What AgentWarden cannot do

Last updated 3 October 2026

It cannot stop everything.

A hijacked session is refused or diverted before a sensitive action runs. But a process already mid-flight, or an agent with no hook support, is detected rather than stopped. Your agent’s own sandbox is still the strongest protection, and AgentWarden shows you whether it is on.

Depth depends on the agent.

Claude Code and Codex are read in full detail, because their session logs are read directly and every step is judged against what you asked. About thirty other agents are recognised running: the commands they start, their skills and their settings are checked, but they are not yet read line by line.

It cannot see inside another sandbox.

Some tools run AI agents inside a sealed sandbox of their own, a container or a virtual machine. NVIDIA OpenShell is one. What an agent does in there never reaches your computer, so AgentWarden cannot watch it. It still lists the tool with your AI tools and tells you plainly that it cannot see inside. On Windows, a tool installed only inside WSL is not seen at all.

Patterns can be evaded.

Rules are patterns, and a new technique can slip past one. The decoys, and the “read hidden instructions, then acted” link, exist to catch what individual rules miss. The daily research loop turns newly published attacks into signed rule updates, usually the same day.

It is not enterprise endpoint security.

AgentWarden is strong personal-grade protection for the computer it runs on, with no kernel-level enforcement and no independent audit yet. We would rather you knew that now.