Threat Pulse · Deep dive
New tool held for review
A brand-new tool appeared in the agent's environment, possibly legitimate, possibly planted. New capabilities are the highest-risk moment in an agent's lifecycle.
How we stop it
New tools are held for human review by default. Nothing executes until someone confirms the tool belongs there.
Frequently asked
What is new tool held for review?
A brand-new tool appeared in the agent's environment, possibly legitimate, possibly planted. New capabilities are the highest-risk moment in an agent's lifecycle.
How does Rogue-Agent Defense stop new tool held for review?
New tools are held for human review by default. Nothing executes until someone confirms the tool belongs there.
What should I do if I see new tool held for review in the Threat Pulse feed?
Nothing urgent: the feed only shows attacks that were already blocked or flagged. If one class keeps appearing, review the linked defense guide and check your agents' allowlists, data boundaries, and spend caps.
Counts are real enforcement rows, anonymized. Attack classes seen in fewer than three workspaces never get a page.