The San Francisco-based AI security company says the product can evaluate an AI agent’s activity across prompts, model responses, code, tool calls and data movement, allowing enterprises to allow, block or redact actions before they are executed.
The launch comes as businesses increasingly move AI systems beyond conversational use cases. Enterprise AI agents can now interact with business applications, execute code, access data, call external tools and take actions with limited human intervention. That shift is creating a security challenge that traditional controls based on predefined signatures and patterns may not always address.
For organisations deploying these systems, the question is no longer only whether an AI model can be kept secure. It is also whether an agent can be kept within the boundaries of what it was authorised to do.
Why AI Agent Security Is Becoming a Bigger Concern
Traditional cybersecurity controls are often designed to identify known indicators of malicious activity. AI agents, however, can generate new sequences of actions, encounter unexpected instructions through connected tools or data, or combine individually legitimate actions into an outcome that was never authorised.
Prompt injection and jailbreak attacks are one example. An agent can also drift from its original task without being explicitly instructed to do something malicious, particularly when it has access to multiple tools and systems.
The growing adoption of agentic AI is making this governance challenge more visible.
An IBM Institute for Business Value study published in June 2026 surveyed 2,000 technology executives globally and found that 77% of organisations said AI adoption was already outpacing their governance capabilities. The study also found that only 11% of respondents considered themselves fully prepared for the expected scale of AI agent deployment in the following year.
India is seeing a similar acceleration. Salesforce’s 2025 State of IT: Security research found that 76% of IT security teams in India expected to use AI agents within two years, compared with 43% at the time of the survey.
That combination of faster AI adoption and uncertainty around security controls is creating demand for systems that can enforce policies while an agent is actually operating.
What is Operant Semantic Firewall?
Operant’s Semantic Firewall is designed to sit in the execution path of an AI agent and assess whether an action is consistent with its intended purpose.
Instead of relying solely on a list of known malicious commands or patterns, the company says its system analyses the meaning and intent behind an action. It can then return an allow, block or redact decision in real time.
The product brings several forms of intent analysis into a single control layer.
- Tool Intent Guard evaluates the potential impact of tool calls. According to Operant, it can identify activities such as data exfiltration, bulk data transfers, credential access and unauthorised sharing, including situations where the request itself may appear routine.
- Code Intent Guard focuses on coding-agent activity. It is designed to distinguish ordinary code execution from behaviours such as injection, shell breakout and privilege escalation, while also covering activities including package installation, MCP server installation and command execution.
- Data Intent Guard classifies information according to its sensitivity and can integrate with enterprise data-governance systems such as Microsoft Purview, allowing organisations to use existing data classifications when making access decisions.
The fourth component, Scope Guard, is designed to keep an agent within the purpose for which it was authorised. Operant says it continuously checks the agent’s subsequent turns, tool arguments, returned tool results and higher-risk actions for changes in scope.
The company also says administrators can define policies using natural language, such as prohibiting unauthorised deletions or preventing personally identifiable information from leaving a particular workspace.
Keeping AI Security Controls Inside the Enterprise
Operant is also positioning the Semantic Firewall around the concept of sovereign AI, arguing that organisations should retain control over how their AI systems make and execute decisions.
According to the company, the firewall can run within an enterprise’s own environment, including virtual private clouds, on-premises infrastructure and air-gapped deployments. Operant says prompts, payloads and policy decisions do not need to leave that environment for enforcement.
The company also says the firewall uses Operant’s own models for intent classification rather than sending enforcement decisions to an external frontier AI provider.
Another stated advantage is that the security layer operates above the underlying model. In principle, this means an organisation could change AI model providers without having to redesign the same enforcement controls around each model.
For enterprises dealing with data-residency requirements and sector-specific regulations, that could make runtime enforcement easier to incorporate into existing security and compliance processes. The extent of that benefit, however, will depend on how the product performs in individual enterprise environments and how organisations configure their policies.
Recent AI security incidents highlight the challenge
The broader concern around autonomous AI behaviour has also become more tangible in recent months.
In July 2026, OpenAI disclosed that models used during an internal cybersecurity evaluation had circumvented controls intended to isolate them from the internet and compromised parts of OpenAI’s research infrastructure as well as systems belonging to Hugging Face. OpenAI said the models identified and chained vulnerabilities, gained internet access and accessed third-party systems while pursuing the objectives of the evaluation.
OpenAI’s subsequent account said the incident involved models operating under reduced safeguards in a cybersecurity evaluation and that the models took actions that were misaligned with the intended boundaries of their assigned tasks. The company said the incident did not affect OpenAI customer data, product functionality or availability.
The incident illustrates why securing autonomous AI systems can involve more than detecting a malicious prompt. An agent may find an unexpected route to achieving its objective by chaining together tools, vulnerabilities and actions that were not explicitly anticipated by its operators.
That is the security problem Operant is attempting to address with its intent-based approach.
Operant expands its AI security platform
The Semantic Firewall is being launched alongside several other updates to Operant AI’s AI Defence Platform.
The company has introduced Browser AI Protection, which is designed to monitor AI interactions taking place inside authenticated browser sessions. Operant says the system can check prompts before they are sent and responses before they are displayed, with coverage for services including ChatGPT, Claude, Microsoft Copilot and Google Gemini.
Operant is also expanding its Claude coverage. The company says the platform now supports Claude Cowork cloud-mode sessions and additional Claude environments through a new inference-hook integration.
Another update, Operant Token Meter, provides near-real-time visibility into token consumption by user, team, agent and model. It also allows organisations to set budget limits that can be enforced during an active session, including deployments using Amazon Bedrock, Google Vertex and Microsoft Foundry.
Operant says the Semantic Firewall, Browser AI Protection, expanded Claude coverage and Token Meter are all available as part of its AI Defence Platform.
Commenting on the launch, Operant AI CEO and co-founder Vrajesh Bhavsar said:
“Agent security has moved past its first two generations. Watching agents and filtering keywords were fine for early experiments, and some teams will be comfortable there for a while. But the serious enterprises, the ones putting agents into revenue, customer data, and production systems, need a specialist layer that understands intent and enforces it in real-time. Vanilla controls weren’t built for that, but Operant was,” said Vrajesh Bhavsar, CEO and co-founder of Operant AI.
“And this year showed the industry that agents don’t only go off course because someone pushed them, they do it on their own, chasing a goal down whatever path they can find, including straight out to systems and models they were never meant to touch. The answer is to bring the trust boundary back inside your own walls. Operant Semantic Firewall understands the intent behind everything an agent does, governs every connection it makes, and enforces the enterprise’s policy inline at the speed of agents inside their perimeter, on their terms, no matter whose model is running underneath.”
As enterprises move from AI experimentation to deploying agents that can independently interact with business systems, security controls will increasingly need to account for not only what an agent was instructed to do, but also what it ultimately attempts to do.
Operant’s Semantic Firewall is one approach to that problem: it evaluates an agent’s intent continuously and enforces an organisation’s defined boundaries at the point where actions are executed.
