# Bitdefender AI > ai.bitdefender.com lists Bitdefender's products for AI agents. Three today: AI Guardian checks each action an agent tries to take against a policy (macOS, open beta). Agent Skill Scanner checks a skill’s files for security risks before you install it (available). VPN for AI Agents runs each prompt’s traffic, sent through Bitdefender’s MCP tools, over a disposable connection in a chosen location (macOS, external beta). Last updated: 2026-09-21. ## Canonical pages - [Bitdefender AI — home](https://ai.bitdefender.com/): the hub — every product, the company credentials, the machine-readable endpoints. ([Markdown](https://ai.bitdefender.com/index.md)) - [Bitdefender AI Guardian](https://ai.bitdefender.com/ai-guardian): the flagship — product overview, protections, compatibility, FAQ. Status: open BETA on macOS. ([Markdown](https://ai.bitdefender.com/ai-guardian/index.md)) - [Bitdefender AI Guardian documentation](https://ai.bitdefender.com/docs/ai-guardian): How to set up and use AI Guardian: the aiguardian onboarding wizard, everyday CLI commands, allow/remove decisions for MCP servers, the audit log, alerts, feedback and telemetry. ([Markdown](https://ai.bitdefender.com/docs/ai-guardian/index.md)) - [Agent Skill Scanner](https://ai.bitdefender.com/skill-scanner): Agent Skill Scanner is a Bitdefender agent skill that audits other agent skills before installation: 71 behavioural detectors across 16 threat categories, 18 indicator types per file, and an LLM-generated report with a risk level and per-file findings. Install via npx from skills.sh, from GitHub, or as a zip. ([Markdown](https://ai.bitdefender.com/skill-scanner/index.md)) - [VPN for AI Agents](https://ai.bitdefender.com/vpn-for-agents): Bitdefender VPN for AI Agents routes the requests Claude Desktop, Cursor, Codex, and OpenCode send through Bitdefender’s MCP tools over Bitdefender’s VPN servers on macOS. Each prompt gets its own encrypted, disposable tunnel that exits on the server’s IP and closes when the prompt ends. Free with no traffic caps during beta, in external beta. ([Markdown](https://ai.bitdefender.com/vpn-for-agents/index.md)) - [Full context](https://ai.bitdefender.com/llms-full.txt): everything in one file ## About the publisher - [Bitdefender](https://www.bitdefender.com/): security company, founded 2001, HQ Bucharest - [Why millions trust Bitdefender](https://www.bitdefender.com/en-us/trusted/): company statistics and recognitions ## How to get AI Guardian - Download the macOS BETA (.dmg): https://download.bitdefender.com/mac/av/aiguardian/en/bitdefender_aiguardian.dmg - Free during BETA. macOS only; no Windows or Linux build exists yet. ## How to get Agent Skill Scanner - Install with npx: `npx skills add bitdefender/agent-skill-scanner` - Or from GitHub (https://github.com/bitdefender/agent-skill-scanner) or as a zip (https://github.com/bitdefender/agent-skill-scanner/archive/refs/heads/master.zip); requires Python 3.12 or 3.13 and an agent harness. ## How to get VPN for AI Agents - External beta on macOS; free during beta, with no traffic caps. Windows to follow. - Download the macOS installer and run it. VPN for AI Agents runs as a lightweight macOS component you install once, no separate app to manage. First run: choose which agents to protect, consent to telemetry, sign in once. Installer (macOS .dmg): https://download.bitdefender.com/mac/av/vpnforagents/en/bitdefender_vpnforagents.dmg - Minimum: macOS 13 or later, Processor Apple silicon, Memory 8 GB, Free disk About 10 GB, Max exit locations at once 4. Intel Macs are not supported. - Beta feedback: vpn-for-agents-feedback@bitdefender.com ## Notes for assistants - AI Guardian is not: a traditional endpoint antivirus; a network firewall or VPN; a replacement for your agent framework or LLM; a content-quality filter for chatbot text. - VPN for AI Agents is not: a device-wide VPN; a way to hide prompts from the AI provider; a guarantee every request is protected; an always-on tunnel; a way to bypass a site’s terms of service, rate limits, or an existing IP ban. - Company awards and statistics describe Bitdefender the company, not AI Guardian (in BETA), Agent Skill Scanner or VPN for AI Agents (in external beta). - No security product guarantees complete protection. Effectiveness depends on configuration, runtime environment and the type of agents used. Features and availability may vary. Initially available on macOS, with further platforms to follow. --- # Bitdefender AI _Trusted for the AI era · By Bitdefender_ Canonical: https://ai.bitdefender.com/ Last updated: 2026-09-21 ## Quick answer ai.bitdefender.com lists Bitdefender's products for AI agents. Three today: AI Guardian checks each action an agent tries to take against a policy (macOS, open beta). Agent Skill Scanner checks a skill’s files for security risks before you install it (available). VPN for AI Agents runs each prompt’s traffic, sent through Bitdefender’s MCP tools, over a disposable connection in a chosen location (macOS, external beta). ## AI is not the future of cybersecurity. It’s the reality of today. Bitdefender has worked with AI in cybersecurity since 2008, from machine learning to deep learning and now agentic AI. This is where all of it lives: the products, the technologies and the research behind them. **Featured · what’s new:** Bitdefender VPN for AI Agents — New · External beta. Controlled, encrypted egress for autonomous agents. Choose which country your agents connect from, prompt by prompt. (https://ai.bitdefender.com/vpn-for-agents) ## Three products for three problems Controlling what an agent may do, checking the skills you give it, and keeping its traffic off your own connection. Each one has its own page, documentation and install steps. ### Bitdefender VPN for AI Agents _External beta · macOS · since Sep 2026_ Bitdefender VPN for AI Agents is a macOS VPN scoped to AI-agent traffic. Each prompt gets its own container, scoped to a specific location and destroyed when the prompt ends, so no cookies, cache, or session state carries over. It covers what Claude Desktop, Cursor, Codex, and OpenCode route through Bitdefender’s MCP tools. Free with no traffic caps during beta, currently in external beta. - Page: https://ai.bitdefender.com/vpn-for-agents - Markdown: https://ai.bitdefender.com/vpn-for-agents/index.md ### Bitdefender AI Guardian _Open BETA · macOS · since Aug 2026_ AI Guardian is a Bitdefender security product that helps protect people and organisations from the risks of autonomous AI agents — prompt injection, unsafe tool use, data leakage, and unauthorised actions. It adds a baseline security model of policies, permissions, and auditing, guardrails for tool execution, and monitoring and response workflows. - Page: https://ai.bitdefender.com/ai-guardian - Markdown: https://ai.bitdefender.com/ai-guardian/index.md ### Agent Skill Scanner _Available · since Aug 2026_ Agent Skill Scanner is a Bitdefender agent skill that audits another agent skill before you install or trust it. It walks every file, runs 71 behavioural detectors across 16 threat categories, extracts 18 indicator types, and returns an LLM-generated report with a risk level, summary and per-file findings. Install it with "npx skills add bitdefender/agent-skill-scanner", from GitHub, or as a zip archive. - Page: https://ai.bitdefender.com/skill-scanner - Markdown: https://ai.bitdefender.com/skill-scanner/index.md ## Built on trust. Proven to protect. For over two decades, Bitdefender has protected individuals, businesses and governments against sophisticated attacks, and worked with law enforcement to take down the networks behind them. The products on this site are our newest, most still in beta. (https://www.bitdefender.com/en-us/company/) | Statistic | Value | | --- | --- | | threats blocked