Open-source tool Sage puts a security layer between AI agents and the OS

This article describes Sage, an open-source Agent Detection & Response (ADR) project that inserts interception hooks into AI agent platforms (Claude Code, Cursor/VS Code, OpenClaw) to vet tool calls—Bash commands, URL fetches, and file writes—using URL reputation, local YAML heuristics, package supply-chain checks, and plugin scans; it preserves most data locally while optionally sending hashes to reputation APIs. The piece also references Gen Threat Labs research highlighting a large number of internet-exposed AI agent instances and a percentage of malicious skills, and provides installation and packaging details for supported platforms.