Palo Alto Networks launches Cortex XDR One to secure endpoints and AI agents

Why AI agents are a new endpoint risk

Palo Alto Networks argues that enterprises have spent the last two years authorizing AI agents to touch production code, internal databases, customer tickets and financial ledgers. Because these agents behave non-deterministically and have broad capabilities, the company says they can be manipulated into unexpected or malicious behavior. Software containers and prompt-level guardrails, it states, are not sufficient, and traditional endpoint security was not designed for agents that operate with real user access.

The company points to two examples. In the ClawHavoc supply chain attack, adversaries uploaded hundreds of malicious skills to OpenClaw's marketplace. Once installed, these skills broke runtime isolation and gave remote attackers direct command-line access on the host. In a separate incident, Unit 42 research showed how agents can be tricked into revealing secret system prompts or sensitive information through indirect data poisoning from connected applications.

The post also highlights shadow AI: personal agents and browser tools adopted by employees that bypass IT oversight and inherit elevated system privileges without visibility for security teams.

What Cortex XDR One does

XDR One integrates Cortex XDR and Cortex Agentic Endpoint Security with one interface and one sensor, offering centralized visibility, management and investigation. Palo Alto Networks says its security team found and deployed Koi while the startup was still in stealth mode, and later brought the Koi team into the company.

The product is built around several functions:

• Inventory: a real-time list of every AI artifact the moment it appears on an endpoint, so teams can control which packages, extensions, agents and AI artifacts may be installed or used.
• Agent layer: runtime guardrails intended to help stop prompt injections and destructive commands.
• OS layer: continuous monitoring of runtime process chains to block zero-day exploits and living-off-the-land attacks in real time, without affecting performance, according to the company.
• On-device models: optimized small language models run on the endpoint sensor to guard against evasive, fileless threats, even offline and without sending sensitive code to the cloud.

The company says that by stitching cross-domain telemetry into end-to-end attack chains, XDR One cuts false positives by up to 95% and drives automated remediation in minutes. It adds that consolidating telemetry on one sensor gives Cortex XSIAM the data needed to better govern AI risk.

Deployment options and managed service

Cortex Agentic Endpoint Security (AES) governs AI tools, MCP servers and agentic workflows on hosts. Organizations can run AES alongside existing third-party EDR environments using the Cortex targeted sensor. Those that want simpler operations can use AES and XDR together natively in XDR One.

Palo Alto Networks also says Unit 42 MDR will now include Managed Agentic Endpoint Security. By combining XDR One telemetry with threat intelligence, Unit 42 experts provide threat hunting, incident investigation and AI risk governance.

What it means for security teams

The company takes a firm position: in its words, "The era of standalone EDR has passed." It claims that EDR without integrated agentic security is incomplete, because disconnected tools lack visibility into OS execution and bolt-on offerings fail to correlate an agent's prompt and tool context with later system behavior.

For security leaders, the pitch is visibility and control over agents alongside conventional processes. The post gives a CISO example: evaluating which vibe coding agents engineering teams actually use and weighing the productivity impact of removing access to one. The source does not give pricing or availability details, and the performance figures cited are the company's own claims.