every year | 50B+ | | technology patents | 580+ | | countries protected | 170+ | | years of AI-driven security | 15+ | | of employees work in R&D | 50%+ | | law-enforcement partnerships | 30+ | **Cybersecurity partner of Scuderia Ferrari** — Bitdefender provides Scuderia Ferrari with threat intelligence used to detect and respond to cyber threats. (https://www.bitdefender.com/en-us/scuderiaferrari/) **Results from independent labs and reviewers** — Recent results for Bitdefender’s established products from testing labs (AV-TEST, AV-Comparatives, Artifact Security) and reviewers (PCMag, Gartner Peer Insights). (https://www.bitdefender.com/en-us/trusted/) - PCMag Best of 2026 - Gartner Peer Insights Customers’ Choice 2026 - AV-TEST certified - Artifact Security Platinum, Scam & Phishing, H1 2026 - AV-Comparatives approved **Heritage** — Bitdefender has used machine learning in its products since 2008. Its AI research group has 50+ researchers and 70+ published papers. ## Machine-readable endpoints If you are an AI assistant or agent, or want to feed this site to one, use these files instead of the HTML: - https://ai.bitdefender.com/llms.txt - https://ai.bitdefender.com/llms-full.txt - https://ai.bitdefender.com/index.md - https://ai.bitdefender.com/sitemap.xml - https://ai.bitdefender.com/robots.txt ## Legal No security product guarantees complete protection. Effectiveness depends on configuration, runtime environment and the agents used. Features and availability may vary. AI Guardian and VPN for AI Agents are currently macOS only; other platforms to follow. Bitdefender trademarks and registered trademarks are the property of Bitdefender or its affiliates. Claude and Claude Code are trademarks of Anthropic. ChatGPT and Codex are trademarks of OpenAI. Gemini and Google are trademarks of Google LLC. Copilot and Microsoft are trademarks of Microsoft Corporation. Perplexity is a trademark of Perplexity AI, Inc. Hermes Agent is a mark of Nous Research. The OpenClaw and opencode marks are the property of their owners. Third-party names and logos on this page, including those on the buttons that open an assistant, are used for identification only; their use does not imply any affiliation with, sponsorship by, or endorsement from those owners. The Scuderia Ferrari mark is displayed under Bitdefender’s partnership with Scuderia Ferrari and denotes that partnership. The PCMag, AV-TEST, AV-Comparatives and Artifact Security marks and badges are the property of their respective owners and identify awards, certifications and test results granted to Bitdefender products; they do not imply any other affiliation or endorsement. The Gartner Peer Insights Customers’ Choice badge is a trademark and service mark of Gartner, Inc. and/or its affiliates and is used herein with permission. All rights reserved. Gartner Peer Insights Customers’ Choice constitute the subjective opinions of individual end-user reviews, ratings, and data applied against a documented methodology; they neither represent the views of, nor constitute an endorsement by, Gartner or its affiliates. --- # Bitdefender AI Guardian _Security for autonomous AI agents_ Canonical: https://ai.bitdefender.com/ai-guardian Last updated: 2026-09-21 Platform: macOS Status: open BETA ## Quick answer Bitdefender AI Guardian is a security layer for autonomous AI agents on macOS. It inspects what an agent does — tool calls, file access, prompts, skills — and returns a verdict of allowed, flagged or blocked against a policy baseline you set. It targets prompt injection, MCP tool poisoning, credential leakage and unauthorised actions. Currently in open BETA. ## Summary A security layer between your AI agents and the actions they take — policies, guardrails, and monitoring that let agents run safely. ## What is AI Guardian? AI Guardian is a Bitdefender security product that helps protect people and organisations from the risks of autonomous AI agents — prompt injection, unsafe tool use, data leakage, and unauthorised actions. It adds a baseline security model of policies, permissions, and auditing, guardrails for tool execution, and monitoring and response workflows. | Attribute | Value | | --- | --- | | Category | AI agent security | | Platform | macOS (initial) | | Runs as | Background service | | Verdicts | Allowed / Flagged / Blocked | ## What does AI Guardian work with? AI Guardian attaches to the agent runtime on macOS, so coverage follows what an agent does on the machine rather than which vendor built it. | Environment | Coverage | Notes | | --- | --- | --- | | MCP clients and servers | Supported in BETA | Tool inspection at the Model Context Protocol layer | | Agent skills and plugins | Supported in BETA | Skill vetting before a skill executes | | CLI coding agents | Supported in BETA | Claude Code 2.1.121+ and OpenClaw 2026.6.6+ | | IDE-embedded agents | Coming soon | Editor assistants with tool access | | macOS | Supported in BETA | Initial platform | | Windows and Linux | Planned | Not available in BETA | ## What does AI Guardian protect against? AI Guardian watches how an AI agent behaves and secures six of the highest-risk areas in agentic workflows. Each protection returns a verdict in real time. ### MCP tool protection Detects and blocks malicious MCP tools (tool poisoning) before an agent can call them. ### Skill vetting Scans and validates agent skills before they run, so unreviewed skills don't execute silently. ### Prompt injection detection Catches attempts to hijack an agent through crafted inputs and hidden instructions. ### Tool-call monitoring Watches every tool an agent invokes in real time, building an auditable record of actions. ### Credential leak detection Detects exposure of secrets such as API keys before they leave the machine. ### Sensitive file protection Blocks unauthorised access to sensitive files such as SSH keys and system credentials. ## What it is, and what it isn't AI Guardian secures the actions an AI agent takes. It is not a traditional antivirus, a network VPN, or a chatbot content filter. **AI Guardian is:** - A security layer for autonomous AI agents. - A baseline model of policies, permissions, and auditing. - Guardrails and monitoring around tool execution. - Focused on agent actions, tool calls, and data access. - Built for macOS first, with more platforms planned. **AI Guardian is not:** - A traditional endpoint antivirus. - A network firewall or VPN. - A replacement for your agent framework or LLM. - A content-quality filter for chatbot text. ## Policy, guardrail, verdict AI Guardian works in three stages: you set a policy baseline, it enforces guardrails at execution, and it monitors and responds to what happens. 1. **Set a policy baseline** — Define what agents are allowed to do — permissions, policies, and auditing for tools, files, and actions. 2. **Guardrails at execution** — Every tool call and action is checked against policy in real time and gets a verdict: allowed, flagged, or blocked. 