AI agents have moved past answering questions. They write code, call tools, and run workflows that touch company data and systems. Palo Alto Networks said on October 15 that its latest Prisma AIRS updates give enterprises more control over how those agents access data, use tools, and consume resources.
The announcement covers three areas. Prisma AIRS now integrates with Claude Enterprise through inference hooks so runtime checks run on Claude Code, Claude.ai, and Claude Cowork before the model processes a request. Scanning expands beyond models to agent skills, plugins, Model Context Protocol servers, and open-source dependencies. The Prisma AIRS AI Gateway gains MCP Guardrails that inspect tool traffic in both directions and Signals plus Smart Routing that pick a model based on the request’s intent and complexity.
Claude checks apply existing data rules before the model runs
Anthropic opened inference hooks for Claude Enterprise in early August. The mechanism lets a compliance system inspect a prompt and tool-call response before Claude processes them across chat, Claude Code, and Claude Cowork. Palo Alto Networks ties its Prisma AIRS API into those hooks. An administrator points Claude at a Prisma AIRS webhook and supplies a key. Claude then sends the payload to Prisma AIRS, which returns an allow or deny verdict before inference starts.
Palo Alto Networks says the integration extends existing enterprise data-loss-prevention policies to keep personal information, intellectual property, and source code from leaving the environment. It also blocks prompt injection and jailbreak attempts. The company positions this as a way to accelerate Claude adoption without creating a second set of rules.
Scanning covers the pieces agents are built from
Agents rely on models, skills, plugins, MCP servers, and open-source packages. Palo Alto Networks says its AI Supply Chain Security has pre-scanned more than three million third-party artifacts. The product scans open-source models, validates agent skills, and blocks malicious code before deployment. The goal is visibility from development through runtime so security teams can see risks after the agent is in use.
The gateway watches tool calls and model choice
The Prisma AIRS AI Gateway, which reached general availability in July after Palo Alto Networks acquired Portkey, sits between agents, models, and tools. The new MCP Guardrails inspect traffic in both directions, block concealed instructions in tool inputs, redact sensitive data from outputs, and enforce access policies. Signals assess a request’s intent and complexity so Smart Routing can select a model that matches cost, quality, or speed targets. Administrators see live metrics on savings, latency, and cache efficiency.
Other vendors already place similar checks
CrowdStrike announced Falcon Guardian on September 1 at Fal.Con. The product uses the existing Falcon sensor to inventory known and shadow AI agents on Windows and macOS laptops, record who deployed each one, and block unapproved agents. It ties agent activity back to endpoint telemetry so security teams can see the path from a prompt to a file write or system change. CrowdStrike’s control point is the device.
AI gateways that route model calls, track spend, and apply input and output checks are now common. Kong AI Gateway, LiteLLM, TrueFoundry, Cloudflare AI Gateway, and Microsoft’s Azure API Management AI Gateway all sit in front of model and tool traffic. Several of them inspect MCP calls, enforce tool allow-lists, and support cost controls. Specialized platforms such as Noma Security and Pillar Security focus on discovering agents and MCP servers, testing them, and enforcing policy at whatever gateway a company already runs.
Palo Alto Networks’ updates line up with that set. The company places its checks on the network and gateway path and inside the Claude Enterprise inference hooks. CrowdStrike places its checks on the endpoint sensor that is already installed. Azure and Kong place theirs on gateways that many enterprises already operate for other API traffic. The choice for a security team is less about whether a check exists and more about which path matches the tools already in place and which vendor’s broader platform the company already runs.
Questions for the security team
Which path does the agent traffic already take, the laptop, an existing API gateway, or a dedicated AI gateway?
Does the current data-loss-prevention policy cover the Claude surfaces the company plans to use, or does it need a separate rule set?
Which vendor already has the inventory of endpoints, the API gateway, or the network path that can see these calls today?
Palo Alto Networks has added concrete controls for Claude Enterprise and for the tools agents call. Those controls join a market that already includes endpoint inventory and blocking, general-purpose AI gateways, and specialized agent platforms. Security teams evaluating the October 15 updates can start by mapping where their agent traffic runs today and which existing product already sits on that path.
Sources: Palo Alto Networks, “Agentic Innovation Meets Enterprise Control,” October 15, 2026; Anthropic, “Inference hooks: inline data loss prevention for Claude Enterprise,” August 5, 2026; CrowdStrike, Falcon Guardian announcement, September 1, 2026; Palo Alto Networks, Prisma AIRS AI Gateway general availability announcement, July 2026.
