Skip to content
Guard0

Accountability for AI

AI agent security and governance. Find every AI agent in your company, what it can reach, and who answers for it.

Start free

Agents are already causing incidents.

Fourteen in public since June 2025, in tools most companies already run.

  1. Coding agentsAug 2026A docs file told coding agents inside Fortune 500 networks to install packages nobody owned.
  2. Hugging FaceJul 2026OpenAI's own research agents left their sandbox and reached Hugging Face production.
  3. CursorJul 2026A prompt injection escaped Cursor's sandbox and ran code on the machine.
  4. Claude Code ActionJun 2026A crafted GitHub issue became a push to Claude Code Action and everything downstream.
  5. Code-review agentsApr 2026A pull request title walked secrets out of three vendors' code-review agents.
  6. ServiceNowJan 2026One request could impersonate any ServiceNow user and steer its agents.
  7. Claude CodeNov 2025A state-backed group ran most of an espionage campaign through Claude Code.
  8. postmark-mcpSep 2025An MCP server for sending email quietly copied every message to an outside address.
  9. Nx and AI CLIsAug 2025A poisoned npm package asked the victim's own AI CLIs to find its secrets.
  10. Salesforce, via DriftAug 2025Stolen tokens from the Drift chat agent let attackers export companies' Salesforce data.
  11. GitHub CopilotAug 2025Text in a file could switch GitHub Copilot to auto-approve and run commands.
  12. Amazon QJul 2025A pull request slipped a wipe-everything prompt into the Amazon Q extension for VS Code.
  13. ReplitJul 2025Replit's coding agent deleted a production database during a code freeze.
  14. Microsoft 365 CopilotJun 2025One email, no click, and Microsoft 365 Copilot handed over internal data.

Each one comes down to three questions.

  1. What agents do we have?

    Every agent, assistant and MCP server, registered or not.

    On the registerNot on the registerData store

  2. What can they access?

    The tools, data and systems each one can reach.

    On the registerNot on the registerData store

  3. Are they acting as intended?

    Test the risky paths. Keep the finding, the fix and the retest on record.

    On the registerNot on the registerData store
The Three Questions framework

Three ways AI gets in. Five controls on every agent.

Guard0 reads each way in without write access. Every agent it finds gets the same five controls, in one record with a person who answers for it.

  1. DiscoveryEvery agent, assistant and MCP server, registered or not.Claude Code, found on jchens-mbp
  2. PostureWhat it can reach, and every grant it doesn’t need.Holds a Production DB token after its user was offboarded
  3. TestingAttacks on the agent and the tools it calls, retested after the fix.Local MCP server answered without auth. Fixed.
  4. RuntimeEvery run checked against your policies.Flagged: installed a package on its ownSent to Slack
  5. GovernanceA named owner, and the evidence your auditors ask for.Owner: Priya Nair

Run it where your data has to stay.

Hosted by us, inside your own cloud account, or air-gapped on your hardware. The platform is the same in all three.

  • SaaS

    Guard0 hosts it. Read-only connectors into your accounts.

    Only entity names, owners, scopes and findings leave, with their evidence.

  • Private SaaS

    Inside your cloud account, your keys, your region.

    Nothing leaves your cloud account.

  • Air-gapped

    The entire platform, models included, on your hardware.

    Nothing leaves. No outbound connection.

Works with the tools you already run

See all integrations
  • GitHub
  • GitLab
  • Bitbucket
  • Microsoft
  • AWS
  • Google Cloud
  • Oracle Cloud
  • OpenAI
  • Anthropic
  • Google Gemini
  • Mistral
  • Cohere
  • Hugging Face
  • Ollama
  • Salesforce
  • ServiceNow
  • Glean
  • LangChain
  • LangGraph
  • CrewAI
  • AutoGen
  • LlamaIndex
  • Semantic Kernel
  • Vercel AI SDK
  • n8n
  • Zapier
  • Make
  • Dify
  • Flowise
  • Langflow
  • Claude Code
  • Cursor
  • GitHub Copilot
  • Windsurf
  • Kiro
  • Amp
  • Cline
  • MCP
  • OpenClaw
  • Okta
  • Google Workspace
  • Ping Identity
  • OneLogin
  • JumpCloud
  • Auth0
  • Jamf
  • Iru
  • HashiCorp Vault
  • CyberArk
  • 1Password
  • Doppler
  • Snowflake
  • Databricks
  • BigQuery
  • PostgreSQL
  • Slack
  • Jira
  • Linear
  • PagerDuty
  • Opsgenie
  • Splunk
  • Google SecOps
  • Datadog
  • Elastic
  • Sumo Logic
  • Panther
  • Exabeam
  • CrowdStrike
  • SentinelOne
  • Palo Alto Networks
  • Trend Micro
  • Zscaler
  • Netskope
  • Cloudflare
  • Fortinet
  • Cisco
  • Wiz
  • Orca
  • Tenable
  • Qualys
  • Rapid7
  • Snyk
  • Vanta
  • Drata
  • OneTrust
  • Archer
  • GitHub Actions
  • Jenkins
  • CircleCI

Start free.

Find the agents already running in your company, and who answers for each one.

Start free

Free to start. No card.