Take control of your AI agent assets

Frequently asked questions

What is an agent asset, and why does it need its own security layer?

Agent assets are the SKILLs, MCP servers, plugins, hooks, harnesses, and inference gateways that agents load and act through. They are a new software supply chain installed in seconds, often as npx bundles, and most security tools read their activity as innocuous user behavior. Optimus Labs discovers every agent asset, ties it to the identity and owner behind it, and governs it from download through runtime.

How is this different from scanning extensions, packages, or marketplaces?

A scan judges a component at the moment of install. Agent assets change after review: a trusted SKILL can be hijacked, a plugin update can change what it does, and an MCP configuration can grant excess access. Optimus Labs connects each asset's provenance and posture to what the agent later attempts, so risk introduced after install is still caught.

How is this different from AI usage visibility or AI detection and response?

Knowing which AI apps people use, or which prompts reach a model, does not tell you which assets an agent loaded, what they can reach, or who owns them. Optimus Labs maps each agent asset to its identity, owner, reach, and posture, then watches the tool calls it makes on the endpoint and in the cloud, including local actions that never cross a model API.

Is Optimus Labs a DLP, proxy, or gateway?

No. DLP inspects content and gateways see traffic that crosses their path. Agents read files, run commands, and call tools locally, so the riskiest actions may never leave the machine as traffic. Optimus Labs secures agent assets where agents are installed and run, and complements the EDR, AppSec, and DLP tools you already have.

Can Optimus Labs stop a risky action, or only report it?

Both. Posture findings flag risky configurations, and behavior anomaly detection monitors every activity of core agents. Policies can alert, block, or request in-flow justification before an action takes effect, scoped to a single user, a group, or the whole enterprise. Each decision is tied to the asset, owner, identity, tool call, and data path that triggered it.

What is the Lethal Trifecta, and how does Optimus Labs use it?

Untrusted input, sensitive data, and the ability to take external action. When one agent holds all three, a single prompt injection can exfiltrate data or trigger unauthorized action. Optimus Labs scores agent asset posture against this model and enforces policy so no agent holds all three at once.

Where does Optimus Labs run, and will it slow down agent users?

Endpoints, cloud environments, and wherever agents run, with a deep focus on endpoints because that is where most enterprise agent assets execute. A lightweight, agentless sensor deploys through your existing MDM in about two minutes on macOS, Windows, and Linux and does not continuously consume compute. No code changes and no proxy in front of the model. Enforcement can start in observe-only mode.

What data does Optimus Labs collect, and what evidence is kept for audit?

Optimus Labs collects the metadata needed for inventory, posture, and detections, including agent asset identity, tool calls, decisions, and anonymized context. Data is encrypted in transit and scoped per tenant. Audit logs are retained for 90 days with PII anonymized, giving GRC teams evidence without creating unnecessary privacy risk.

Does Optimus Labs have any open source tools?

Yes. We release focused research tools as open source when they help the broader security community. Our latest is Grokpatrol, a forensic CLI for investigating the Grok CLI codebase-upload exposure.