing we have seen comes from Straiker's evaluation guidance: which tool inspects the threat surface your agents actually expose, at a latency and false-positive rate you can leave on full-time? A blocker that gets bypassed after a week of user complaints protects nothing.
• Deployment-model tradeoffs. API-based, agent-based and network-based approaches carry different latency and coverage costs. Note that policy evaluation itself is nearly free — one published benchmark measured 0.198ms on average — so when latency is high, it is the classification models that are slow, and you should ask why.
• Detection methodology disclosure. Demand measurable accuracy on standardised attack sets, the test methodology, and the false-positive tradeoff. Refusal to disclose is an answer.
• Enforcement, not just observation. Ask the vendor to block — not flag — a live tool-misuse attempt in the demo.
• Coverage of your actual surface. Employee AI use, homegrown agents, SaaS-embedded copilots and the MCP estate are four different problems; few products cover all of them. Regulated buyers should ask hard questions about self-hosted and air-gapped options.
• Standards alignment. Audit-ready reporting mapped to NIST, OWASP and MITRE turns your runtime layer into compliance evidence rather than another log source.

If you want to see what sub-38ms (p99) inline enforcement looks like against your own agents rather than a slide, AccuroAI's agent security platform runs a 72-hour pilot.

FAQ

What is the difference between AI agent runtime security and AI-SPM?

AI-SPM (security posture management) inventories AI assets and finds misconfigurations before problems occur. Runtime security enforces policy while agents execute — blocking a malicious tool call mid-flight. Mature programmes need both; posture tools cannot stop an EchoLeak-style zero-click injection.

Does runtime inspection add noticeable latency?

It adds some; the question is how much and where. Self-reported figures range from under 38ms to under 200ms per inspection, and the classification step — not policy evaluation — dominates. Benchmark with your own traffic, because no published number in this market is independently audited.

Do I still need runtime security if my agent platform has built-in guardrails?

Platform guardrails only govern that platform, and ForcedLeak showed a platform's own trust configuration can be the weakness. An independent runtime layer applies one policy across Copilot, Agentforce, Bedrock and your homegrown agents — which is also the architecture Gartner's guardian agent category describes.

What is an AI agent kill switch?

A control that immediately halts a specific agent, session or agent class — revoking tool access and freezing execution. It is the last line when detection fires mid-incident, and it only works if the enforcement point sits inline rather than reading logs after the fact.

Sources: Palo Alto Networks AIRS documentation and Prisma AIRS 3.0 release · Lasso MCP Gateway and platform materials · Portkey–Lasso announcement · SecurityWeek on Zenity's Series C · TechCrunch on HiddenLayer's Series B · vendor and press releases on the Lakera, Prompt Security, CalypsoAI and Aim acquisitions · The Hacker News on EchoLeak and ForcedLeak · Unit 42 on the Salesloft Drift compromise · OWASP Top 10 for Agentic Applications (Dec 2025) · Gartner AI TRiSM materials, Market Guide details as summarised by vendors with access to the report.

Related: Guardian Agents Explained · How to Secure AI Agents in Production · The 9-Second Database Delete.