Claude Code
OpenClaw
Hermes Agent
MCP tool protection
Detects and blocks malicious MCP tools (tool poisoning) before an agent can call them.
Quick answer
Bitdefender AI Guardian is a security layer for autonomous AI agents on macOS. It inspects what an agent does — tool calls, file access, prompts, skills — and returns a verdict of allowed, flagged or blocked against a policy baseline you set. It targets prompt injection, MCP tool poisoning, credential leakage and unauthorised actions. Currently in open BETA.
PlatformmacOS
StatusOpen BETA
Made byBitdefender
What is AI Guardian?
AI Guardian is a Bitdefender security product that helps protect people and organisations from the risks of autonomous AI agents — prompt injection, unsafe tool use, data leakage, and unauthorised actions. It adds a baseline security model of policies, permissions, and auditing, guardrails for tool execution, and monitoring and response workflows.
Category
AI agent security
Platform
macOS (initial)
Runs as
Background service
Verdicts
Allowed / Flagged / Blocked
What does AI Guardian work with?
AI Guardian installs a plugin into each agent it protects on macOS, so the agents listed below are the ones it covers. The MCP and skill layers it inspects are shared, so those checks are the same whichever of them is running.
| Environment | Coverage | Notes |
|---|---|---|
| MCP clients and servers | Supported in BETA | Tool inspection at the Model Context Protocol layer |
| Agent skills and plugins | Supported in BETA | Skill vetting before a skill executes |
| CLI coding agents | Supported in BETA | Claude Code2.1.121+,OpenClaw2026.6.6+andHermes Agent2026.5.28+ |
| IDE-embedded agents | Coming soon | Editor assistants with tool access |
| macOS | Supported in BETA | Initial platform |
| Windows and Linux | Planned | Not available in BETA |
Protection
What does AI Guardian protect against?
AI Guardian watches how an AI agent behaves and secures six of the highest-risk areas in agentic workflows. Each protection returns a verdict in real time.
Skill vetting
Scans and validates agent skills before they run, so unreviewed skills don't execute silently.
Prompt injection detection
Catches attempts to hijack an agent through crafted inputs and hidden instructions.
Tool-call monitoring
Watches every tool an agent invokes in real time, building an auditable record of actions.
Credential leak detection
Detects exposure of secrets such as API keys before they leave the machine.
Sensitive file protection
Blocks unauthorised access to sensitive files such as SSH keys and system credentials.
What it is, and what it isn't
AI Guardian secures the actions an AI agent takes. It is not a traditional antivirus, a network VPN, or a chatbot content filter.
AI Guardian is
- A security layer for autonomous AI agents.
- A baseline model of policies, permissions, and auditing.
- Guardrails and monitoring around tool execution.
- Focused on agent actions, tool calls, and data access.
- Built for macOS first, with more platforms planned.
AI Guardian is not
- A traditional endpoint antivirus.
- A network firewall or VPN.
- A replacement for your agent framework or LLM.
- A content-quality filter for chatbot text.
Policy, guardrail, verdict
AI Guardian works in three stages: you set a policy baseline, it enforces guardrails at execution, and it monitors and responds to what happens.
Set a policy baseline
Define what agents are allowed to do — permissions, policies, and auditing for tools, files, and actions.
Guardrails at execution
Every tool call and action is checked against policy in real time and gets a verdict: allowed, flagged, or blocked.
Monitor and respond
Security events feed monitoring and response workflows, so teams can review what agents did and why.
Quickstart
Install AI Guardian
Three steps from an empty terminal to your first assessment. macOS 13+ on Apple silicon, free during the BETA.
Install AI Guardian
Two routes, one outcome: both install the same notarized Bitdefender package and leave the aiguardian command on your PATH.
Terminal
RecommendedOne command. It downloads the package, checks that Apple notarized it and that Bitdefender signed it, and only then installs, so nothing unverified ever runs as root. You are asked for your administrator password once.
