- An AI agent doesn't break in. It runs with the privileges of the employee who installed it, and to an EDR that looks like ordinary work.
- In ClawHavoc, researchers found more than 800 malicious skills in the marketplace of the AI agent OpenClaw.
- Palo Alto Networks' Cortex XDR One defends against AI and with AI, in one sensor and one console.
- ON2IT maps which agents are on your endpoints, links that to your Protect Surfaces and monitors Cortex XDR with MDR Detect™ or MDR Prevent™.
Your EDR is quiet. So nothing is running that shouldn't be?
In early 2026 the open source AI agent OpenClaw went viral. If you wanted your agent to do more, you grabbed an extra skill from the marketplace. One click, and it worked. Except researchers found more than 800 malicious skills in that marketplace. Once installed, they broke out of the agent's sandbox and gave an attacker access to the machine's command line. Unit 42, the Palo Alto Networks research team, gave the attack a name: ClawHavoc.
Nothing was cracked. No exploit was needed. The agent did what it was allowed to do, with the privileges of the employee who installed it.
In short
An agent doesn't break in. It already has the keys.
A new layer on every laptop
Look at what sits on an average workstation these days. AI assistants in the code editor, copilots, MCP servers that connect an agent to your mail or your database, browser extensions, personal agents an employee picked out themselves. IT approved some of them. Nobody knows the rest are there.
All of these tools run with real user privileges. They read mail, write code, call APIs. And they can be manipulated:
Poisoned skill
An extra skill from a marketplace that does more than it promises.
Tainted source
A document or SaaS app the agent pulls its information from.
Silent update
An update that looks just slightly different from the last one.
An EDR is built to watch processes, and it is good at that. But an agent using your privileges to do something that is technically allowed looks like ordinary work to an EDR.
So the question isn't whether your endpoints are secured. The question is: who decides what the agents on them are allowed to do?
Defending against AI, and with AI
On October 19, 2026, Palo Alto Networks introduced Cortex XDR One. What struck us is that it answers that question from two sides.
Against AI
Cortex XDR One brings Cortex XDR together with Agentic Endpoint Security, the technology from Koi. It keeps a live inventory of every AI tool, agent, extension and MCP server the moment it appears on an endpoint. You decide what may be installed and used. And while an agent is at work, hard limits apply: against prompt injection, against destructive commands, against an agent trying to escape its own environment.
With AI
Small language models run on the sensor itself and recognize fileless and evasive attacks, even when the endpoint is offline and without sending code to the cloud. Signals from the operating system and the agent are stitched into a single attack chain. You don't just see that something happened, but also which prompt or which tool set it in motion.
It all lives in one sensor and one console. And if you already run an EDR from another vendor, you can deploy Agentic Endpoint Security alongside it. You don't have to replace anything to get started.
One detail from the announcement stuck with us. When agentic AI was just emerging, the Palo Alto Networks internal security team went looking for a way to secure its own AI agents. They found Koi, then a startup still in stealth, and deployed it themselves. Only after that came the acquisition.
In short
In other words, they bought something they first needed themselves.
Why we are proud of this partnership
We have worked with Palo Alto Networks since 2009. In 2020 Palo Alto Networks named us Global MSS Partner of the Year. We are proud of that, and we're happy to say so.
But pride is no reason to recommend something. Our view that Palo Alto Networks is best in class rests on what independent parties have found, year after year:
IDC
Named Palo Alto Networks a Leader in its MarketScape for modern endpoint security in September 2026, specifically pointing to its visibility and control over AI agents.
AV-Comparatives
Certified Cortex XDR as a Leader in its 2026 Endpoint Prevention and Response test, for the seventh year in a row. All 50 attacks were stopped before any damage was done.
SE Labs
Gave Cortex XDR an AAA rating in its ransomware test in August 2026: 3,664 out of 3,664 assessments correct.
Not one good score, but years in a row, from analysts and testers alike. And now with an answer for the agents as well. To us, that is best in class.
What we do
Palo Alto Networks delivers the technology. We make sure it works in your environment and that you can actually do something with it.
Step 1
Look. Which agents, extensions and MCP servers are really on your endpoints right now, and what are they allowed to do?
Step 2
Translate to Zero Trust. Which Protect Surfaces do these tools touch, and what access is really needed?
Step 3
Monitor. Our GSOC watches your endpoint alerts from Cortex XDR around the clock with MDR Detect™, or we manage that environment entirely for you with MDR Prevent™.
In closing
Your EDR is quiet. Maybe because nothing is happening. Maybe because nobody is watching the agents.
Get in touch
Want to know which keys you've handed out?
Talk to us about the agents on your endpoints and what they are allowed to do. Or read more about Cortex XDR at ON2IT.
Contact usFAQ
Why doesn't an EDR see an AI agent as a threat?
An EDR is built to watch processes. But an agent using an employee's privileges to do something that is technically allowed looks like ordinary work to an EDR. In ClawHavoc nothing was cracked and no exploit was needed: the agent did what it was allowed to do.
What is Cortex XDR One?
Palo Alto Networks introduced Cortex XDR One on October 19, 2026. It brings Cortex XDR together with Agentic Endpoint Security, the technology from Koi. It defends against AI, with a live inventory of every AI tool on an endpoint and hard limits for agents, and with AI, with small language models on the sensor itself. It all lives in one sensor and one console.
Do I have to replace my current EDR?
No. If you already run an EDR from another vendor, you can deploy Agentic Endpoint Security alongside it. You don't have to replace anything to get started.
What does ON2IT do?
ON2IT maps which agents, extensions and MCP servers are on your endpoints and what they are allowed to do. We translate that into your Zero Trust approach: which Protect Surfaces do these tools touch, and what access is really needed? Our GSOC watches Cortex XDR alerts around the clock with MDR Detect™, or we manage that environment entirely for you with MDR Prevent™.
Karin Muller leads marketing at ON2IT, where she is building an AI-first marketing team with security designed in rather than bolted on. She turns thought leadership into something sales can use, with Threat Talks and Hack the Boat as flagships.