Proofpoint unveils AI tool to police autonomous agents

Proofpoint has launched Proofpoint AI Security, a product designed to govern how autonomous AI agents and employees use AI tools inside organisations.

The launch comes as AI agents increasingly browse the web, access internal systems, send emails, execute code and run multi-step workflows with limited human oversight. Proofpoint argues that while existing security controls can track traffic and permissions, they do not determine whether an AI agent's actions match the original request and company policy.

Intent checks

Proofpoint AI Security uses intent-based detection models to continuously evaluate whether AI behaviour aligns with the original prompt, the stated purpose of the request and organisational policy. The system flags risky or misaligned actions in real time, before they lead to outcomes such as non-compliant communications or data loss.

The launch also includes the Agent Integrity Framework, a model for governing autonomous AI in the enterprise. It includes a five-phase maturity model that runs from discovery to runtime enforcement.

Multiple surfaces

Proofpoint AI Security covers several access points for AI tools, including endpoints, browser extensions and connections using the Model Context Protocol (MCP), which some AI agent tools use to connect to external systems and services.

It includes discovery features to identify sanctioned and unsanctioned AI tools used by people and agents. Proofpoint lists examples including OpenClaw, Ollama, ChatGPT and MCP servers. The product also monitors prompts and responses and tracks data flows during AI use.

Organisations can apply access controls and enforce policies during live interactions, which Proofpoint positions as a way to manage risks when AI agents run tasks at machine speed across multiple systems.

Risk focus

Proofpoint highlights risks it associates with autonomous AI agents, including privilege escalation, prompt injection, non-compliant outputs and AI-related data loss. It also points to "zero-click" prompt injection, which it describes as a threat that can occur without a user explicitly interacting with malicious content.

Proofpoint links the offering to its acquisition of Acuvity, citing Acuvity research that 70% of organisations lack optimised AI governance and 50% expect AI-related data loss within 12 months.

"AI is now embedded in how work gets done, and security must evolve with it. Humans and AI agents share similar risks: both can be manipulated and both can take actions that diverge from their intended purpose, yet traditional security was never designed to validate intent," said Sumit Dhawan, CEO of Proofpoint.

Framework pillars

The Agent Integrity Framework defines "Agent Integrity" as assurance that an AI agent operates within the boundaries of its intended purpose, authorised permissions and expected behaviour across interactions, tool calls and data access. Proofpoint says the framework has five pillars: Intent Alignment, Identity and Attribution, Behavioural Consistency, Auditability and Operational Transparency.

The maturity model offers a phased approach for security leaders building governance around AI agent use. Proofpoint says it is designed to work without requiring organisations to replace their existing security architecture.

Proofpoint says the product targets workplaces where AI use spans corporate endpoints, browsers and developer tooling. It highlights developer environments in particular, citing the spread of agent-connected coding assistants, plugins and MCP-integrated tools.

"Humans are expected to operate with integrity when using business systems, and AI agents must be held to the same standard," said Ryan Kalember, executive vice president of cybersecurity strategy at Proofpoint. "Agent Integrity means ensuring that AI agents act within the boundaries of their intended purpose, authorised permissions, and expected behaviour across every interaction, tool call, and data access. With Proofpoint AI Security and the Agent Integrity Framework, we can provide a clear blueprint to help enterprises comprehensively address the full spectrum of risks that emerge when AI agents operate autonomously across enterprise systems."

Proofpoint AI Security is available in global markets.