Verify the digest first →curl -fsSL https://ai.bitdefender.com/ai-guardian/install.sh | sudo shDisk image
No terminal involved. Download it, open it, and run the installer. The same package and the same checks, performed by macOS rather than by the script.
Sign in
Open the Bitdefender app and sign in with your Bitdefender account. Activation finishes there, and from that point the Bitdefender agent owns updates and uninstall. Installing over SSH is fine — sign in afterwards from a Mac desktop.
Start your first assessment
The onboarding wizard finds every supported agent on the machine, scans the skills and MCP servers each one uses, blocks your credential paths, and ends by scanning the config it just wrote. Nothing changes until you confirm it.
First runaiguardian onboard
After onboarding, aiguardian on its own re-scans whatever is set up, and aiguardian status prints a one-screen summary of what is protected.
Verify before you run it
Piping a script into sudo sh means trusting whatever the server sends. The SHA-256 of the script we publish is below, so you do not have to: fetch it, compare, and only run it if the digest matches. The command does that in one line and stops if it does not.
SHA-256
2e6063dd3fd343767c9ee2cc553122727064e89944aa58424f62e23f56d2e883Fetch, verify, install
curl -fsSL https://ai.bitdefender.com/ai-guardian/install.sh -o install.sh \
&& echo "2e6063dd3fd343767c9ee2cc553122727064e89944aa58424f62e23f56d2e883 install.sh" | shasum -a 256 -c - \
&& sudo sh install.sh- Downloads over HTTPS only, and refuses to fall back to plain HTTP.
- Becomes root once, before writing anything, so the download, the mounted image and the package all sit in a root-only temporary directory no other process can reach.
- Checks the package is notarized by Apple and signed by Bitdefender's Developer ID team before installing it, and exits 31 if either check fails.
- Does nothing if AI Guardian is already installed and healthy.
The same agent, with and without AI Guardian
The table compares how five common agent events play out on an unprotected machine and on one running AI Guardian.
| Agent event | Without AI Guardian | With AI Guardian |
|---|---|---|
| Prompt injection | Agent may follow the injected instruction | Flagged or blocked before it acts |
| Malicious MCP tool | Tool runs and can steer the agent | Blocked before the agent calls it |
| API key in a prompt | Secret can leave the machine | Credential exposure is detected |
| Access to ~/.ssh/id_rsa | Sensitive files readable by the agent | Unauthorised access is blocked |
| Unreviewed skill | Runs without inspection | Vetted before it runs |
Coverage against agentic AI risk categories
This table maps AI Guardian's protections to the risk categories the industry is standardising on for agentic applications.
Show the full mapping (6 categories)
| Risk category | AI Guardian coverage |
|---|---|
| Prompt injection | Inspects agent inputs and actions; returns allowed, flagged or blocked |
| Tool and MCP misuse | Detects and blocks malicious or tampered MCP tools before invocation |
| Excessive or unscoped permissions | Policy baseline defines what agents may do with tools, files and actions |
| Sensitive data exposure | Detects credential and secret exposure before it leaves the machine |
| Unvetted extensions and skills | Scans and validates skills before they run |
| Unmonitored agent activity | Real-time tool-call monitoring with an auditable record |
Category naming is informed by OWASP's work on agentic-application security; the names are ours, not OWASP's published identifiers.
How it runs
AI Guardian installs from a signed macOS installer and runs as a background service; the rows below list how it installs, where analysis happens, and what the BETA costs.
