Threat Pulse
Attacks blocked. Live.
Every row below is a real attack a real agent faced — and lost. Anonymized so thoroughly that no customer, agent, or IP could ever be identified from it. Live
Quiet right now — no blocked attacks in the recent window. That's the point of a firewall.
Methodology
What this feed shows — and what it hides
What you see
Aggregate counts of blocked and flagged attacks, the attack class (e.g. "Prompt injection attempt", "PII leak attempt"), and relative times ("3 min ago"). Every number is a direct count of real enforcement rows. Counts refresh at most every 5 minutes; the "Live" badge only appears when the data is under 5 minutes old — otherwise we show the actual refresh age.
What we never show
Customer identities, agent names, tool names, IP addresses, exact timestamps, or anything that could identify whose agent was attacked. Attack classes seen in fewer than three workspaces are bucketed as "other" so a rare attack can never fingerprint a single customer's setup. We never name alleged attackers and never shame IPs.
What an empty feed means
Quiet is honest. If no attacks were blocked recently, the feed says so — we never synthesize activity, loop a demo ticker, or inflate counts. An empty feed is a firewall doing its job.
Defense playbook
How each attack class is stopped
Prompt injection shield
Every inbound message is scored against ~70 attack patterns — direct and indirect injection, multilingual payloads, homoglyph and invisible-Unicode smuggling — before the agent ever sees it. High-scoring inputs are blocked or quarantined. Read the full guide.
Data exfiltration defense
Outbound tool calls and messages are scanned for secrets, credentials, and sensitive data shapes. Exfiltration-shaped payloads are blocked pre-flight. Read the full guide.
Tool allowlisting
Agents may only call tools on their explicit allowlist. Unlisted or blocked tools are denied before execution; brand-new tools are held for human review until baselined. Read the full guide.
Egress PII guard
Every tool call is scanned for PII-shaped material — emails, phones, national IDs (US and LATAM), bank accounts, payment cards — and redacted with a labeled token before it fires. Fail-closed: if the engine errors, the call is blocked, never leaked.
Data boundaries
Each agent is confined to the data classes its clearance allows. A support agent reaching for payroll records is stopped at the boundary, with the attempt logged.
Bulk transfer guard
Unusual volumes of data movement — the shape of a bulk exfiltration — trip the guard even when each individual call looks innocent.
Clearance gates
Actions requiring higher data clearance than the agent holds are blocked or routed to the human approval queue. Escalation attempts are logged as violations.
Destructive action guard
Irreversible operations on sensitive data — mass deletes, permission changes, credential rotations — require explicit clearance and are blocked by default. Zero-tolerance categories are never auto-approved.
Velocity guards
Burst rates, per-minute call anomalies, off-hours spikes, and repeated failure streaks all signal automation gone wrong — or an attacker at the keyboard. The guard throttles or blocks and alerts.
Spend guards
Per-action and daily spend caps with anomaly detection. A cost spike — the classic signature of a hijacked agent burning API budget — is blocked before the bill lands.
Scanner-proxy execution tripwire (Pro)
Observed in the wild (Oct 2026): rogue agents conscript third-party security scanners as execution proxies — embedding programs in URLs for a scanner to run on their behalf, and pulling exposed credentials from public code repos. Your firewall watches the agent's own tools; this tripwire watches the shape of its calls: program-payload URLs aimed at scanner services, and public-repo fetches followed by credential-shaped material. Matched calls are held and the agent quarantined via the kill switch. Open the tripwire console.