What happened
On Oct 28, 2026 OX Security introduced Agent Activity, in early access across OX.VibeSec and OX.Cloud, which traces each agent session's prompts, MCP and tool calls, read/write access and sensitive-data touches. It adds custom runtime guardrails scoped by model, MCP server and skill (from 100+ built-in policies) with flag-or-block control, plus a new LiteLLM connector to bring LLM-proxy traffic into view.
Why it matters
Agent Activity closes the gap between agent discovery/code-scanning and what an agent actually did at runtime — the exact visibility gap behind recent agent-injection and shadow-agent incidents — and brings governance that runs at agent speed rather than periodic scan cadence.
Applicability
Security teams running LLM proxies or many MCP-connected agents should evaluate OX Agent Activity for runtime audit trails and guardrail enforcement while it's in early access, and watch for GA.