Rein Security Raises $25M for AI Agent Runtime Protection — A Defender's Guide to Securing Agentic AI in Production

---
title: AI Agent Runtime Spawning Command Shell or Interpreter
id: 3f8a2c41-7b5e-4d29-9a61-8c3d5e7f9012
status: experimental
description: Detects LLM agent runtime processes (Python, Node.js) spawning command shells or scripting interpreters. Agentic AI frameworks orchestrate tools via APIs and libraries; interactive shell execution as a child of an agent runtime is a strong indicator of prompt injection, tool-chain abuse, or a compromised agent workflow.
references:
  - https://www.securityweek.com/rein-security-raises-25-million-to-guard-ai-agents-at-runtime/
  - https://attack.mitre.org/techniques/T1059/
  - https://owasp.org/www-project-top-10-for-large-language-model-applications/
author: Security Arsenal
date: 2026/04/06
tags:
  - attack.execution
  - attack.t1059
logsource:
  category: process_creation
  product: windows
detection:
  selection_parent:
    ParentImage|endswith:
      - '\python.exe'
      - '\python3.exe'
      - '\pythonw.exe'
      - '\node.exe'
  selection_child:
    Image|endswith:
      - '\cmd.exe'
      - '\powershell.exe'
      - '\pwsh.exe'
      - '\wscript.exe'
      - '\cscript.exe'
      - '\mshta.exe'
      - '\rundll32.exe'
      - '\certutil.exe'
      - '\curl.exe'
      - '\wget.exe'
  filter_agent_paths:
    ParentImage|contains:
      - '\Windows\System32\'
  condition: selection_parent and selection_child and not filter_agent_paths
falsepositives:
  - Legitimate agentic automation frameworks that intentionally invoke shells (e.g., coding agents like Cursor, Devin, or internal RPA) — baseline by parent path and approved agent directories
  - Node.js package installers spawning scripts during deployment windows
level: high
---
title: AI Agent Process Accessing Credential or Secret Files
id: 8d4e6b17-2c9a-4f53-b7d2-6e1a9c4f8023
status: experimental
description: Detects AI agent runtime processes (Python, Node.js) reading credential stores, .env files, cloud CLI credentials, or SSH private keys. Agents frequently hold their own scoped tokens but should not enumerate broad credential material; such reads are consistent with injection-driven secret theft or tool-scope abuse.
references:
  - https://www.securityweek.com/rein-security-raises-25-million-to-guard-ai-agents-at-runtime/
  - https://attack.mitre.org/techniques/T1552/
author: Security Arsenal
date: 2026/04/06
tags:
  - attack.credential_access
  - attack.t1552.001
  - attack.t1552.004
logsource:
  category: file_event
  product: windows
detection:
  selection_image:
    Image|endswith:
      - '\python.exe'
      - '\python3.exe'
      - '\pythonw.exe'
      - '\node.exe'
  selection_target:
    TargetFilename|contains:
      - '\.aws\credentials'
      - '\.azure\'
      - '\.config\gcloud\'
      - '\.ssh\id_'
      - '\.env'
      - 'credentials.json'
      - 'secrets.yaml'
      - 'secrets.yml'
      - '\vault-token'
  condition: selection_image and selection_target
falsepositives:
  - Agent frameworks legitimately loading their own application .env configuration — restrict alerting to reads outside the agent's application directory
  - Cloud SDK-based agent tooling reading its own service credentials
level: high
---
title: MCP Server or AI Agent Process Initiating Outbound Connection to Rare External Host
id: 5c2f9a84-1e7d-4b36-a8c4-9d2e6f103547
status: experimental
description: Detects MCP server processes and AI agent runtimes establishing outbound network connections to paste sites, tunneling services, or file-sharing infrastructure commonly abused for exfiltration. Indirect prompt injection frequently steers agents to transmit sensitive data to attacker-controlled endpoints under the cover of a trusted agent identity.
references:
  - https://www.securityweek.com/rein-security-raises-25-million-to-guard-ai-agents-at-runtime/
  - https://attack.mitre.org/techniques/T1041/
  - https://attack.mitre.org/techniques/T1102/
author: Security Arsenal
date: 2026/04/06
tags:
  - attack.exfiltration
  - attack.t1041
  - attack.t1102
logsource:
  category: network_connection
  product: windows
detection:
  selection_image:
    Image|endswith:
      - '\python.exe'
      - '\python3.exe'
      - '\node.exe'
  selection_destination:
    DestinationHostname|contains:
      - 'pastebin.com'
      - 'paste.ee'
      - 'rentry.co'
      - 'ngrok.io'
      - 'ngrok-free.app'
      - 'trycloudflare.com'
      - 'webhook.site'
      - 'requestbin'
      - 'pipedream.net'
      - 'transfer.sh'
      - 'file.io'
  condition: selection_image and selection_destination
falsepositives:
  - Developers testing webhooks or tunneling during agent development — scope to production agent hosts or alert at medium in dev environments
level: high

