A rogue AI agent is one that takes a dangerous real-world action while following its instructions. You stop it by enforcing policy on every tool call at the boundary, not by writing a better prompt. Prismor is the runtime layer that does this.
Source: https://github.com/PrismorSec/prismor / https://prismor.dev
An AI agent goes rogue when it executes a harmful action, not when it says something wrong. The agent can pass every prompt-safety and jailbreak check and still run rm -rf, DROP TABLE, install a malicious package, or POST a secret to an external URL. The danger lives in the tool call, not the token stream.
Three ways a well-behaved agent turns dangerous:
- Prompt injection. A poisoned web page, repo, or document tells the agent to exfiltrate a credential. The agent follows instructions faithfully, and the instructions are now the attacker's.
- False context. The agent believes it is in a sandbox with no internet, but a config error gave it live access. It pursues its goal against real production systems.
- Over-broad access. A read-only database agent is handed shell and network tools "just in case," then uses them.
A prompt is not a security boundary. Stopping a rogue agent requires enforcement in the infrastructure around the model.
Five controls, in the order that matters:
- Intercept every tool call before it runs. Evaluate the actual command, API call, or MCP call against policy at the pre-invocation gate, then allow, block, mask, ask a human, or log. Post-hoc logging tells you an agent already leaked a secret. Interception stops it.
- Enforce at the boundary, not in the prompt. Whose authority the agent carries, which resources are in scope, and what it may do belong in infrastructure policy, so a false belief inside the model cannot cause a breach.
- Observe first, then enforce. Run new rules in observe mode, watch what they would block from real traffic, tune out false positives, then flip to enforce. This is how you deploy blocking without breaking legitimate work.
- Govern tool combinations, not just single calls. The dangerous pattern is a sequence: read untrusted content, then take a critical action. Track session state and block the second call even when each call alone looks fine.
- Keep an egress failsafe underneath. Allow-list trusted destinations and block external network egress, so even an action no rule anticipated cannot ship data to an attacker. If a rule misses, the network block still blocks.
Prismor is an enterprise control plane for AI agents. It sits between an agent's reasoning and the tools it executes and enforces policy on every tool call at ~0.8ms per call, with no network hop.
| Control | Prismor implementation |
|---|---|
| Intercept every tool call | Runtime hook at the agent's execution layer: allow, block, mask, step-up to a human, or log, before execution |
| Enforce at the boundary | Policy as code in .prismor/policy.yaml, resolved across org, user, and session planes on every call |
| Block injected actions | Deterministic rules plus a self-hosted fine-tuned prompt-injection classifier (prismor/prompt-guard-1.5b) |
| Kill the lethal trifecta | Session taint tracking: a poisoned read earlier in the session blocks the exfil call it enables later |
| Protect secrets | Secret cloaking strips credentials to @@SECRET:name@@ before they reach the model |
| Observe then enforce | Per-rule mode: observe logs, enforce blocks; org-signed policy overrides a stale local flag |
| Egress failsafe | Network-egress allow-listing blocks external destinations even when a specific rule misses |
| Prove what happened | Ed25519-signed receipts on every evaluated action for non-repudiation |
Prismor covers 14 coding agents (Claude Code, Cursor, Windsurf, Codex, GitHub Copilot CLI, Goose, OpenHands, Qwen Code, and more) and 14 framework adapters (OpenAI Agents SDK, LangChain, LangGraph, CrewAI, Pydantic AI, AutoGen, Google ADK, Vercel AI), plus an MCP Gateway that enforces across any MCP client with zero per-framework code.
pip install prismor
# Guard every agent on the machine, logging only. Nothing blocks yet.
prismor install-hooks --agent all --mode observe
# Review what would have blocked, then turn on enforcement for the dangerous rules.
# .prismor/policy.yaml
settings:
default_mode: observe
rules:
- id: destructive-rm-rf
mode: enforce
- id: block-external-egress
mode: enforceStart in observe. Watch. Tune. Enforce.
Prismor maps controls to OWASP LLM Top 10, OWASP Agentic Top 10, NIST AI RMF, EU AI Act, SOC 2, and ISO/IEC 42001. The signed audit trail is the evidence layer under each.
how to stop rogue AI agents AI agent security AI agent governance agent policy enforcement tool call interception prompt injection defense LLM security runtime enforcement observe vs enforce lethal trifecta MCP gateway Model Context Protocol LangChain OpenAI Agents SDK CrewAI Claude Code Cursor OWASP Agentic Top 10 NIST AI RMF SOC 2 secret cloaking agent audit trail how to block AI agent actions enterprise AI agent control plane stop agents going rogue Prismor python