Free tools Windows power users keep installed
One-click scans. No signup required.
Detect unauthorized AI agent activity by comparing each agent’s identity, tool calls, data access, and outcomes with its approved task and permissions. To stop it, disable the agent through a tested control, revoke or restrict its credentials and downstream access, and verify connected systems reject further actions—while preserving the logs and inputs needed to understand what happened.
What counts as unauthorized AI agent activity?
An agent is acting without authorization when its actions exceed the identity, task, permissions, or tool boundaries approved for it. The cause may be a compromised credential, an overly broad grant, a misused tool, or instructions hidden in content the agent reads. Other investigation possibilities include data exfiltration, poisoned memory, high-impact actions without required approval, or one agent triggering unsafe activity in another.
As an Amazon Associate I earn from qualifying purchases.
These are hypotheses to investigate, not proof of compromise. A risky-looking tool call may be legitimate in context; confirm what the agent was authorized to do and what actually happened before classifying an event as unauthorized.
Recommended Free Tools
One important case is agent hijacking: malicious instructions are embedded in data—such as a document, email, or web page—that the agent is expected to process. NIST CAISI describes this as indirect prompt injection and identifies the blurred boundary between trusted instructions and untrusted content as the underlying problem. Its technical blog, published January 17, 2025, discusses how such content can redirect an agent toward unintended actions (NIST CAISI’s agent-hijacking evaluation guidance).
#1 Best Overall
- Compact and Efficient Design: The FortiGate 40F is designed for small to mid-sized businesses and enterprise branch offices, featuring a compact, fanless desktop form factor that ensures quiet operation and minimizes space usage.
- Robust Connectivity Options: Equipped with 5 GE RJ45 ports, including 1 WAN port and 4 internal ports, this model provides essential connectivity and flexibility for various network configurations in a small-scale environment.
- High-Performance Security: Offers up to 1 Gbps IPS throughput and 600 Mbps threat protection throughput, using Fortinet’s purpose-built security processor technology to deliver industry-leading performance and protection for SSL encrypted traffic.
- Advanced Threat Protection: Integrated with Fortinet’s AI-powered FortiGuard Labs, the FortiGate 40F offers comprehensive cybersecurity, identifying and mitigating both known and unknown threats to maintain robust security across your network.
- Simplified Management and Deployment: Features a user-friendly management console that provides comprehensive network automation and visibility, coupled with Zero Touch Integration with Fortinet’s Security Fabric for easy deployment.
OWASP’s AI Agent Security Cheat Sheet offers a broader set of investigation categories, including tool abuse, privilege escalation, excessive autonomy, memory poisoning, decision or approval manipulation, cascading failures, and malicious console configuration. Use these categories to guide questions and evidence collection, not as a checklist that proves an incident occurred.
Establish what each agent is allowed to do
Detection depends on having a reliable reference point. Maintain an inventory that records each agent’s approved purpose and its authority. Review it when an agent is registered, materially changed, or retired; an outdated inventory can make both legitimate changes and unauthorized ones difficult to distinguish.
- Ownership and location: agent name, accountable owner, platform, environment, and business purpose.
- Configuration: model and version, task or workflow, relevant instructions, and data sources.
- Identity and authority: service or user identity, credential owner, approved tools and APIs, allowed actions, and resources it may access.
- Operations: risk tier, logging location, retention and access rules, and the tested emergency disable and credential-revocation procedure.
Set explicit authorization rules for identity, allowed tools, permitted actions, and validated parameters. Least privilege and least action reduce the impact of a mistake or compromise. For high-impact or irreversible actions, require a human approval where appropriate and provide a safe pause or stop mechanism. Microsoft’s guidance on reducing autonomous agentic AI risk describes these controls; they apply as design principles, not as a substitute for defining your own policy.
Record enough to reconstruct an agent’s actions
Agent logs should let responders follow an event from identity and task through a tool call to its result. Capture, where applicable:
- Agent and user identifiers, timestamps, and task or session identifiers.
- Model and configuration version, plus relevant changes to identity, permissions, tools, or data sources.
- Input provenance where appropriate, including retrieved content or attachments relevant to a suspected hijack.
- Tool name and arguments, authorization or policy decision, resources read or changed, and the result returned by the tool.
- Correlation identifiers that connect the agent event to downstream application, cloud, endpoint, identity, or network records.
