Sweet Security debuts Agentic AI Blocking to stop rogue agents in real time

UPDATED 09:00 EDT / JULY 29 2026 SECURITY Sweet Security debuts Agentic AI Blocking to stop rogue agents in real time by Duncan Riley Israeli runtime security startup Sweet Security Ltd. today unveiled Agentic AI Blocking, a capability that stops artificial intelligence agents mid-action in production when they do something they were not built to do. Released ahead of Black Hat USA 2026 in Las Vegas, the feature extends the enforcement Sweet already runs against cloud workloads to the agents now operating alongside them. The company said it terminates unauthorized tool calls and agent sessions as they execute, prevents secrets and personally identifiable information from leaving an environment through an agent and shuts down prompt injection attempts before they redirect an agent’s behavior. The pitch rests on a timing argument. Agents deployed inside enterprises hold their own identities and reach into sensitive systems, often with no human reviewing the individual actions they take. Detection tools flag that activity after the fact, meaning the alert describes something the agent has already finished doing. “AI has collapsed the cost of attack, and it has put autonomous software inside the enterprise. Someone has to decide, in the moment, what an agent is allowed to do,” said Dror Kashti, chief executive and co-founder of Sweet Security. “When an agent reaches for data it shouldn’t touch, Sweet stops the action red-handed and provides the team one line: here is what we found, and here is how we stopped it. Nothing bad happened, and nothing is waiting in a queue. That is what lets an enterprise adopt AI with confidence.” Blocking decisions draw on what Sweet calls its runtime reasoning layer, which the company said analyzes more than one billion runtime events a day to establish what each application and agent is intended to do. Anything outside that baseline is treated as unauthorized. Sweet describes the surrounding process as its Learning Loop, a cycle of attacking, fixing and defending that it said allows enforcement to be applied to live workloads without breaking them. That last point is the hard part of runtime blocking. Enforcement that misreads legitimate behavior takes down production, and Sweet’s argument is that the risk is why most of the industry has settled for alerting instead. One early customer is Israeli mobile advertising company Zoomd Technologies Ltd. Chief technology officer and co-founder Niv Sharoni said in Sweet’s announcement that the platform gave the company “the confidence to adopt AI across the business,” and drew a contrast between finding out about bad agent behavior in a report and having it blocked at the moment it happens. Sweet plans to demonstrate the capability at booth 5721 during Black Hat, which runs Aug. 1 to Aug. 6. The company was founded by Kashti, a retired brigadier general and former chief information security officer of the Israel Defense Forces, along with Eyal Fisher, previously head of the cyber department at Unit 8200, and Orel Ben-Ishay, who ran the cybersecurity research and development center at Unit 81. It sells a runtime platform covering cloud workloads, identities and application programming interfaces and moved into AI security last year with tooling for discovering models and agents and tracking what they connect to. Sweet has raised $120 million to date, including a $75 million Series B round led by Evolution Equity Partners in November. Image: SiliconANGLE/Ideogram A message from John Furrier, co-founder of SiliconANGLE: Support our mission to keep content open and free by engaging with theCUBE community. Join theCUBE’s Alumni Trust Network, where technology lea