Table Of Content
The Agent Runtime You Don't Control
-
November 2, 2026
-
What OpenShell-style sandboxes leave on the endpoint
This month Zscaler and CrowdStrike both announced support for NVIDIA’s OpenShell reference architecture, a pattern for running AI agents inside governed runtimes with defined boundaries, identity and telemetry. It is a sensible direction. It is also notable that Zscaler’s own announcement acknowledges that agents will not all run inside a governed runtime, and extends visibility to agents on endpoints and in cloud workloads so teams can see “not only the sanctioned ones.”
That caveat is where most enterprises will spend their time.
Two populations of agents
Agents IT deploys. Built on approved platforms, run in managed environments, given scoped credentials. A reference runtime can wrap these with policy, logging and containment.
Agents users install. A coding agent in a terminal, a desktop assistant with file access, an IDE extension, a locally run model, an agent wired to a handful of MCP servers copied from a README. These start on a laptop, with the user’s own permissions, and never pass through a platform team.
The second population is growing faster, and it is the one holding the user’s real access: source repositories, cloud credentials, browser sessions, mail and documents.
What a runtime boundary cannot see
If an agent was never launched inside the sandbox, the sandbox has nothing to say about it. Questions that remain open on the endpoint:
- Which agents and agent-like processes are installed and running on which devices?
- What can each one reach: directories, credentials, MCP servers, network destinations?
- Which model endpoint is it talking to, and under which account?
- What sensitive content did the user or the agent hand to it, and what did it send out?
- Is the device itself in a posture where agent access should be allowed at all?
These are endpoint questions. The answers come from process, file, network and user activity combined with device posture and content classification, observed where the action happens.
A practical split of responsibilities
- 1.Use governed runtimes for agents you build and deploy. Take the containment, identity and runtime telemetry they offer.
- 2.Inventory everything else at the endpoint. Discover agent binaries, extensions, MCP configurations and model destinations across the fleet, including ones nobody announced.
- 3.Apply content-aware policy at the point of action. Allow approved agents on healthy managed devices, warn on unapproved ones, block regulated data heading to unapproved destinations.
- 4.Join the two views. An agent seen inside a runtime and the same user's activity on the laptop belong in one investigation.
Keep it proportionate
Endpoint visibility into agents should focus on activity relevant to risk, be explained to employees, and restrict who can see the records. The aim is to extend the same governance discipline to the tools people actually use.
Where Kitecyber fits
Kitecyber’s endpoint agent (under 2% CPU) gathers device posture, operating system, process, user and network activity with data classification across 80+ categories. Teams use it to discover and govern Gen AI tools and desktop or CLI agents on employee devices, enforce allow, warn or block decisions by content, destination, account and posture, and keep an audit trail. It complements runtime-level controls rather than replacing them. Deployment typically takes around a day with pre-built compliance policies.
Book a Kitecyber walkthrough at kitecyber.com to see agent discovery on your own fleet.
Ajay Gulati
Ajay Gulati is a passionate entrepreneur focused on bringing innovative products to market that solve real-world problems with high impact. He is highly skilled in building and leading effective software development teams, driving success through strong leadership and technical expertise. With deep knowledge across multiple domains, including virtualization, networking, storage, cloud environments, and on-premises systems, he excels in product development and troubleshooting. His experience spans global development environments, working across multiple geographies. As the co-founder of Kitecyber, he is dedicated to advancing AI-driven security solutions.