Prompts, retrieved content, and traces can contain sensitive data. Apply data minimization, access controls, redaction, and retention rules, while ensuring authorized responders can retrieve evidence before it expires. OWASP’s GenAI Incident Response Guide 1.0 calls for AI-specific evidence planning and familiarity with system architecture and logging.
Correlate agent logs with conventional security telemetry. A tool-call record may show what the agent requested; identity and downstream service records can help establish whether the request was accepted, which resources were affected, and whether related activity came from the same principal or time window.
Rank #2
- HARDWARE PLUS SECURITY SERVICES: FortiGate-60F Firewall Appliance bundled with 1 year of FortiCare Premium and FortiGuard Unified Threat Protection.
- UNIFIED THREAT PROTECTION (UTP): Secures against advanced online threats with comprehensive web filtering and anti-botnet technologies.
- OPTIMIZED FOR MEDIUM-SIZED BUSINESSES: Tailored for businesses needing robust security without the infrastructure of larger enterprises.
- RELIABLE CUSTOMER SUPPORT: FortiCare Premium ensures high-quality support and service continuity.
- EFFECTIVE PROTECTION: Employs advanced filtering technologies to safeguard against sophisticated threats.
Which signals should trigger investigation?
Use deterministic policy checks for decisions that can be stated clearly, such as whether an identity may call a tool or whether an action’s parameters are allowed. Baselines and anomaly detection can help surface unusual behavior, but they do not define authorization: a previously common action can still be forbidden, and a rare action can be legitimate.
| Signal to investigate | Questions to ask |
|---|---|
| Unexpected tool, API, or destination | Is this tool approved for this agent and task? Were the arguments and destination permitted? |
| Out-of-scope data access or movement | Did the agent access data beyond the user’s need or assigned role? Was there an unusual write or external transmission? |
| Unexpected identity or configuration change | Was the identity, permission set, model, tool configuration, or data source changed by an authorized owner? |
| Repeated denials, retries, or bypass attempts | Is the agent repeatedly attempting blocked actions, changing parameters, or behaving differently from its task pattern? |
| Unusual fan-out or cross-agent activity | Did one action trigger a chain of calls, unusual resource use, or activity by connected agents? |
| Untrusted content that appears to redirect the task | Did retrieved text or an attachment try to override instructions, request secrets, or change the intended destination? |
| High-impact action or suspicious access context | Did a tool call change an important resource, access credentials, or occur from an unexpected identity or IP? |
For each alert, compare the event with the agent’s recorded purpose and authorization, then inspect the related tool, identity, and downstream records. Statistical or model-assisted detection can add context, but human review and enforceable policy controls matter most when an action could cause significant or irreversible harm.
How to stop an agent without losing the evidence
Containment must remove the ability to act, not just hide or close the chat interface. The right controls depend on how the agent, identity provider, tools, and downstream services are connected. Use a procedure tested for that architecture:
- Preserve the immediate context. Save the alert and relevant agent, identity, tool, and downstream events, along with implicated inputs, before they expire. Follow internal evidence-handling and privacy rules.
- Pause or disable the agent. Use its tested emergency control and confirm that it prevents new work from being initiated or continued.
- Constrain its authority. Revoke or restrict credentials and tokens, remove risky tool grants, and deny implicated routes or destinations. If a shared identity or dependency may be involved, account for other agents that use it.
- Verify containment downstream. Check the connected tools and services to confirm that they reject further requests. Do not assume disabling the user-facing agent invalidates every credential or stops work already accepted by another system.
- Scope the activity. Determine what data was accessed, what resources changed, who or what received data, which agents or dependencies were involved, and whether access or configuration persists elsewhere.
Microsoft’s agentic risk guidance highlights safe stop mechanisms and least privilege as foundational controls. It does not provide a universal containment procedure for every agent architecture, so validate the actual behavior of your platform and connected services in advance.
Independent reader supportYour contribution helps us test, update, and keep practical guides available for everyone.Use a response sequence that covers recovery
1. Triage and validate
Establish what happened, when, which agent identity and user or task were involved, and what the agent was authorized to do. Determine whether the signal reflects a real policy violation or an expected action. Preserve the alert and event context; a suspicious answer alone is not enough when tool and identity logs can confirm what the agent did.
