Most of what is written about AI security is about models: what they say, what they refuse, how they are trained. That matters. But an agent on your Mac is not a conversation — it is a process, running as you, with your files, your network, your keychain and your mounted volumes already in reach. Securing that is a different discipline, and it happens at the endpoint.
They are not competing approaches and you want all three. But only one of them knows which file on your disk is a production credential, and it is not one of the two the vendor controls.
Alignment, refusals, safety training, red-teaming. This decides what the model is willing to produce.
Where it runs out: It travels with the model, not with your machine. It cannot know that this particular file is your production database credential.
Prompt hardening, tool allowlists, confirmation dialogs, workspace conventions inside the agent itself.
Where it runs out: The agent is enforcing limits on the agent. Anything that changes its reasoning changes its enforcement, and a bypass is a single convincing sentence away.
An independent, deny-by-default boundary outside the AI that decides which files, endpoints, executables and tools the process can reach at all.
Where it runs out: Requires OS-level enforcement and rigorous identity resolution. It is the hardest layer to build, which is why it is usually the missing one.
None of these requires the agent to be malicious, compromised, or badly intentioned. Every one of them is a plausible Tuesday for software that is trying to be helpful and has more authority than the task needed.
An agent reads ~/.ssh/id_ed25519, ~/.aws/credentials, or a .env, and puts the contents in a request, a commit, or a log.
Those paths are outside every grant. The read is denied and recorded, and the agent never had a reason it could argue with.
A GitHub issue, a dependency README, a scraped page or an MCP tool result carries instructions the agent follows as if you had typed them.
The instruction still has to become an operation, and the operation still has to pass policy. Injection changes what the agent wants; it does not change what it may reach.
The agent is restricted, so it runs `bash -c`, which runs Python, which opens the socket.
The containment session is attached to the process tree. The fourth process is governed by the policy the first was given.
An agent allowed to reach an API endpoint scans 192.168.0.0/16, finds an SSH port or an internal service, and connects.
Destinations are classified from their bytes. Internet, local network, loopback and multicast are separate authority, and reaching one grants nothing about the others.
A postinstall script in an npm or pip package runs with everything the agent had, which was everything you had.
Execution targets are identified by resolved path, signing identity and hash, and inherit the session. A package manager is not a category of software with its own authority.
An MCP server is handed a GitHub token so the agent can read one repository. The token can now do everything the token can do, forever.
The broker performs the approved operation and returns the result. The reusable secret stays broker-owned; there is no raw-token retrieval call to find.
The failure mode of endpoint security products is a green checkmark that means nothing in particular. BitShout shows what asked, what it asked for, what was decided, and whether the operating system enforced the decision or the policy engine merely evaluated it — because those are not the same claim.
Most AI security incidents that will actually cost someone money start with a token handed to an agent for a good reason. Once read, it is permanent: it exists in a context window, possibly in a log, possibly in a provider's retention window, and it keeps working until someone rotates it.
The fix is structural rather than procedural. Give the agent the capability and keep the credential: the broker validates identity, capability, resource, parameters and policy, performs the one approved operation, and returns the result. There is no generic HTTP proxy, no raw token retrieval, and no "reveal secret" call in the surface at all.
MCP security in detailMost answer "it keeps going", because the alternative interrupts people. That means a broken enforcement component silently becomes permission — and you find out from the incident, not the dashboard.
~.BitShout does all five structurally rather than asking you to remember them. See how.
AI security covers three distinct layers: model safety, which governs what a model will produce; application security, which governs how an AI product behaves; and capability containment, which governs what an AI process running on a real machine can actually reach. The first two are the vendor’s responsibility and travel with the software. The third is yours, because it depends on what is on your disk, your network and your keychain.
Traditional endpoint security asks whether a program is malicious — by signature, reputation or behaviour. An AI agent is not malicious and its behaviour is legitimate by construction: reading files, running commands and making network calls is the job. The question that matters is not "is this program bad" but "should this program be able to reach that". That is an authority question, and authority is what containment governs.
Not usefully, no. EDR is built to catch software doing things it should not be doing. An agent reading your SSH key is, from the operating system’s perspective, a process you started opening a file you own — indistinguishable from you doing it yourself. There is no signature for "this was a bad idea". You need a boundary that requires permission in advance, not a detector that reports afterwards.
No, and any product claiming to is overselling. Prompt injection is a property of how language models process untrusted text, and it will not be solved at the endpoint. What BitShout changes is the consequence: an injected instruction still has to become a filesystem, network, execution or capability operation, and that operation still has to pass a deny-by-default policy it cannot argue with. The attack succeeds and achieves nothing.
No. BitShout is local-first: policy, grants, credential references, evidence and containment decisions stay on your Mac. There is no mandatory telemetry, no automatic diagnostic upload, and no cloud analysis step. Exporting evidence is an explicit action you take, and the export is redacted.
No, deliberately. The policy engine is deterministic, versioned, ordinary code: the same inputs produce the same verdict every time. Using a language model to decide whether another language model should be allowed to read your keys would reintroduce exactly the unpredictability the product exists to contain.