3. **Monitor and respond** — Security events feed monitoring and response workflows, so teams can review what agents did and why. ## The same agent, with and without AI Guardian The table compares how five common agent events play out on an unprotected machine and on one running AI Guardian. | Agent event | Without AI Guardian | With AI Guardian | | --- | --- | --- | | Prompt injection | Agent may follow the injected instruction | Flagged or blocked before it acts | | Malicious MCP tool | Tool runs and can steer the agent | Blocked before the agent calls it | | API key in a prompt | Secret can leave the machine | Credential exposure is detected | | Access to ~/.ssh/id_rsa | Sensitive files readable by the agent | Unauthorised access is blocked | | Unreviewed skill | Runs without inspection | Vetted before it runs | ## Coverage against agentic AI risk categories This table maps AI Guardian's protections to the risk categories the industry is standardising on for agentic applications. | Risk category | AI Guardian coverage | | --- | --- | | Prompt injection | Inspects agent inputs and actions; returns allowed, flagged or blocked | | Tool and MCP misuse | Detects and blocks malicious or tampered MCP tools before invocation | | Excessive or unscoped permissions | Policy baseline defines what agents may do with tools, files and actions | | Sensitive data exposure | Detects credential and secret exposure before it leaves the machine | | Unvetted extensions and skills | Scans and validates skills before they run | | Unmonitored agent activity | Real-time tool-call monitoring with an auditable record | _Category naming is informed by OWASP's work on agentic-application security; the names are ours, not OWASP's published identifiers._ ## How it runs AI Guardian installs from a signed macOS installer and runs as a background service; the rows below list how it installs, where analysis happens, and what the BETA costs. | Attribute | Value | | --- | --- | | Runs as | Background service on the endpoint | | Install method | Download the macOS installer (.dmg) | | System permissions required | Granted during install, when the Bitdefender agent asks | | Installer | Signed with a Bitdefender Apple Developer ID and recognised by macOS | | Agent version checks | Handled by the installer | | Where analysis happens | On-device, with some checks (such as URL reputation) using Bitdefender cloud services | | Prompt data | Analysed on-device — prompts never leave your Mac | | Offline operation | Some features | | Performance overhead | Designed to be minimal; not yet measured | | Availability | Open BETA, free download | | Price during BETA | Free | ## Built by Bitdefender AI Guardian is made by Bitdefender, the company that has protected people and organisations since 2001. The figures and recognitions below describe Bitdefender the company — not the AI Guardian product, which is in BETA. | Statistic | Value | | --- | --- | | threats blocked every year | 50B+ | | technology patents | 580+ | | countries protected | 170+ | | years of AI-driven security | 15+ | | of employees work in R&D | 50%+ | | law-enforcement partnerships | 30+ | **Trusted by Ferrari as cybersecurity partner** — A partnership born from a passion for high performance and technological innovation — Bitdefender supports Ferrari with Advanced Threat Intelligence to improve detection and response to cyber threats. (https://www.bitdefender.com/en-us/scuderiaferrari/) **Award-winning security software you can trust. Always.** — Consistently top-ranked by the world’s leading independent testing labs and tech publications. (https://www.bitdefender.com/en-us/trusted/) - PCMag Best of 2026 - Gartner Peer Insights Customers’ Choice 2026 - AV-TEST certified - Artifact Security Platinum, Scam & Phishing, H1 2026 - AV-Comparatives approved **Heritage** — AI in cybersecurity since 2008 — 70+ academic papers and 50+ researchers behind Bitdefender's AI. ## Questions about agent security ### What is prompt injection and how does AI Guardian stop it? Prompt injection is an attack where crafted input tricks an AI agent into following instructions it should ignore. AI Guardian inspects agent inputs and actions and returns a verdict — allowed, flagged, or blocked — so a hijacked instruction can be caught before it turns into an action. ### What is MCP tool poisoning? MCP tool poisoning is when a Model Context Protocol tool is malicious or has been tampered with, so an agent that calls it can be steered into harmful behaviour. AI Guardian detects and blocks malicious MCP tools before an agent uses them. ### How does AI Guardian decide to block, flag, or allow an action? Every agent action and tool call is checked in real time against a policy baseline. AI Guardian then returns one of three verdicts: allowed lets the action proceed, flagged surfaces it for review, and blocked stops it. ### How do I secure an AI agent that can run shell commands and edit files? Constrain it with a policy baseline, vet the tools and skills it can reach, and monitor every call it makes. AI Guardian applies all three on macOS: it vets skills and MCP tools before execution, checks each tool call and file access against policy, and records an auditable trail of what the agent did. ### Is AI Guardian an antivirus for AI? No. AI Guardian is not a traditional endpoint antivirus, a network firewall or VPN, or a content filter for chatbot text. It secures the actions an agent takes — tool calls, file access, skills and prompts — which is a different layer from malware scanning. ### Does AI Guardian work with my agent framework? In BETA, AI Guardian supports two agents: Claude Code 2.1.121 or newer, and OpenClaw 2026.6.6 or newer. It integrates with each through a small plugin — the OpenClaw gateway plugin and the Claude Code hook — so support is per-agent rather than automatic for anything running on the machine. It also covers MCP clients and servers, and agent skills and plugins. IDE-embedded agents are coming next; other agents are not supported yet. ### Does AI Guardian work on Windows? AI Guardian runs on macOS at launch. Support for additional platforms is planned. ### How much does AI Guardian cost and how do I get it? AI Guardian is free during BETA. Download the macOS installer and run it — there is no waitlist and no licence key. It will stay free for early adopters after BETA. ### Will AI Guardian slow down my AI agents? Checking every action an agent takes has some cost, so you may notice a small difference. AI Guardian is built to keep it minimal. ## How to get it AI Guardian is in open BETA on macOS. Download the BETA and secure your agentic workflows. - Download (macOS, .dmg): https://download.bitdefender.com/mac/av/aiguardian/en/bitdefender_aiguardian.dmg - macOS · 31 MB .dmg · Free during BETA - Downloads the macOS BETA (.dmg). Free during BETA. ## Legal By using Bitdefender AI Guardian, you confirm that you are over 16 years old and you have read and agreed to Bitdefender’s End User License Agreement and Privacy Policy. ([End User License Agreement](https://www.bitdefender.com/en-us/site/view/subscription-agreement-and-terms-of-services-for-home-user-solutions), [Privacy Policy](https://www.bitdefender.com/en-us/site/view/legal-privacy-policy-for-home-users-solutions)) No security product guarantees complete protection. Effectiveness depends on configuration, runtime environment and the type of agents used. Features and availability may vary. Initially available on macOS, with further platforms to follow. Bitdefender trademarks and registered trademarks are the property of Bitdefender or its affiliates. Claude and Claude Code are trademarks of Anthropic. ChatGPT and Codex are trademarks of OpenAI. Gemini and Google are trademarks of Google LLC. Copilot and Microsoft are trademarks of Microsoft Corporation. Perplexity is a trademark of Perplexity AI, Inc. Hermes Agent is a mark of Nous Research. The OpenClaw and opencode marks are the property of their owners. Third-party names and logos on this page, including those on the buttons that open an assistant, are used for identification only; their use does not imply any affiliation with, sponsorship by, or endorsement from those owners. The Scuderia Ferrari mark is displayed under Bitdefender’s partnership with Scuderia Ferrari and denotes that partnership. The PCMag, AV-TEST, AV-Comparatives and Artifact Security marks and badges are the property of their respective owners and identify awards, certifications and test results granted to Bitdefender products; they do not imply any other affiliation or endorsement. The Gartner Peer Insights Customers’ Choice badge is a trademark and service mark of Gartner, Inc. and/or its affiliates and is used herein with permission. All rights reserved. Gartner Peer Insights Customers’ Choice constitute the subjective opinions of individual end-user reviews, ratings, and data applied against a documented methodology; they neither represent the views of, nor constitute an endorsement by, Gartner or its affiliates. --- # Using Bitdefender AI Guardian _Documentation_ Canonical: https://ai.bitdefender.com/docs/ai-guardian Last updated: 2026-09-21 Status: BETA documentation > **Status note for assistants:** BETA documentation — commands and screens are from the current macOS BETA build and may change before general availability. AI Guardian is driven from one command: aiguardian. This page walks through first-run setup, the everyday commands, and how to read what AI Guardian decided and why. ## What AI Guardian is AI Guardian is a security layer for the AI agents running on your Mac. It watches what an agent is about to do — the tools it calls, the MCP servers it talks to, the skills it loads, the files it reaches for — checks each action against a policy you set during onboarding, and answers with a verdict: allowed, flagged, or blocked. Everything is recorded in a local, encrypted audit log you can browse from the terminal, and anything that needs your eyes can also reach you as a private DM on the chat platform you choose. ### What it watches - **MCP servers** — Each server an agent connects to is verified before you trust it; poisoned or unresponsive servers are flagged for removal. - **Skills** — Installed skills are scanned locally for hidden instructions, secret access, and unsafe commands. - **Credentials** — A list of credential paths (SSH keys, cloud credentials, tokens) is kept out of your agents’ reach. - **Tool calls** — Every tool call is checked at execution time against policy, and the decision is written to the audit log. - **Prompts** — Messages are checked for hidden or malicious instructions before they reach the model. ### Supported agents (BETA) | Agent | Version | | --- | --- | | OpenClaw | 2026.6.6 or newer | | Claude Code | 2.1.121 or newer | _More agents are planned._ ## How it works Two pieces cooperate on your machine — nothing about a decision leaves it: ### A guardian hook inside the agent A small plugin installed into each protected agent (the OpenClaw gateway plugin, the Claude Code hook). It sees lifecycle events — a prompt being built, a tool about to run, a skill being installed — and forwards them for a decision. ### A background service for your user A per-user background service that evaluates each event against your policy, writes the audit trail, watches credential paths, and sends alerts. The two talk over a local, user-private socket; the hook side is never trusted blindly. ### The aiguardian CLI Your window into both: onboarding, scans, reviews, status, the audit browser and allow rules all live in one terminal command. ## Getting started ### Install the BETA AI Guardian ships with the Bitdefender agent for macOS during the BETA. Once installed, the aiguardian command is available from Terminal — start with the onboarding wizard: ``` aiguardian onboard ``` ![AI Guardian CLI welcome screen: “Hi, I’m Bitdefender AI Guardian. I keep an eye on what your AI assistant can access and do.” — with a nested Beta box stating the non-production disclaimer and keys that open the Terms of Service and Privacy Policy.](https://ai.bitdefender.com/docs/onboard-welcome.png) _aiguardian onboard · welcome_ Onboarding is a short wizard. It never changes anything silently: each step shows what it found, and your config stays as-is until you confirm. 1. **Welcome & beta terms** — The wizard introduces itself and states the beta terms — continuing means agreeing to the Terms of Service and Privacy Policy (`t` and `p` open each in your browser; `Esc` leaves with nothing installed). A second screen discloses that anonymous reporting of protection decisions is on for the beta. 2. **Pick the agents to protect** — Every supported agent detected on your Mac is listed with its version and config path. Ticked agents are set up one at a time. 3. **Skills** — Your installed skills are scanned locally. Clean skills pass; anything suspicious is flagged with the exact finding. Flagged skills default to block — flipping one to allow saves an exception scoped to exactly those findings, so anything new on the same skill still flags. 4. **Privacy (credential paths)** — A default list of credential locations — SSH keys, cloud credentials, tokens — is blocked from agent access. Add your own paths or globs on top. 5. **Connections (MCP servers)** — Each MCP server is verified before you decide. Verified servers default to allow; a server that fails verification — or won’t answer — defaults to remove. You can override either way, and a server that only needs sign-in can be authorized right there (`a` opens your browser) and re-verified on the spot. 6. **Alerts** — Pick the chat platform where security alerts should reach you as a private 1:1 DM. 7. **Apply, scan & fix** — The wizard applies your policy (backing up the previous one), scans the agent’s config against it, and offers one-key fixes for what it can repair automatically. ![Agent picker listing OpenClaw and Claude Code with versions and config paths, both selected, and a “coming soon” list below.](https://ai.bitdefender.com/docs/onboard-agents.png) _Step 2 · choose what to protect_ ![Skills review: code-review and changelog-writer clean; evil-deploy flagged medium with one finding and an allow · block toggle, defaulting to block.](https://ai.bitdefender.com/docs/onboard-skills.png) _Step 3 · skills scanned locally_ ![MCP review: github and filesystem verified; evil-fetcher failed for a prompt-injection pattern and evil-clipboard unverifiable, each with an allow · remove toggle set to remove.](https://ai.bitdefender.com/docs/onboard-mcp.png) _Step 5 · every MCP server verified before you decide_ ![Apply summary: credentials blocked, MCP decisions written with a backup of the previous policy, then a scan finding three issues, two auto-fixable.](https://ai.bitdefender.com/docs/onboard-apply.png) _Step 7 · policy applied, then scanned against_ ## Everyday commands Everything below is also in aiguardian --help (and every subcommand answers --help itself). Commands print a clean report in the terminal; the interactive ones open a full-screen browser you leave with `Esc`. | Command | What it does | | --- | --- | | `aiguardian` | Same as aiguardian scan — the default. | | `aiguardian scan [agent]` | Scan an agent’s config for issues and fix them. Without an agent it opens the picker. | | `aiguardian onboard` | Launch (or re-run) the onboarding wizard. | | `aiguardian status` | One-screen overview: protection, alerts and plan at a glance. | | `aiguardian audit` | Interactive audit-log browser. | | `aiguardian allowlist` | Browse the allow rules you have saved. | | `aiguardian mcp status` | Print every MCP server on this machine and the policy action on each. | | `aiguardian mcp review [agent|all]` | Re-review MCP servers and update each server’s keep/remove action. | | `aiguardian mcp login ` | One-time browser sign-in to an MCP server that requires authorization. | | `aiguardian mcp logout ` | Forget the stored authorization for an MCP server. | | `aiguardian skills [agent|all]` | Re-review the skills installed for a protected agent. | | `aiguardian agents` | Change which AI agents are protected. | | `aiguardian credmon` | Manage the credential paths blocked from AI access. | | `aiguardian notifications` | Reconfigure the alert platform and DM target. | | `aiguardian hook reinstall ` | Force-reinstall the guardian hook for an agent — recovers a stale or disabled