An agent reads fifty customer records, then opens an outbound connection to a host it has never touched. No lock breaks. No alert fires. You issued the credential. You wanted the job done. The agent is doing exactly what you built it to do.
That is what makes an agent a hard exfiltration path. Permission was never the problem. The danger is the shape of the moves, taken together, by one identity, over a window.
A faster insider, with no friction
A human insider moves data at human speed. A coffee break, a second login, a moment of hesitation before the upload. An agent has none of that. It reads a thousand records while a person reads one. It chains a warehouse query straight into a call against an external endpoint with no pause between. And it bends to instruction: a prompt injection buried in a document it was told to summarize can steer it somewhere its operator never intended.
The agent does not have to be compromised for this to go wrong. A healthy agent holding valid credentials can be talked into moving the wrong data to the wrong place through a channel you approved. The instruction was hostile. The access was legitimate. Every control that checks permission waves it through.
This is the insider blind spot, sharpened. The move authorized on purpose, where only the pattern is off, is the exact move permission-based controls exist to allow.
Where the usual controls stop
Identity and access management decides whether the agent may touch a resource. It is good at that. It will not tell you that an agent which normally reads five tables just read fifty, then dialed an endpoint it has never used.
Data loss prevention scans content against rules at the application layer. It catches the obvious copy of a known pattern. It builds no baseline for how a specific agent identity moves data over time, so it cannot notice when that identity drifts from its own history.
API gateways and agent frameworks log calls. A log records what happened. It does not judge whether what happened fit the identity behind it. By the time someone correlates the logs, the data is gone.
None of these is wrong. Each does its job. The structural gap is the same in all of them: they judge each action alone, against a policy, at the instant it occurs. The exfiltration lives in no single action. It lives in the shape of the actions together, by one identity, across a window. That shape only appears at runtime, while the data moves.
Catch the pattern where the data moves
The only place to see the agent's pattern is where the movement happens: at runtime, on the host running the workload, while the data is in motion. Predictive tools guess at intent before the fact and guess wrong often. Forensics reconstruct a loss after it lands. Neither is in the room when the move forms.
Hilt watches data movement at the kernel, metadata only by default, off the path. It does not sit between the agent and its destination, and it does not read your data to work. It runs single-tenant inside your own cloud, on the order of 0.1% of one core and 4 to 8 MB of memory per host. It does not block, drop, or alter the agent's traffic.
Instead it resolves each move to a probabilistic, source-dependent identity: which workload, which agent process, which job, which destination, and whether this fits what that identity normally does. An agent is an identity like any other. Hilt learns how a given agent moves data over time, the sources it reads, the volumes it handles, the destinations it writes to, the hours it runs.
So an agent that summarizes support tickets suddenly runs a bulk read across high-value customer paths and opens an outbound connection to a host it has never contacted. The deviation shows up across layers at once. The job is wrong for that identity. The access is a bulk read in a short window. The destination is new and the volume does not fit it. Any one signal alone is noise. Together they are a pattern, and a pattern is a case, not an alert.
That separates logging what an agent did from governing how it moves data. The first hands you a record to read after the fact. The second surfaces the dangerous shape as it forms, resolved to the identity behind it, narrative already written.
Respond without standing in the agent's way
When the case is real, Hilt isolates the host at the network, quarantine, from the control plane. The move cannot complete and the case can be worked. The collector never sits inline, so it does not filter packets to do this. It observes the move, then acts at the host level once the pattern is clear.
This matters for agentic infrastructure. Agents earn their keep on throughput, and a control that inspects every call inline taxes the exact thing you deployed the agent for. A collector that stays off the path lets you see the full pattern and cut off the host when that pattern is dangerous, without taxing the agent's normal work.
Questions to put to any governance vendor
Deploying autonomous agents against valuable data? Four questions separate governance from log collection.
Does it treat the agent as an identity? Logging API calls is not building a behavioral baseline for a specific agent and scoring its movement against its own history. Ask whether the system resolves each move to the workload and job behind it, or just records that a call happened.
Does it read your data to work? Metadata only by default means the system sees that an agent's pattern is wrong without inspecting content. Content-aware inspection should be there when you choose it, not the price of seeing movement at all.
Where does it sit relative to the agent's traffic? A control inline with every call adds latency to the workload you deployed for speed. Ask whether the collector is off the path, and how it responds once a case is real. Host-level network isolation from the control plane stops the move without standing in every call.
Where does the data stay? For regulated and sensitive workloads, residency decides the deal. The path from kernel event to written case should run single-tenant inside your own cloud, AWS, GCP, Azure, or Ali Cloud, and events should never leave your account.
Agents will move more of your most valuable data than any group of humans ever could, faster, across more systems. They will do it on access you granted on purpose, so permission-based controls keep waving them through. The agent does not break a rule. It does exactly what you allowed, and moves the wrong data to the wrong place in a pattern nothing was built to see.
That pattern is visible in one place: at runtime, on the movement itself, resolved to the agent behind it. If you are putting agents to work against data you cannot afford to lose, it is worth a thirty-minute technical call to walk through how this looks on your own workloads.