Shadow Agents: How SentinelOne Secures the AI Tools That Act Like Users

The document outlines SentinelOne’s three-layer defense model for securing agentic AI assistants—combining EDR/XDR behavioral detection, Prompt Security for AI interaction governance, and ClawSec for agent runtime hardening. It includes example hunting queries and indicators (e.g., process names and default ports), maps capabilities to seven security pillars, and offers phased recommendations for discovery, visibility, and governance of shadow AI and agentic tools.