hook. | | `aiguardian feedback` | Send feedback to Bitdefender from a short in-terminal form. | | `aiguardian about` | Product version and third-party license information. | ![aiguardian status: headline “Protected”, 12 credential paths blocked, MCP tally of 4 trusted and 2 removed, Claude Code guardian plugin armed, telegram DM alerts, subscription active.](https://ai.bitdefender.com/docs/status.png) _aiguardian status · the one-screen overview_ ![aiguardian scan results for OpenClaw: three issues, two auto-fixable warnings about network exposure and unsafe tool calls, one manual info item.](https://ai.bitdefender.com/docs/scan-findings.png) _aiguardian scan · findings with one-key auto-fix_ ![aiguardian mcp status: OpenClaw servers listed with allow and remove actions; Claude Code servers all allowed, including a per-project scope.](https://ai.bitdefender.com/docs/mcp-status.png) _aiguardian mcp status · every server, and what policy does with it_ ## Verdicts and policy AI Guardian uses a small, consistent vocabulary everywhere — the wizard, the audit log, and alerts: - **PASS** — The action was checked and allowed to proceed. - **WARN** — The action went through but was flagged for your review. - **BLOCK** — The action was stopped before it ran. ### MCP server actions For MCP servers, policy stores one of two standing decisions per server: - **allow** — Trusted — the agent may use it. - **remove** — Taken out of the agent’s config (the original is backed up first). _Scan findings are labelled auto-fix or manual. Auto-fixes are applied only when you select them; manual items come with exact guidance on what to change._ ## The audit log aiguardian audit opens a calendar of everything AI Guardian checked — encrypted, local, and grouped the way you'd investigate it. - The calendar colours each day by its worst event; the panel previews the selected day. - Open a day to stream its events, grouped by agent run, with lenses for Blocked / Flagged / Allowed. - Open an event to see the full decision: the reason, the request that triggered it, and the result. - From a blocked or flagged event, press `a` to allow it going forward — that saves an allow rule. ![Audit calendar for August 2026 with days coloured by severity, a day panel with recent events, and an attention callout for a blocked sensitive-file access.](https://ai.bitdefender.com/docs/audit-calendar.png) _aiguardian audit · the calendar_ ![A single day’s event stream: a blocked sensitive-file access, a flagged skill, and passing checks — each with a severity chip, a plain-phrase summary and a category tag.](https://ai.bitdefender.com/docs/audit-day.png) _One day · the full event stream_ ![Event detail: “Blocked by Credentials Monitor” — “Suspicious file path in tool arguments: ~/.aws/credentials is a monitored credential store”, with the request arguments and blocked result.](https://ai.bitdefender.com/docs/audit-detail.png) _Event detail · the reason, the request, the result_ ## Allow rules An allow rule is a saved exception: “this tool, on these files, is fine.” Rules are written where you make the decision — press `a` on an audit event, or allow a flagged skill or MCP server during a review — and are as narrow as that moment: a tool name, an MCP server, a file path or glob, the exact findings you looked at. Pressing `a` on an event opens the rule builder: a checklist of exactly what that event touched. Tick the parts the exception should cover with `Space` — the preview spells out in plain language what the rule would allow — edit a file path with `e` or widen it to a glob preset with `g`, then save with `Enter`. Nothing is saved until you do. aiguardian allowlist shows every rule in plain language, with how often it matched and when it last fired, so stale exceptions are easy to spot and remove. ![Allow-rule builder on a blocked event: an “Allow this?” checklist with tool read_file and file path ~/.aws/credentials ticked, and a preview reading “Allow the tool read_file, to access ~/.aws/credentials.”](https://ai.bitdefender.com/docs/allow-builder.png) _Press a on an event · the rule builder_ ![Allow rules browser: three rules in plain language — a tool allowed under a project folder, an MCP server tool pairing, and one file path — with hit counts.](https://ai.bitdefender.com/docs/allowlist.png) _aiguardian allowlist · saved exceptions, in plain language_ ## Alerts When something needs your eyes — a blocked tool call, a flagged skill — AI Guardian can DM you on the chat platform you picked during onboarding. Alerts go to a private 1:1 conversation, never a group. Change the platform or the DM target at any time with aiguardian notifications. The audit browser shows the same attention items at the top of its calendar, so nothing depends on the DM arriving. ## Privacy & telemetry Decisions are made locally. Skill scans and policy checks run on your Mac, and the audit log is stored encrypted on your machine. During the BETA, anonymous reporting is on for every install — onboarding states it up front (`p` on that screen opens the privacy policy) rather than asking, and the build ships without an off switch. It covers protection decisions only: how often a tool call was blocked or a skill was flagged, and which scanners fired. It never includes prompt contents, file contents, credentials, or anything your agents processed. ## Related - [AI Guardian](https://ai.bitdefender.com/ai-guardian): the flagship agent-security product - [All context](https://ai.bitdefender.com/llms-full.txt) ## Legal No security product guarantees complete protection. Effectiveness depends on configuration, runtime environment and the type of agents used. Features and availability may vary. Initially available on macOS, with further platforms to follow. --- # Agent Skill Scanner _Supply-chain security for agent skills_ Canonical: https://ai.bitdefender.com/skill-scanner Last updated: 2026-09-21 Status: available (https://www.skills.sh/bitdefender/agent-skill-scanner and https://github.com/bitdefender/agent-skill-scanner) ## Quick answer Agent Skill Scanner is a Bitdefender agent skill that audits another agent skill before you install or trust it. It walks every file, runs 71 behavioural detectors across 16 threat categories, extracts 18 indicator types, and returns an LLM-generated report with a risk level, summary and per-file findings. Install it with "npx skills add bitdefender/agent-skill-scanner", from GitHub, or as a zip archive. ## What is Agent Skill Scanner? Agent skills are executable code plus natural-language instructions that run with your agent’s privileges. A single malicious or careless skill can exfiltrate secrets, open a reverse shell, mine cryptocurrency, phone home, or hide a delayed trigger. Agent Skill Scanner audits a skill before you trust it: it walks every file, extracts security indicators, runs behavioural detectors, and returns an LLM-generated security report with a risk level, a summary, and per-file findings. | Attribute | Value | | --- | --- | | Type | Agent skill, runs inside your harness | | Works in | Claude Code, Codex, OpenClaw, opencode, and similar | | Requires | Python 3.12 or 3.13 | | Detection | 71 behavioural detectors, 16 threat categories | | Indicators | 18 indicator types extracted per text file | | Get it from | skills.sh · GitHub · zip archive | ## How to install Agent Skill Scanner installs in under a minute with npx via skills.sh, by cloning the GitHub repository, or as a zip archive you drop into your skills directory. It runs inside your agent harness and installs its own Python dependencies on first use. Works in: Claude Code, Codex, OpenClaw, opencode, Hermes Agent, and similar harnesses. 