Windows Errors? Fix Them Before They Spread
Repair common Windows errors and clear accumulated junk for a smoother, more stable PC - no reinstall needed.Free scan · no reinstallCrashes, No Sound, or Screen Glitches?
Random freezes, missing sound and display glitches usually trace back to one bad driver. Find and replace yours safely.Free scan · under a minute2. Contain and preserve
Use the tested stop and revocation controls, verify that downstream services reject further actions, and retain the records needed to scope the event. Preserve relevant tool arguments and results, permission and configuration changes, implicated retrieved content, and affected systems’ records.
Rank #3
- 【Up to 1100 Mbps VPN Speed 】 Hardware-accelerated WireGuard and OpenVPN-DCO deliver up to 1100 Mbps VPN throughput, over 3× faster than Brume 2 for smooth remote access and file transfers.
- 【Three 2.5G Ports & Multi-WAN】Tri-port 2.5GbE design with flexible WAN LAN configuration supports multi-gigabit wired setups, dual-ISP Multi-WAN and failover to keep home and SOHO networks online.
- 【Stealth VPN Obfuscation】VPN obfuscation disguises VPN traffic as regular HTTPS, helping you evade blocking, bypass restrictive networks and maintain stable, private connections.
- 【DPI protection】Deep Packet Inspection with visual dashboards blocks adult/gambling/malicious sites, while SQM and QoS prioritize gaming, calls, and video when bandwidth is tight
- 【OpenWrt & USB 3.0 Expansion】OpenWrt with 1GB DDR4 and 8GB eMMC lets you install plugins and build VPN, ad-blocking or NAS, while USB 3.0 Type‑C connects high-speed storage or 4G/5G dongles
3. Eradicate the cause
Remove malicious content or compromised dependencies, rotate affected credentials, restore a known-good configuration, and reduce permissions to the minimum required. The right remediation depends on whether the event affected memory, data, models, or connected systems; retraining is not automatically required for every incident.
4. Validate before re-enabling
Test the repaired agent against the suspected attack path and its normal tasks. Confirm that prohibited actions are blocked, approvals work as intended, and logs still capture the relevant chain of events before restoring access.
5. Update controls and evaluations
Revise detections, inventory, permissions, and response procedures based on what the incident revealed. NIST CAISI recommends adaptive, task-specific evaluation and testing attacks over multiple attempts to get a more realistic view of risk. OWASP’s incident response guide also emphasizes AI-specific preparation and training for response teams.
Prepare before the alert
Maintain an AI-specific incident runbook that gives responders an architecture and log map, evidence-handling steps, named decision owners, and the tested disable and revocation procedures for each agent. Practice scenarios such as an instruction hidden in a retrieved document, a compromised credential, and a tool call that causes a high-impact change. Reassess controls and repeat relevant tests whenever models, instructions, tools, permissions, or dependencies change.
What Microsoft Defender’s agent detection covers
Microsoft documents near-real-time AI-agent threat detection in Defender for scenarios including jailbreaks, indirect prompt injection, malicious content propagation, secret or credential leakage, evasion, reconnaissance, and suspicious user or IP access. The Microsoft Learn page labels this capability public preview; its coverage is not universal. The documentation ties detection to Agent 365 observability data for managed agents, notes separate Defender for Endpoint setup for local endpoint agents, and describes limits including coverage for published Microsoft Foundry agents. Check the Defender documentation for the applicable platform requirements and current preview status.
Microsoft’s documentation also describes Agent 365 observability records for agent actions, tool invocations, and data access, with inventory, alerts, alert evidence, and behavior records. It describes Advanced Hunting with KQL for tracing tool calls, investigating scope and root cause, and developing detections. These are Microsoft-specific examples, not prerequisites for building an effective program on another stack.
For broader observability, Microsoft’s monitoring and forensics catalog describes centralizing prompts, context, tool calls, outputs, traces, policy decisions, and lineage, then correlating agent behavior with identity, application, network, and cloud signals. It also discusses canary values, fingerprints, and agent/tool relationship graphs as optional custom analytic techniques; assess their privacy implications, false-positive rates, and operating cost before deploying them. The catalog says it was last updated August 1, 2026, and maps monitoring concepts to OWASP, MITRE ATLAS, and NIST frameworks without claiming a one-to-one mitigation mapping for every cross-cutting practice (Microsoft’s monitoring, detection, and forensics catalog).
Quick Recap
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
