SentinelOne launched Singularity Agentic Detection and Response to watch company AI agents as they work. Until now, employees used AI agents that held real login access and acted on their own.
Because traditional security tools could not see inside agent platforms, teams could not watch what agents did. To close the gap, SentinelOne built the system to track agent behavior and stop rogue actions as they happened.
SentinelOne Agent Monitoring at OneCon 2026
On the 21st of October, SentinelOne unveiled the system at OneCon, its global customer conference, and opened early access immediately. The system became the newest addition to the company’s AI security products. It could list agents, tools, skills, connectors, and Model Context Protocol (MCP) servers across devices and cloud services.
MCP servers let agents use tools and data through one standard connection. Once the list showed which agents existed, teams could set rules on which agents ran and what they reached. Afterward, it could track agent behavior live and block known harmful actions as they happened. In addition, SentinelOne’s system supported agents on Salesforce Agentforce, Microsoft Copilot Studio, ChatGPT workspace, and Claude managed agents.
Furthermore, Chief Product Officer Chris Corde said traditional tools also missed how agents worked with files and operating systems. Corde added that approved agents acting in ways nobody intended posed an equal or bigger risk than attackers.
To cover both risks, SentinelOne built the system on Prompt AI Agent Security, its March release. While the March product found agents and controlled their tool and data links, the new system added live monitoring.
A Clear View of Agent Actions
Tools such as Claude Code, Cowork, and Codex let every employee manage AI agents. Because agents link tool calls on their own, a faulty action could reach company systems before anyone checks it.
Therefore, SentinelOne’s live engine checked agent actions with the same behavior-based method it used against traditional threats. As a result, it could catch agents that went beyond their assigned tasks. Also, the system joined agent and device activity in one chain of events.
The chain showed the user request, AI assistant, and MCP server behind each action. Then, analysts could find where every agent action started. Teams could then stop one rogue agent mid-action without halting the workflow. Corde said, “we can stop rogue agentic actions using the same platform our customers already use.”
Early Access and Real-World Testing
No independent test results were public at launch, so customers will provide the first real-world results on detection accuracy. SentinelOne already serves more than 15,000 customers and partners worldwide. Its platform also protects the devices, identities, mobile systems, and cloud workloads where agents run.
According to Corde, SentinelOne’s approach differs from competitors that rely on network gateways. Network monitoring struggles because tools like Claude run as full virtual machines on the device. So, rival tools without device-level monitoring can’t see or stop those agent actions.
Ultimately, early buyers will compare live monitoring with network gateways as more companies use AI agents. If early customers confirm accurate detection, SentinelOne could make live monitoring a standard part of company AI security.
