Question 1

What happens when Quint blocks an agent action?

Accepted Answer

The agent receives a structured error response explaining which policy was violated and why the action was blocked, not a cryptic timeout. Blocked events are logged with full context (agent, tool call, matched policy) and raised as alerts. Policies support block, flag, and allow verbs: flag records the match and lets the action proceed, which is how new rules are proven against real traffic before they enforce.

Question 2

How is this different from a CASB or API gateway?

Accepted Answer

CASBs and API gateways sit at the network perimeter, so they only see traffic leaving your infrastructure. Quint sits at the endpoint, seeing tool calls before they execute and OS-level truth as they run. It sees the full context: which agent, what it was asked to do, what tools it's calling, and what data it's accessing. A gateway can't tell you that an agent read a credentials file and then started running destructive commands. Quint sees both halves, correlates them, and raises the finding in real time.

Question 3

We have thousands of endpoints running agents. How does fleet deployment work?

Accepted Answer

Quint ships as a signed package (a daemon plus an OS-level sensor). Deploy via your existing MDM or a one-liner in your provisioning script. Each machine registers with your organization in Quint's cloud automatically. Policies push on heartbeat: a policy change reaches every machine within about a minute. Machine inventory, health monitoring, and agent census are built in.

Question 4

Does Quint read our source code, customer data, or proprietary content?

Accepted Answer

Quint audits agents, but by default it carries what they handle, including what people type into them: the daemon sends prompts, the contents of files an agent reads, the output of commands it runs, command lines and file paths to Quint's cloud. Credentials its detector recognises are masked on some capture paths, not all. Two settings keep that content out of Quint's storage: with log_bodies off, the daemon replaces it with an explicit redaction marker before any event ships, and with content suppression, which Quint enables for an organization on request, Quint's ingest removes it before anything is stored, apart from times when ingest cannot read the setting or the setting has just changed. Either way the cloud still receives metadata: event type, tool, agent, timestamps, findings, the working directory, file and program names, and network destinations.

Question 5

What if an agent uses a tool Quint doesn't recognize?

Accepted Answer

Quint's detection layer operates at the transport and OS level: it inspects HTTP/HTTPS traffic and MCP protocol messages, and observes file, process, and network activity through the operating system's own security events, regardless of the specific tool. Unknown tools are scored using the intrinsic action risk layer (verb + target sensitivity) and flagged for review. The system is protocol-aware, not tool-specific.

Question 6

How does the Ed25519 audit trail hold up in a compliance audit?

Accepted Answer

On each machine, the daemon signs each audit record with that machine's Ed25519 key and chains it to the previous record with SHA-256, so editing a record's tool, arguments, result, verdict or risk makes it fail verification. Four limits matter in an audit: other columns, such as the session id, are not signed; an administrator on that machine can re-sign records with the key stored there; deleting the newest records is not detectable; and a signature shows that the daemon wrote a record, not that what it describes happened (any local process can send the daemon agent-hook events). Check a machine with sudo quint audit verify --data-dir /var/lib/quint; auditors can do so without access to Quint's infrastructure. Quint's cloud keeps a separate hash chain over each event's type, tool name, decision, risk score and time; it is not signed and does not cover the event's content. The format maps directly to SOC 2 CC6.1 (logical access), GDPR Article 30 (records of processing), and EU AI Act Article 12 (logging requirements).

Question 7

Can we write custom policies beyond the built-in frameworks?

Accepted Answer

Policies are declarative rules evaluated on-device: match on agent and tool-name patterns, argument content, and parameter constraints. For example, flag any agent whose arguments touch .pem or .aws/credentials, or act when a transfer amount exceeds a cap. Rules are priority-ordered and run observe-first, so you measure exactly what a rule would have caught on your real traffic before it enforces anything. Policy authoring is operator-managed today; self-serve authoring in the dashboard is on the roadmap.

Question 8

What's the latency impact on agent workflows?

Accepted Answer

Risk scoring and policy evaluation run locally on the machine, with no cloud round-trip in the decision path. A typical agent tool call takes 50–500ms to execute; Quint's in-path work is a lookup against already-synced policy, designed to be invisible at that scale. The daemon uses minimal memory and negligible CPU.

Question 9

What is divergence detection?

Accepted Answer

Quint records two things about every agent: what it said it was about to do, taken from its own tool calls, and what its process then did on the machine, taken from the operating system. The gap between the two is the signal for a compromised, misconfigured or malicious agent, whether it is a coding agent, a support bot or a trading agent.

Question 10

Does Quint monitor human activity?

Accepted Answer

Partly. Quint does not track keystrokes or productivity, but it monitors AI use on the machine, and some of that is people's. What a person types or pastes into an agent is captured and, by default, sent to Quint's cloud. Requests from any program on the machine to the AI provider API hosts Quint intercepts pass through its proxy, which captures them the same way when it can decrypt them; Claude Desktop's traffic is decrypted and captured by design (not yet measured end to end), while ChatGPT Desktop's is recorded only as a connection. When a browser opens an AI chat site such as claude.ai or chatgpt.com, Quint uploads a record of the site and the process id, not the content. Quint's network filter also sees the destination of every other outbound connection from every process, and uploads only those of recognised agent sessions.

Behavioral security
for the agentic era.

Agents are already at work. Security isn’t.

A Cursor agent deleted a company’s production database and the backups stored with it, on a token made for managing domains. It took 9 seconds.

An attacker’s AI agents breached an enterprise in less than ten hours. Human operators would normally need around two weeks.

An OpenAI evaluation agent broke out of its sandbox, reached Hugging Face’s production, and cycled through five exits as each one was closed.

The public record, to 12 Sep 2026: 71 reports

Introducing Quint. Your agents, held to what you asked.

The Quint Intent Model

Agent discovery

Agent observability

Policy enforcement

Threat detection

MCP visibility

Incident response

Live monitoring

Compliance mapping

See everything your agents do.

Decide what they're allowed to do.

Works with what you already run.

Three ways to deploy. One brain behind them.

On the endpoint

In your own agents

Agentless, for SaaS agents

Cross-fleet graph learning

Research & threat analysis

What is AI agent runtime security? The definition, the three layers, and how to evaluate it

Behavioral security for AI agents: what the agent declared vs what the OS recorded

The MCP security checklist: ten checks before you trust an MCP server

Frequently Asked Questions

Your agents are running. See what they're actually doing.

Behavioral securityfor the agentic era.