// Hunt: AI agent runtimes (Python/Node) spawning shells or LOLBins — potential prompt-injection or tool-chain abuse
// Scope the parent process list to your deployed agent runtimes; baseline approved automation agents first.
let AgentRuntimes = dynamic(["python.exe", "python3.exe", "pythonw.exe", "node.exe", "python", "python3", "node"]);
let SuspiciousChildren = dynamic(["cmd.exe", "powershell.exe", "pwsh.exe", "mshta.exe", "wscript.exe", "cscript.exe", "rundll32.exe", "certutil.exe", "curl.exe", "wget.exe", "bash", "sh", "curl", "wget", "nc", "ncat"]);
DeviceProcessEvents
| where TimeGenerated > ago(7d)
| where InitiatingProcessFileName in~ (AgentRuntimes)
| where FileName in~ (SuspiciousChildren)
| where InitiatingProcessFolderPath !startswith @"C:\Windows\System32"
| project TimeGenerated, DeviceName, AccountName,
          AgentRuntime = InitiatingProcessFileName,
          AgentCommandLine = InitiatingProcessCommandLine,
          SpawnedProcess = FileName,
          SpawnedCommandLine = ProcessCommandLine,
          AgentFolder = InitiatingProcessFolderPath
| order by TimeGenerated desc
;
// Hunt: Agent service identities making network connections to uncommon external destinations
// Useful for spotting injection-driven exfiltration riding a trusted agent process.
let AgentRuntimes2 = dynamic(["python.exe", "python3.exe", "node.exe", "python", "python3", "node"]);
DeviceNetworkEvents
| where TimeGenerated > ago(7d)
| where InitiatingProcessFileName in~ (AgentRuntimes2)
| where RemoteIPType == "Public"
| summarize ConnectionCount = count(),
            Devices = dcount(DeviceName),
            Processes = make_set(InitiatingProcessCommandLine, 5)
    by RemoteUrl, RemoteIP, RemotePort, InitiatingProcessFileName
| where ConnectionCount < 20   // rare destinations — tune threshold to environment
| order by ConnectionCount asc

-- Hunt: Enumerate running AI agent runtime processes, their command lines,
-- and their active network connections to identify rogue or hijacked agents.
-- Deploy as a Velociraptor hunt across hosts where agentic workloads run.

LET agent_procs = SELECT Pid, Ppid, Name, Exe, CommandLine, Username, CreateTime
FROM pslist()
WHERE Name =~ '(?i)python|node'
  AND (
       CommandLine =~ '(?i)langchain|langgraph|autogen|crewai|semantic_kernel|openai|anthropic|mcp|agent'
    OR Exe =~ '(?i)agents|ai-workloads|copilot'
  )

SELECT Pid, Ppid, Name, Username, CreateTime, CommandLine,
       netstat().LocalAddr AS LocalAddr,
       netstat().RemoteAddr AS RemoteAddr,
       netstat().RemotePort AS RemotePort,
       netstat().Status AS ConnState
FROM agent_procs

#Requires -RunAsAdministrator
# AI Agent Runtime Audit — Security Arsenal
# Inventories agent runtimes, flag suspicious child processes, exposed secrets in env, and egress.