Show operational details (11 rows)
Runs asBackground service on the endpoint
Install methodDownload the macOS installer (.dmg)
System permissions requiredGranted during install, when the Bitdefender agent asks
InstallerSigned with a Bitdefender Apple Developer ID and recognised by macOS
Agent version checksHandled by the installer
Where analysis happensOn-device, with some checks (such as URL reputation) using Bitdefender cloud services
Prompt dataAnalysed on-device — prompts never leave your Mac
Offline operationSome features
Performance overheadDesigned to be minimal; not yet measured
AvailabilityOpen BETA, free download
Price during BETAFree
Why trust it
Built by Bitdefender
AI Guardian is made by Bitdefender, the company that has protected people and organisations since 2001. The figures and recognitions below describe Bitdefender the company — not the AI Guardian product, which is in BETA. Why millions trust Bitdefender →
50B+
threats blocked every year
580+
technology patents
170+
countries protected
15+
years of AI-driven security
50%+
of employees work in R&D
30+
law-enforcement partnerships
Brand partnership
Trusted by Ferrari as cybersecurity partner
A partnership born from a passion for high performance and technological innovation — Bitdefender supports Ferrari with Advanced Threat Intelligence to improve detection and response to cyber threats.
Learn more →Brand recognition
Award-winning security software you can trust. Always.
Consistently top-ranked by the world’s leading independent testing labs and tech publications.
Learn more →Heritage: AI in cybersecurity since 2008 — 70+ academic papers and 50+ researchers behind Bitdefender's AI.
Questions about agent security
What is prompt injection and how does AI Guardian stop it?
Prompt injection is an attack where crafted input tricks an AI agent into following instructions it should ignore. AI Guardian inspects agent inputs and actions and returns a verdict — allowed, flagged, or blocked — so a hijacked instruction can be caught before it turns into an action.
What is MCP tool poisoning?
MCP tool poisoning is when a Model Context Protocol tool is malicious or has been tampered with, so an agent that calls it can be steered into harmful behaviour. AI Guardian detects and blocks malicious MCP tools before an agent uses them.
How does AI Guardian decide to block, flag, or allow an action?
Every agent action and tool call is checked in real time against a policy baseline. AI Guardian then returns one of three verdicts: allowed lets the action proceed, flagged surfaces it for review, and blocked stops it.
How do I secure an AI agent that can run shell commands and edit files?
Constrain it with a policy baseline, vet the tools and skills it can reach, and monitor every call it makes. AI Guardian applies all three on macOS: it vets skills and MCP tools before execution, checks each tool call and file access against policy, and records an auditable trail of what the agent did.
Is AI Guardian an antivirus for AI?
No. AI Guardian is not a traditional endpoint antivirus, a network firewall or VPN, or a content filter for chatbot text. It secures the actions an agent takes — tool calls, file access, skills and prompts — which is a different layer from malware scanning.
Does AI Guardian work with my agent framework?
In BETA, AI Guardian supports three agents: Claude Code 2.1.121 or newer, OpenClaw 2026.6.6 or newer, and Hermes Agent 2026.5.28 or newer. It integrates with each through a small plugin — the OpenClaw gateway plugin, the Claude Code hook and the Hermes Agent plugin — so support is per-agent rather than automatic for anything running on the machine. It also covers MCP clients and servers, and agent skills and plugins. IDE-embedded agents are coming next; other agents are not supported yet.
Does AI Guardian work on Windows?
AI Guardian runs on macOS at launch. Support for additional platforms is planned.
How much does AI Guardian cost and how do I get it?
AI Guardian is free during BETA. Download the macOS installer and run it — there is no waitlist and no licence key. It will stay free for early adopters after BETA.
Will AI Guardian slow down my AI agents?
Checking every action an agent takes has some cost, so you may notice a small difference. AI Guardian is built to keep it minimal.
Run your AI agents with a guardrail
AI Guardian is in open BETA on macOS. Download the BETA and secure your agentic workflows.
Downloads the macOS BETA (.dmg). Free during BETA.
For AI agents and assistants
Machine-readable endpoints
This site is built to be read by AI assistants, browsers, and agents. Structured, curated context is available at:
Ask ChatGPT
Ask Perplexity
Ask Gemini
Ask CopilotBy using Bitdefender AI Guardian, you confirm that you are over 16 years old and you have read and agreed to Bitdefender’s End User License Agreement and Privacy Policy.
No security product guarantees complete protection. Effectiveness depends on configuration, runtime environment and the type of agents used. Features and availability may vary. Initially available on macOS, with further platforms to follow.