Use case · Detect undesired activity

Let AI agents act. Stop what breaks policy.

Optimus Labs watches what coding agents, personal assistants, and proactive agents do, ties each action to its owner, and blocks or alerts on what breaks your policy.

See every deploy, file access, and new destination
Know the asset, owner, and tool call behind each finding
Alert or block by user, group, or enterprise

Book a demo

Published Oct 16, 2026 · Updated Oct 20, 2026

How do I stop AI agents from doing things that break company policy?

It depends on where the agents run and what you need to stop. If coding agents, personal assistants, or proactive agents run on employee endpoints and you need to alert on or block specific actions, such as an unofficial app deployment or data sent to a new destination, Optimus Labs fits: each action is tied to its asset and owner. If your main concern is known malware or attacker infrastructure, threat intelligence and EDR cover that better. If agents only touch email, a DLP rule may be enough.

Optimus Labs · Detections

Illustrative

Coding agent

Railway

Publish internal-app to Railway · Owner: Engineering team

Evaluating

Policy · Approved release path: ScopeEnterpriseConditionDeploy target not in approved hostsResponseBlock, notify admin and owner
How it was detected: ProcessCoding agentCommanddeployDestinationrailway.app (not approved)

BlockedAlert sent to admin and owner

Avoided: an unowned service, unexpected costs, and incident response work.

Illustrative scenarios, not reported incidents or confirmed platform-specific detections.

The risk

Four actions your policies should catch

An action can be technically valid but outside business policy. Undesired activity combines technical risk and business impact, whether or not there is malicious intent.

Unofficial app deployment

An agent builds or publishes an app outside approved workflows, for example on Lovable or Railway.

Seen from: Coding agents

An unreviewed app may expose endpoints, company data, or embedded credentials.

Unowned services, unexpected spend, and release processes bypassed.

Unauthorized infrastructure changes

An agent modifies cloud resources or configuration without approval.

Seen from: Coding agents, Proactive agents

Configuration drift, excessive permissions, or disrupted services.

Downtime, recovery costs, and changes with no accountable approval.

Data leakage

An agent includes sensitive data in a file, commit, or message it creates.

Seen from: Coding agents, Personal assistants, Proactive agents

Sensitive data becomes accessible outside its intended boundary.

Loss of confidentiality, customer trust, and potential reporting obligations.

Data exfiltration

An agent sends sensitive data or credentials to an unapproved destination.

Seen from: Coding agents, Personal assistants, Proactive agents

Data or reusable credentials move beyond company control.

Potential account compromise, loss of intellectual property, and incident response costs.

In practice

Evidence from the wild

One example comes from Optimus Labs · Civilizations research, one from public reporting. Each pairs technical risk with business impact and links to its source. Neither is customer telemetry.

From Optimus Labs · Civilizations

Documented product behavior

A coding CLI uploaded whole repositories in the background

A coding agent CLI bundled entire Git repositories, including secrets deleted from files but still in history, and staged them for upload, even when file access was denied.

01Approved tool
02Background upload
03Code and secrets leave

Technical risk

The upload ran outside the agent's permission prompts, so in-session approvals were not a boundary.

Business risk

Source code and live credentials left without review. Teams could not rotate what they did not know was sent.

What to review

Which harnesses are installed and by whom
Background network activity from agent tools
Secrets present in Git history, not just current files

Source: Optimus Labs discovery write-up, Jul 16, 2026 Read the full briefing

From public reporting

Real incident

An MCP server quietly copied every email to an attacker

In September 2025, an unofficial postmark-mcp package on npm behaved normally for 15 versions, then added one line that blind-copied every email sent through it to an outside address. It was downloaded about 1,500 times before removal. Postmark confirmed it had no involvement.

0115 clean versions
02One-line update
03Every email copied

Technical risk

The agent's actions looked normal. Only the destination of each outgoing email revealed the problem.

Business risk

Password resets, invoices, and customer messages left the company through a tool agents used every day.

What to review

Which MCP servers agents use, and who published them
Unexpected recipients or destinations in agent actions
Version changes to trusted agent tools

Source: Postmark security alert, Sep 25, 2025

How Optimus Labs helps

From action to decision

01
Watch what assets do
The sensor records agent asset behavior, such as tool calls, file access, and new destinations.
02
Connect action and risk
Behavior anomaly detection links each finding to the asset and owner. Review the technical exposure alongside your business policy.
03
Alert or block
Policies alert or block risky actions. Start in observe-only mode, then enforce when ready.

Deploys through your MDM in minutes. macOS and Windows today, Linux coming soon. Prompts and file contents stay on your devices by default. Optimus Labs receives only AI agent asset and behaviour metadata, never PII.

Questions

Is this just threat intelligence?: No. Threat intelligence adds context about known threats and vulnerabilities. Behavior detection evaluates activity from your AI agent assets, including actions that are technically valid but outside business policy. The two complement each other.
Which agents does this cover?: Coding agents, personal assistants, and proactive agents running on the endpoint. All are held to the same policies.
Will this slow my engineers down?: No. Start in observe-only mode, then block only what your policy forbids. Everything else runs as usual.
Does undesired mean malicious?: No. Many risky actions come from a helpful agent doing too much. Optimus Labs looks at what an action does, not why the agent did it.
How is this different from posture findings?: Posture findings describe risky configuration before anything runs. Runtime detection covers what an asset actually does, including changes after review.
What happens when something is detected?: You choose per policy: send an alert to your existing tools, or block the action. Policies apply to a single user, a group, or the whole enterprise.
Did Optimus Labs detect the incidents shown here?: No. The Lovable and Railway scenario is illustrative, not a reported incident or a claim of platform-specific coverage. The sourced examples describe documented CLI behavior from our own research and a publicly reported MCP server that copied outgoing emails to an attacker.