New Singularity capability combines AI agent discovery, governance and real-time behavioural protection to detect and stop malicious or unintended actions.
SentinelOne has launched Singularity Agentic Detection and Response (ADR), a new security offering designed to discover AI agents, govern their access and detect and stop malicious or unintended activity at runtime.
Announced at OneCon 2026, the company’s global customer conference, the offering is immediately available in early access. It extends SentinelOne’s AI security portfolio by combining agent visibility and policy enforcement with behavioural detection and response across endpoints, cloud workloads and enterprise environments.
As organisations increasingly deploy autonomous agents that hold credentials, access tools and execute multi-step workflows, security teams face risks from both malicious agents and authorised systems acting beyond their intended purpose.
Singularity ADR builds on SentinelOne’s earlier Prompt AI Agent Security capabilities, adding runtime monitoring and response. It provides an inventory of AI agents, tools, skills, connectors and Model Context Protocol (MCP) servers, alongside information about their permissions and associated users. The platform also extends coverage to environments including Salesforce Agentforce, Microsoft Copilot Studio, OpenAI ChatGPT workspace agents and Anthropic Claude managed agents.
“An equal if not more prominent risk comes from unintended behavior of sanctioned agents.” — Chris Corde, Chief Product Officer, SentinelOne
Key capabilities include monitoring agent activity through the Singularity Data Lake, correlating AI actions with endpoint events, enforcing execution policies and blocking threats such as prompt injection, credential exfiltration and tool poisoning before actions execute.
The platform can also identify discrepancies between an agent’s intended task and its actual behaviour, while allowing security teams to contain an individual agent without stopping an entire workflow.
SentinelOne CEO Tomer Weingarten said the launch extends runtime protection to agents performing enterprise work.
The move reflects a shift towards securing AI systems not only at deployment but throughout their operational lifecycle, as organisations seek to adopt autonomous workflows without sacrificing visibility, control or security.