AI Agents can be incredibly useful, but their autonomous actions can be incredibly dangerous if not adequately controlled.
Max Brin is developing a product he describes as an ‘AV for AI’. The analogy with antivirus can be a little confusing since this product is nothing like a traditional antivirus – but the designation is at least well-known, and the purpose of protecting networks from software mishaps is well understood by security practitioners. The name of the product is OpenLeash, which is more informative: the product keeps a controlling leash on unexpected and unwelcome actions that can be caused by AI agents.
It runs alongside the agent and provides an authorization layer aimed at keeping autonomous AI agents accountable, secure, and aligned with user intent when they perform real-world actions.
Agents tend to inherit the permissions of their user, but they do not inherit any human situational awareness. As such they have wide access and generous permissions across the network, and a single bad prompt, malicious tool, or compromised model can cause real damage.
OpenLeash intercepts agent intentions. Depending on the configuration applied by the user, OpenLeash monitors the agents’ actions and where necessary asks the user if the action by the agent should be allowed. If no, that action is paused. If yes, it is allowed. Brin describes it as ‘medication for AI anxiety’.
He gives an example of the product in action. A misconstrued command, or an error in the agent coding, could cause it to silently delete a database without any human awareness. “When it intends to delete my database, Leash intercepts this message, evaluates it, and tries to understand if the action is risky or not. In some cases, it’s definitely risky, and Leash will just block it immediately. But in other cases where Leash is not sure, it asks the user: did you intend to delete your entire database – or did you intend to upload your credentials to this or that or those websites. Basically, it’s like a guardian angel that intercepts all the conversations between an agent and network assets. It does this on in-house agents, on cloud agents and on third-party agents, and then it helps users decide if they really want the agent to take that specific action.”
The threat exists because the agent alone doesn’t behave as if it needs to ask permission to do something; it’s just performing the instructions it has as it interprets them and does what it is told. OpenLeash is designed to provide a permission layer in the action, regardless of the agent’s interpreted commands.
While OpenLeash is still described as under development, it is also in active use. Brin has a list of planned additions and improvements that he suspects will take a couple of months to complete. Meanwhile, the existing product is already in active use by several hundreds of personal users and at least four organizations.
He sees OpenLeash as especially relevant to the new class of vibe coders.“AI is bringing us the ability to code and write software, even if we don’t know how to write a single line of code, and have zero understanding of cybersecurity,” he says. “There are people who want to write software and create applications or agents to automate their own workload. They have ideas, and they’re a bit like entrepreneurs but with no technical knowledge. They download Claude Code or Cursor to develop AI agents to do what they want, and then turn to OpenLeash to control the agents.”
The product is highly configurable. Acceptable API endpoints, destinations or payment limits can be specified in the configuration. So, for example, payments below a certain threshold can be allowed to proceed, while payments above that threshold will need to be authorized by a human in the loop. The configuration can be amended at any time.
In Brin’s own words, OpenLeash is an AV for AI that tethers reckless agentic behavior, acts as a guardian angel, and provides medication for AI anxiety.
Related: UK Government Rolls Out Agentic AI Defense Plan Alongside Industry Pledge
Related: Critical Vulnerability Exposes GitHub Agentic Workflows to Prompt Injection
Related: Agentic AI Security: Wrong Context, Wrong Decisions at Machine Speed
Related: The New Rules of Engagement: Matching Agentic Attack Speed