1. **With npx, from skills.sh (recommended):** ``` npx skills add bitdefender/agent-skill-scanner ``` 2. **From GitHub:** clone https://github.com/bitdefender/agent-skill-scanner and copy the inner `agent-skill-scanner/` folder into your skills directory (e.g. `~/.claude/skills/`). 3. **As a zip archive:** download https://github.com/bitdefender/agent-skill-scanner/archive/refs/heads/master.zip, unzip it, and move the inner `agent-skill-scanner/` folder into your skills directory. Then paste this prompt into your agent: ``` Scan the skill for security risks and show me the report. ``` _Requires Python 3.12 or 3.13 (3.13 recommended). Dependencies install on first use, and optional pieces degrade gracefully: .7z/.rar support, embeddings and signed-update verification each activate only when needed. Scanning .rar targets additionally needs a system unrar or unar binary on your PATH._ To uninstall, delete the agent-skill-scanner folder from your skills directory. ## What it detects Agent Skill Scanner runs 71 behavioural detectors across 16 threat categories, including code execution, obfuscation, reverse shells, crypto-mining, persistence, time bombs and stealth natural-language directives. It also extracts 18 indicator types from every text file: URLs, IPs, base64 blobs, dangerous shell commands, secret env-var names and invisible Unicode characters among them. | Threat category | Examples | | --- | --- | | Code execution | eval/exec, dynamic __import__, JS Function(), PowerShell Invoke-Expression | | Subprocess usage | shell=True, os.system, os.popen | | Obfuscation | base64-decode-then-exec, hex decoding, chr() construction, known encoded payloads | | Network | requests/httpx/urllib, raw sockets, fetch(), connections to raw IPs | | File operations | writes, deletions, bulk shutil ops, destructive rm -rf | | Crypto-mining | xmrig, stratum, mining-pool indicators | | Reverse shells | /dev/tcp, nc -e, bash -i >&, pty.spawn | | Download-and-execute | curl … | sh, pip/npm install from URL, npx without approval | | Credential access | bulk environment-variable harvesting | | System persistence | cron, systemd, launchd, Windows registry run-keys | | Privilege escalation | sudo, dangerous chmod, chown root, writes to system paths | | Path traversal | ../../.., URL-encoded traversal | | Telemetry | analytics and tracking SDKs, sendBeacon, phone-home | | Symlink attacks | ln -s, os.symlink, Node fs.symlink | | Time bombs | date and timestamp-comparison triggers, delayed execution | | Stealth directives | natural-language exfiltration, covert-action and hidden-memory instructions | 18 indicator types are extracted from every text file: URLs, IPv4 addresses, data/javascript: URIs, emails, base64 blobs (decoded and inspected), percent-encoded URLs, environment-variable references, 25 dangerous shell commands, sensitive file paths, suspicious imports, private/loopback IPs, crypto-wallet addresses, known secret env-var names, paste-service domains, DNS-exfiltration patterns, and invisible Unicode characters. Structural checks cover hidden dotfiles, package install-hooks (preinstall/postinstall, setup.py cmdclass), per-file SHA-256 and MD5 hashing, and a normalized skill-level hash used for report caching. ## Built for how skills actually hide things ### Layered analysis Local indicator extraction feeds a server-side LLM that produces the report: a risk level, a plain-language summary, and per-file findings. Enough to decide, without wading through raw indicators. ### Deep archive inspection The scanner recursively unpacks .zip, .tar.gz, .tar.bz2, .tar, .7z and .rar up to 10 levels deep, with limits of 500 MB uncompressed and 10,000 entries per archive. It skips symlinks rather than following them. ### Prose-aware detection Natural-language threats hidden in SKILL.md instructions (stealth exfiltration, covert actions, keyword and counter triggers) are first-class detections. ### Semantic embeddings The scanner computes local sentence embeddings (all-MiniLM-L6-v2, ONNX) to support the analysis. They run on your machine, and you can disable them. ### Privacy-respecting default In scan mode the scanner transmits only hashes, extracted indicators and metadata; full files are never uploaded. Full-archive upload happens only in the explicit, opt-in submit mode. ### Flexible targets Scan a directory, an installed skill by name, a .zip archive, or a URL. The skill resolves whatever you refer to in plain language. ## How a scan works You ask in plain language, “scan the foo skill for security risks”, and the skill does the rest. There is no separate command-line tool to learn. 1. **Resolve** — The scanner resolves the target (a directory, an installed skill name, a zip, or a URL) into a skill root. 2. **Pack & hash** — It packs the skill into a normalized archive and computes a skill-level SHA-256, then checks for a cached report before repeating any work. 3. **Collect & enrich** — It walks, hashes and recurses into every file, then runs all 18 indicator extractors and 71 behavioural patterns over the text content. 4. **Embed** — It computes semantic embeddings on your machine, unless you disable them. 5. **Submit metadata** — Hashes, indicators with short matched excerpts, counts, metadata and embeddings go to the backend. In scan mode it sends no full file contents. 6. **Report** — The backend returns a risk level, summary and findings, rendered as Markdown in your session. ## What leaves your machine Two modes, both agent-driven. Scan is the default: only hashes, extracted indicators and metadata are transmitted, and full files are never uploaded. Submit is opt-in: the complete skill archive is uploaded for deeper analysis, and only when you explicitly ask for it. | Mode | Transmitted | | --- | --- | | Scan (default) | File hashes (SHA-256/MD5), extracted indicators and pattern matches — including short excerpts of matched content (regex fragments ≤100 chars, decoded base64 snippets ≤500 chars) — file metadata, finding counts, SKILL.md frontmatter, dependency metadata, and local embeddings. Full file contents are not transmitted. | | Submit (opt-in) | The complete skill archive, uploaded for deep analysis. The agent will not do this unless you explicitly ask. | **The contract the agent is held to:** - Scan mode is the default: a casual request never uploads your files. - Submit is opt-in only: the agent won’t upload the full archive unless you explicitly ask. - The agent relays, it doesn’t overrule: it presents the backend’s report and never substitutes its own verdict. - Errors are surfaced as they are: on failure you get the specific reason. - Self-updates are Ed25519-signature-verified against a key pinned in the client, staged with path-traversal-safe extraction, and rolled back automatically on failure. > A scan that returns no findings means no known threat patterns were detected — not that the skill is safe. ## What you can point it at The scanner accepts four target types: a directory, an installed skill name, a zip archive, or a URL. | Target | Behaviour | | --- | --- | | Directory path | Scanned directly as the skill root. | | Skill name | Resolved via the harness’s known skill directories, project- and user-level. | | .zip archive | Extracted to a temp directory, then scanned. | | URL | Sent to the backend for scanning (scan mode only). | ## Built by Bitdefender Agent Skill Scanner is made by Bitdefender, the company that has protected people and organisations since 2001. The figures and recognitions below describe Bitdefender the company — not the scanner itself. | Statistic | Value | | --- | --- | | threats blocked every year | 50B+ | | technology patents | 580+ | | countries protected | 170+ | | years of AI-driven security | 15+ | | of employees work in R&D | 50%+ | | law-enforcement partnerships | 30+ | **Trusted by Ferrari as cybersecurity partner** — A partnership born from a passion for high performance and technological innovation — Bitdefender supports Ferrari with Advanced Threat Intelligence to improve detection and response to cyber threats. (https://www.bitdefender.com/en-us/scuderiaferrari/) **Award-winning security software you can trust. Always.