What happened
On Nov 4, 2026 Sysdig announced general availability of Sysdig AI Defense, a runtime product that instruments the agent harness and OS kernel to see what an agent actually does vs. what it reports. It builds a live inventory of agents, harnesses, models, MCP servers, skills and plugins, traces each agent to an accountable human, and allows/pauses/blocks actions against OWASP LLM Top-10-mapped policies, with an immutable audit action-graph and per-agent model-spend attribution. Available for macOS and Windows, covering Claude Code, Codex, GitHub Copilot and Cursor; Sysdig reports ~7 kernel processes per logged agent action.
Why it matters
This is a GA runtime-control layer that treats the kernel (not the agent's self-reported log) as the source of truth, directly addressing the 'agent says one thing, does another' governance gap in production agentic deployments.
Applicability
Enterprises running AI coding/agent workloads (Claude Code, Codex, Copilot, Cursor) that need runtime guardrails, audit records and agent-to-owner accountability should evaluate during initial rollout.