Cortex XDR One: inventory the AI agents on your laptops

AI agent security just moved onto the laptop. Palo Alto Networks has released Cortex XDR 6.0 and Cortex XDR One, which put its endpoint detection and Agentic Endpoint Security (built on the Koi acquisition) in one console and one sensor. The pitch: find every AI agent, MCP server and plugin on a device, score the risk, and stop bad actions before they run. You don't need Palo Alto to steal the idea.

What actually happened

Palo Alto's Cortex XDR 6.0 post, dated October 19, describes the release:

• Discovery. The sensor finds agents, MCP servers, plugins, models and extensions on endpoints, and scores each by publisher, code makeup and runtime behavior. Scores update over time, including when a component updates silently.
• Runtime control. Agent actions go into one session-based audit trail. Actions that break guardrails or custom policies are blocked before they execute. Policy templates map to MITRE ATLAS.
• App coverage. Named examples include ChatGPT, Claude Desktop, OpenClaw and Hermes, with outgoing prompts intercepted and responses monitored.
• On-device models. Small language models on the sensor check hidden or obfuscated scripts before they run.
• Standalone path. A targeted sensor can run just the agent module next to another vendor's EDR.

Add-on modules need extra licenses. The post lists no pricing or GA date. The agent tech comes from Koi, which Palo Alto finished buying in April. Trade coverage at ITdaily cites the ClawHavoc attack, which seeded the OpenClaw marketplace with hundreds of malicious add-ons, as the reason this category exists.

Why agentic endpoint security matters for your business

Your staff already installed agents. Coding assistants, desktop chat apps, browser extensions, MCP servers pulled from GitHub. Each one can read files and call tools with that person's access. Most small shops can't list them.

The inventory is free. The enforcement isn't. A seat of enterprise XDR is a big-company budget. A spreadsheet of every agent, every MCP server, what it can reach, and who approved it costs an afternoon. Do that first.

Pin and review what agents load. Silent plugin updates are the supply-chain hole. Pin versions where the tool allows it, and re-check after updates.

Give agents their own credentials. An agent on the owner's laptop with the owner's bank login is the worst case. Scoped accounts make any runtime block, from any vendor, worth more.

Sources: Palo Alto Networks blog, Palo Alto Networks press release, ITdaily.