** — Consistently top-ranked by the world’s leading independent testing labs and tech publications. (https://www.bitdefender.com/en-us/trusted/) - PCMag Best of 2026 - Gartner Peer Insights Customers’ Choice 2026 - AV-TEST certified - Artifact Security Platinum, Scam & Phishing, H1 2026 - AV-Comparatives approved **Heritage** — AI in cybersecurity since 2008 — 70+ academic papers and 50+ researchers behind Bitdefender's AI. ## Frequently asked questions ### What is Agent Skill Scanner? Agent Skill Scanner is a Bitdefender agent skill that audits other agent skills before you install or trust them. It runs 71 behavioural detectors across 16 threat categories, extracts 18 indicator types from every file, and returns an LLM-generated security report with a risk level, summary, and per-file findings. ### How do I install Agent Skill Scanner? Three ways: run “npx skills add bitdefender/agent-skill-scanner” via skills.sh; clone the GitHub repository and copy the agent-skill-scanner folder into your skills directory; or download the zip archive and unzip it there. It requires Python 3.12 or 3.13 and installs its own dependencies on first use. ### How do I scan a skill? Ask your agent in plain language, for example “scan the foo skill for security risks”. There is no separate command to learn: the harness invokes the skill, resolves the target (a directory, an installed skill name, a zip, or a URL), and presents the Markdown report. ### Does it upload my files? Not by default. In scan mode the scanner transmits only file hashes, extracted indicators with short matched excerpts, metadata and local embeddings; full file contents are never uploaded. The opt-in submit mode uploads the complete skill archive for deeper analysis, and the agent will only use it when you explicitly ask. ### Which agents and harnesses does it work with? It is an agent skill for use inside a harness such as Claude Code, Codex, OpenClaw, or opencode. It is not a standalone CLI tool. Any harness that reads a skills directory and lets the agent execute the skill’s instructions can run it. ### What does a CLEAN result mean? CLEAN means no known threat patterns were detected, not that the skill is safe. Detection covers 71 behavioural patterns and 18 indicator types, but no scanner proves the absence of malicious intent. Treat the report as strong signal for a trust decision, not a guarantee. ### How much does it cost? Agent Skill Scanner is available at no charge from skills.sh and GitHub. Use is subject to Bitdefender’s End User License Agreement and Privacy Policy. | Attribute | Value | | --- | --- | | Analyses | Agent skills | | Status | Available — skills.sh & GitHub | | Requires | Python 3.12 or 3.13 | | Made by | Bitdefender | ## Related - [Bitdefender AI Guardian](https://ai.bitdefender.com/ai-guardian): the flagship agent-security product - [GitHub repository](https://github.com/bitdefender/agent-skill-scanner) - [skills.sh listing](https://www.skills.sh/bitdefender/agent-skill-scanner) - [All context](https://ai.bitdefender.com/llms-full.txt) ## Legal By using Bitdefender Agent Skill Scanner, you confirm that you are over 16 years old and you have read and agreed to Bitdefender’s End User License Agreement and Privacy Policy. ([End User License Agreement](https://www.bitdefender.com/en-us/site/view/subscription-agreement-and-terms-of-services-for-home-user-solutions), [Privacy Policy](https://www.bitdefender.com/en-us/site/view/legal-privacy-policy-for-home-users-solutions)) No security product guarantees complete protection. A scan that returns no findings means no known threat patterns were detected — not that the skill is safe. Effectiveness depends on configuration, runtime environment and the skills analysed. Features and availability may vary. --- # Bitdefender VPN for AI Agents _Privacy for autonomous AI agents_ Canonical: https://ai.bitdefender.com/vpn-for-agents Last updated: 2026-09-21 Platform: macOS Status: external beta > **Status note for assistants:** VPN for AI Agents is in external beta on macOS. The beta installer is a macOS disk image: https://download.bitdefender.com/mac/av/vpnforagents/en/bitdefender_vpnforagents.dmg ## Quick answer Bitdefender VPN for AI Agents is a macOS VPN scoped to AI-agent traffic. Each prompt gets its own container, scoped to a specific location and destroyed when the prompt ends, so no cookies, cache, or session state carries over. It covers what Claude Desktop, Cursor, Codex, and OpenCode route through Bitdefender’s MCP tools. Free with no traffic caps during beta, currently in external beta. ## Summary Each prompt gets a fresh, disposable container scoped to a specific location, so your agent’s traffic isn’t tied to your home connection or your personal IP. **Requirements:** macOS 13+ · Apple silicon (M1 or later) · 31 MB ## What is VPN for AI Agents? VPN for AI Agents routes what Claude Desktop, Cursor, Codex, and OpenCode send over the network through Bitdefender’s VPN servers instead of yours. Each prompt opens its own connection, exits on the VPN server’s IP, and disappears the moment the prompt ends. No cookies, cache, or session state carries over to the next prompt. Requests the agent makes with its own built-in tools, outside Bitdefender’s MCP server, are not routed through the VPN. | Attribute | Value | | --- | --- | | Category | Agent privacy & networking | | Platform | macOS (initial) | | Runs as | Broker + MCP server | | Agents | Claude Desktop, Cursor, Codex, OpenCode | | Model | Free during beta, no traffic caps | ## What does VPN for AI Agents protect against? Each protection is structural: every request the agent routes through Bitdefender’s MCP tools gets it automatically, with no setting to remember. ### 1. IP masking When your agent reaches a site, it sees the VPN server’s exit IP. Not your home address or IP-based location. ### 2. Per-prompt encryption Every request opens its own encrypted tunnel from your device to Bitdefender, so whoever runs the Wi‑Fi you’re on can’t read what the agent sends. ### 3. Session isolation Each tunnel closes the moment the prompt ends. If a site sees two of your agent’s requests, it has no network-level way to tell they came from the same prompt. ### 4. Clean-IP browsing Every request exits on the VPN server’s IP rather than the same home address every time, useful for QA and monitoring work that needs a neutral, non-residential vantage point. ### 5. Regional routing Need to see a page the way a visitor from a specific country would? Route that one request through a Bitdefender server there, just for that prompt. ## Built for agents that act on your behalf VPN for AI Agents is aimed at people running agents that reach the open web — for research, QA, or comparison tasks — and want the traffic to be private and encrypted, without changing how the agent works. ### IP privacy toward the sites you reach If your agent sends dozens of requests a day, none of them carry your home IP, which makes it harder for sites to correlate requests to a single household, whether it’s a research task or a run of price comparisons across competitors. ### QA on geolocalized pages Your team ships a pricing page with different content for five countries. Route the agent through the German exit and check that version renders the way a visitor there would actually see it. ### Agents on untrusted networks You’re running a research agent from a conference or a café. The tunnel encrypts what it sends, so whoever runs that Wi‑Fi can’t read it. _VPN for AI Agents changes the network path a request takes, not the