CagedAgent Runtime
A managed runtime for LLM agents that wraps code execution, secret access, and outbound network calls in credential-injecting proxies, so even a misbehaving agent can never exfiltrate long-lived keys or quietly enroll new nodes on your tailnet.
Head of platform and security at companies shipping customer-facing AI agents (support bots, coding copilots, workflow automators)
- Drop-in SDK that routes every outbound call through a vetted, policy-checked equivalent instead of raw network access
- Per-action allow/deny policies configurable in plain English (e.g., 'agent may read its own vector store but never AWS keys')
- Live audit log of every outbound call the agent attempted, with a one-click freeze-agent kill switch
- Plays nicely with Tailscale, AWS IAM, and Cloudflare Access — no rip-and-replace of your networking stack
After a publicly visible 181-node intrusion and Tailscale's own admission that 'most customers haven't looked at credential injection yet,' teams shipping agents need a turnkey answer that doesn't require rebuilding their network.
Real, documented intrusion (Hugging Face / Tailscale, July 2026) and a dedicated AI agent security category attracting major capital — Noma Security raised a $100M Series B less than a year after its last round, signaling clear enterprise pull.Tailscale in the Hugging Face intrusion: The good news and the bad news ↗Noma Security Raises $100M to Drive Adoption of AI Agent Security ↗
LangChain already shipped an effectively identical primitive — LangSmith Sandboxes' 'Auth Proxy' injects auth headers at the network layer and constrains egress — making this a feature, not a standalone market, for teams already on LangSmith.How Auth Proxy secures LangSmith agent sandboxes ↗LLM Agent Sandbox - GitHub ↗
Clear enterprise willingness to pay: LangSmith monetizes sandboxes as a paid add-on, Noma raised $100M Series B, and Kai launched with $125M for agent security — security budgets are easier to unlock than dev-tools budgets.How Auth Proxy secures LangSmith agent sandboxes ↗Noma Security Raises $100M to Drive Adoption of AI Agent Security ↗
Agent security is structurally durable: as agents scale to thousands of runtimes, credential and egress control becomes permanent infrastructure, reinforced by compliance regimes (SOC2, EU AI Act) targeting autonomous systems.How Auth Proxy secures LangSmith agent sandboxes ↗
Buildable with known primitives (microVMs/Firecracker, eBPF or HTTP egress proxy, OPA-style policy) — LangChain shipped a reference impl in months — but policy UX, multi-cloud secret brokering, and audit/compliance surface area add non-trivial engineering.How Auth Proxy secures LangSmith agent sandboxes ↗LLM Agent Sandbox - GitHub ↗