Write-Host "=== AI Agent Runtime Audit ===" -ForegroundColor Cyan

# 1. Find running agent runtime processes (Python/Node) with agent-related command lines
Write-Host "`n[1] Running agent-related processes:" -ForegroundColor Yellow
$agentProcs = Get-CimInstance Win32_Process | Where-Object {
    ($_.Name -match '^(python|python3|pythonw|node)(\.exe)?$') -and
    ($_.CommandLine -match 'langchain|langgraph|autogen|crewai|semantic_kernel|openai|anthropic|mcp|agent|copilot')
} | Select-Object ProcessId, ParentProcessId, Name, CommandLine, CreationDate
$agentProcs | Format-List
if (-not $agentProcs) { Write-Host "  None found." -ForegroundColor Green }

# 2. Flag agent runtimes with suspicious child processes (shell/LOLBins)
Write-Host "`n[2] Agent runtimes with suspicious child processes:" -ForegroundColor Yellow
$badChildren = Get-CimInstance Win32_Process | Where-Object {
    $_.Name -match '^(cmd|powershell|pwsh|mshta|wscript|cscript|rundll32|certutil|curl|wget)(\.exe)?$'
} | Where-Object {
    $parent = Get-CimInstance Win32_Process -Filter "ProcessId=$($_.ParentProcessId)" -ErrorAction SilentlyContinue
    $parent -and $parent.Name -match '^(python|python3|pythonw|node)(\.exe)?$'
} | Select-Object ProcessId, ParentProcessId, Name, CommandLine
$badChildren | Format-List
if (-not $badChildren) { Write-Host "  None found." -ForegroundColor Green }

# 3. Check for plaintext API keys exposed in process environment (agent token hygiene)
Write-Host "`n[3] Environment variables containing likely AI API keys (system/user scope):" -ForegroundColor Yellow
$keyPatterns = 'OPENAI_API_KEY|ANTHROPIC_API_KEY|AZURE_OPENAI|GOOGLE_API_KEY|HUGGINGFACE|MCP_.*KEY|LANGCHAIN_API_KEY'
$sysEnv = [Environment]::GetEnvironmentVariables('Machine').GetEnumerator()
$usrEnv = [Environment]::GetEnvironmentVariables('User').GetEnumerator()
($sysEnv + $usrEnv) | Where-Object { $_.Name -match $keyPatterns } |
    ForEach-Object { Write-Host "  EXPOSED: $($_.Name) — rotate if host is untrusted; move to a secrets manager" -ForegroundColor Red }

# 4. List listening MCP/agent services and their owning processes
Write-Host "`n[4] Listening ports owned by agent runtimes (potential exposed agent endpoints):" -ForegroundColor Yellow
Get-NetTCPConnection -State Listen -ErrorAction SilentlyContinue | ForEach-Object {
    $p = Get-Process -Id $_.OwningProcess -ErrorAction SilentlyContinue
    if ($p -and $p.ProcessName -match '^(python|python3|pythonw|node)$') {
        [PSCustomObject]@{ Port = $_.LocalPort; Address = $_.LocalAddress; Process = $p.ProcessName; PID = $p.Id; Path = $p.Path }
    }
} | Format-Table -AutoSize

# 5. Outbound connections from agent runtimes to public IPs
Write-Host "`n[5] Active outbound connections from agent runtimes to public IPs:" -ForegroundColor Yellow
Get-NetTCPConnection -State Established -ErrorAction SilentlyContinue | Where-Object {
    $_.RemoteAddress -notmatch '^(10\.|172\.(1[6-9]|2[0-9]|3[01])\.|192\.168\.|127\.|::1|fe80)'
} | ForEach-Object {
    $p = Get-Process -Id $_.OwningProcess -ErrorAction SilentlyContinue
    if ($p -and $p.ProcessName -match '^(python|python3|pythonw|node)$') {
        [PSCustomObject]@{ RemoteIP = $_.RemoteAddress; RemotePort = $_.RemotePort; Process = $p.ProcessName; PID = $p.Id }
    }
} | Sort-Object RemoteIP -Unique | Format-Table -AutoSize

Write-Host "`n=== Audit complete. Investigate any hits in sections 2, 3, and 5. ===" -ForegroundColor Cyan