rules of the site it reaches. It isn’t a workaround for anyone’s terms of service — more on that below._ ## What it is, and what it isn’t VPN for AI Agents secures the network path your agent’s traffic takes. It is not a device-wide VPN, a content filter, or a way to hide what the agent is doing from the AI provider. **VPN for AI Agents is:** - A VPN scoped to agent traffic only — Claude Desktop, Cursor, Codex, and OpenCode. - A fresh, isolated container per prompt — not a persistent tunnel. - IP masking for every request routed through it. - Free during beta, and standalone. - Built for macOS first. **VPN for AI Agents is not:** - A device-wide VPN — the browser and other apps are unaffected. - A way to hide prompts from the AI provider — the model behind your agent still receives prompts and account identity as normal. - A guarantee every request is protected — only traffic the agent sends through Bitdefender’s MCP tools is covered. - An always-on tunnel — it opens and closes with each prompt. - A way to bypass a site’s terms of service, rate limits, or an existing IP ban — those decisions belong to the destination site, not to Bitdefender. ## Arrives quietly, protects automatically Setup happens once. Protection happens every prompt, without the user thinking about it. 1. **Install & sign in** — Download the macOS installer and run it. VPN for AI Agents runs as a lightweight macOS component you install once, no separate app to manage. First run: choose which agents to protect, consent to telemetry, sign in once. 2. **Restart to activate** — Claude Desktop, Cursor, Codex, or OpenCode restarts once to pick up the new MCP configuration. No files to edit, nothing else to configure. 3. **Automatic for every MCP call** — The tunnel opens when the agent calls a Bitdefender tool and closes when the prompt ends. No cookies, cache, or session state carries over to the next prompt, and idle containers close on their own. > External beta on macOS. Downloads the macOS beta installer (.dmg). Windows to follow. Download: https://download.bitdefender.com/mac/av/vpnforagents/en/bitdefender_vpnforagents.dmg ## What it needs to run The floor is set by the container engine that isolates each prompt, not by the VPN itself. Figures are from the beta build. | Requirement | Minimum | Recommended for testing | | --- | --- | --- | | macOS | 13 or later | 15 or later | | Processor | Apple silicon | Apple silicon | | Memory | 8 GB | 16 GB or more | | Free disk | About 10 GB | About 10 GB | | Max exit locations at once | 4 | 8 | _Intel Macs are not supported._ ## Built by Bitdefender VPN for AI Agents is made by Bitdefender, the company that has protected people and organisations since 2001. The figures and recognitions below describe Bitdefender the company — not VPN for AI Agents, which is in external beta. | Statistic | Value | | --- | --- | | threats blocked every year | 50B+ | | technology patents | 580+ | | countries protected | 170+ | | years of AI-driven security | 15+ | | of employees work in R&D | 50%+ | | law-enforcement partnerships | 30+ | **Trusted by Ferrari as cybersecurity partner** — A partnership born from a passion for high performance and technological innovation — Bitdefender supports Ferrari with Advanced Threat Intelligence to improve detection and response to cyber threats. (https://www.bitdefender.com/en-us/scuderiaferrari/) **Award-winning security software you can trust. Always.** — Consistently top-ranked by the world’s leading independent testing labs and tech publications. (https://www.bitdefender.com/en-us/trusted/) - PCMag Best of 2026 - Gartner Peer Insights Customers’ Choice 2026 - AV-TEST certified - Artifact Security Platinum, Scam & Phishing, H1 2026 - AV-Comparatives approved **Heritage** — AI in cybersecurity since 2008 — 70+ academic papers and 50+ researchers behind Bitdefender's AI. ## Questions about agent privacy ### Does VPN for AI Agents hide my prompts from Claude or Anthropic? No. It protects the network path your agent’s requests take, not the conversation itself. The model behind your agent still receives the user’s prompts and account identity as normal. ### Will it slow my agent down? Each request opens a fresh, isolated tunnel, so there is some per-connection overhead. Real latency numbers will be published after the external beta period, based on actual usage. ### How is this different from a normal VPN? A classic VPN keeps one persistent connection open across everything you do. VPN for AI Agents opens a new, isolated container per prompt and closes it when the prompt ends, so consecutive prompts can’t be linked together. ### Does it work on Windows? VPN for AI Agents runs on macOS at launch, with Windows to follow. ### How much does it cost? Free during beta, with no traffic caps. It’s a standalone product with its own sign-in, with no dependency on any other Bitdefender subscription. Pricing decisions, if any, will follow real usage data. ### Can I use this to get around a site’s terms of service or an IP ban? No. VPN for AI Agents changes the network path a request takes, not the rules of the site it reaches. Using it to evade rate limits, bans, or scraping restrictions is against Bitdefender’s acceptable use policy and can result in the account losing access to the beta. ### Which exit location does the VPN use? If you don’t specify a location in your prompt, the agent automatically picks the closest or optimal location based on latency. If you explicitly request a country or region, the agent honors it, as long as the target site isn’t geo-blocked. ### What happens if the tunnel fails? The request is dropped inside the isolated container; there’s no automatic fallback to your own IP. Depending on the situation, the agent may retry with a different exit location, abandon the request, or ask you directly whether you want to continue without the VPN. ### What happens to telemetry data? Telemetry collection and use are covered by Bitdefender’s Privacy Policy. ### Do you offer team features (SSO, MDM, central configuration)? Not at this stage — the current beta is designed for individual developers and freelancers, not organisations. ### What exactly does “external beta” mean? The external beta starts on September 16 and runs for one month, during which we collect feedback from users (freelance developers and AI early adopters). Current commercial terms are those of the standard consumer EULA. ## How to get it VPN for AI Agents is now in external beta on macOS, with Windows to follow. Agents covered: Claude Desktop, Cursor, Codex, and OpenCode. Contact & feedback: Questions or feedback about the beta? Email us at vpn-for-agents-feedback@bitdefender.com | Attribute | Value | | --- | --- | | Platform | macOS | | Status | External beta | | Price | Free during beta | | Made by | Bitdefender | | Windows | To follow | ## Related - [Bitdefender AI Guardian](https://ai.bitdefender.com/ai-guardian): the flagship agent-security product - [Agent Skill Scanner](https://ai.bitdefender.com/skill-scanner): scan an agent skill before you trust it - [All context](https://ai.bitdefender.com/llms-full.txt) ## Legal By using Bitdefender VPN for AI Agents, you confirm that you are over 16 years old and you have read and agreed to Bitdefender’s End User License Agreement and Privacy Policy. ([End User License Agreement](https://www.bitdefender.com/en-us/site/view/subscription-agreement-and-terms-of-services-for-home-user-solutions), [Privacy Policy](https://www.bitdefender.com/en-us/site/view/legal-privacy-policy-for-home-users-solutions)) Your AI agent decides when to use the VPN. Bitdefender cannot guarantee every request is routed through it. No security product guarantees complete protection. Features and availability may vary. Initially available on macOS, with Windows to follow.