Agent Egress Monitoring

What is it

Agent Egress Monitoring is network-level observability for AI coding agents. When a developer runs Claude Code, Cursor, Windsurf, or Cline, the agent reads files, shells out commands, and calls LLM APIs. The risk: a misconfigured agent, a malicious prompt injection, or a sloppy "read the whole repo" instruction can ship your entire private codebase to a third-party endpoint. Agent egress monitoring sits on the outbound path — a local proxy, eBPF hook, or SDK shim — and inspects what data is leaving the machine or CI runner. It flags whole-repo uploads, secrets in payloads, and unexpected destinations.

The business significance is straightforward: enterprises are adopting AI coding tools faster than their security teams can review them. Casbin Gateway — an open-source authorization project — added agent egress monitoring specifically to detect whole-repo uploads. That a policy engine team shipped this tells you the anxiety is real and the tooling gap is wide. This is the "DLP for the agent era" category, and it is barely 12 months old.

Why now

Three forces converged in late 2025 and early 2026. First, agentic coding went mainstream: Cursor crossed $500M ARR, Claude Code became a default tool at thousands of companies, and Cline/OpenHands brought autonomous multi-step agents to the masses. Second, the attack surface became visible. Prompt injection attacks against coding agents — where a malicious README or dependency instructs the agent to exfiltrate .env files — moved from theory to published exploits. Third, compliance caught up: SOC 2 auditors and EU AI Act enforcement began asking "where does your source code go when an agent runs?"

The timing matters because the tooling is still greenfield. Traditional DLP (Netskope, Zscaler) monitors human traffic, not agent API calls. Traditional SAST/SCA scans code, not egress. Nobody has a mature "agent egress firewall" yet. The 200% growth rate in mentions reflects a category forming in real time — the same inflection point CASB hit in 2015 or CSPM hit in 2019. If you build now, you define the category. Wait 18 months and you're competing with Wiz.

Market Evidence

The signal is thin but directionally strong: 2 independent sources (oschina, devcommunity), 4 total mentions, 200% growth, stage classified as "nascent," trend score 62/100. Let's be honest about what this means. Four mentions is not a market — it's an early whisper. But the whisper is coming from a credible source: Casbin, a project with 17k+ GitHub stars, chose to build egress monitoring into its gateway. That's a product decision by a team that watches authorization and access patterns for a living.

Compare this to how other infra categories started. Early CSPM mentions in 2017 were similarly sparse before exploding. The 200% growth rate is the number that matters — it means month-over-month doubling of discussion, which at low absolute numbers is exactly what a forming category looks like. The risk is that this is a feature, not a category — that Cursor and Anthropic ship native egress controls and the standalone market evaporates. My read: they'll ship basic controls, but enterprise-grade policy, audit trails, and cross-tool coverage will remain a third-party opportunity, the same way cloud providers ship basic security but Wiz and Orca still thrive.

Who's Behind It

The visible driver is the Casbin community — a CNCF-adjacent open-source authorization project with strong enterprise adoption in China and growing Western usage. Casbin's move signals that authorization-layer vendors see agent egress as adjacent to their core policy engine. Beyond Casbin, the implicit whales are the agent platforms themselves: Anthropic (Claude Code), Cursor, Cognition (Devin), and the open-source agent frameworks (OpenHands, Aider, Cline). These companies have every incentive to not solve this well, because tight egress controls slow agents down and generate support tickets.

On the buyer side, the whales are CISOs at mid-to-large enterprises who already bought Cursor/Claude Code licenses and now need to justify them to auditors. The competitive dynamic is a classic platform-vs-tool tension: platforms want to own the trust layer, but security teams want vendor-neutral enforcement across all agents. That neutrality gap is where an indie product wins.

TAM & Market Size

The addressable buyer is a security or platform engineer at a company with 50–5,000 developers that has adopted AI coding tools. Let's size it: roughly 40,000 companies globally have 50+ developers and active AI coding tool adoption as of 2026. Of those, maybe 15% have acute compliance pressure (SOC 2, ISO 27001, FedRAMP, financial services) — call it 6,000 companies with real budget urgency.

Price tolerance: security tooling for a 200-dev org typically runs $15k–$60k/year. Agent egress monitoring as a point solution can credibly anchor at $8k–$25k/year for mid-market, $2k–$6k/year for startups. That's a $50M–$150M SAM today, growing 40%+ annually as agent adoption spreads. The demand score of 0/100 reflects that this is pre-demand — buyers don't yet have a line item for "agent egress." You'll be creating the budget category, which is harder but also means no incumbent owns the wallet. The opportunity score of 0/100 is a data artifact of low mention volume, not a verdict; treat it as "unproven," not "dead."

Competitive Landscape

Direct competitors are essentially nonexistent as standalone products. Adjacent players: (1) Traditional DLP — Netskope, Zscaler, Palo Alto — they monitor human egress but have no agent-aware policy engine and won't ship one fast. (2) AI gateways — Portkey, Helicone, LiteLLM — they sit in the LLM API path and could add egress inspection, but their customers use them for cost/observability, not security. (3) Agent platforms — Cursor, Anthropic — will ship basic "don't send secrets" guards, but they're single-vendor and shallow. (4) Casbin Gateway — open-source, authorization-focused, early.

The gap: a vendor-neutral, agent-aware egress monitor that works across Claude Code, Cursor, Cline, and CI runners, with policy-as-code and audit logs. Big Tech entry risk is real but slow — Microsoft (Defender for AI) and Palo Alto (Prisma AI) are 12–24 months from a credible agent-egress product. That's your window. Differentiate on cross-tool coverage and developer experience (no agent slowdown, sub-50ms inspection).

Business Model

Recommendation: usage-based SaaS with a generous open-source core. Ship an open-source local proxy (MIT license) that developers can run free — this drives bottom-up adoption and matches the Casbin/OSPO buying pattern. Monetize the cloud control plane: centralized policy, audit logs, SIEM integration, team management, and compliance reports.

Pricing:

• Free: 1 developer, local-only, no cloud sync.
• Team: $12/dev/month (min 5 seats) — cloud policy, 30-day log retention.
• Business: $28/dev/month — SSO, 1-year retention, SIEM export, custom policies.
• Enterprise: $15k–$40k/year flat — on-prem, SOC 2 report, support SLA.

Why usage-based per-dev: it aligns with how security budgets scale and undercuts per-endpoint DLP pricing by 60%+.

12-month forecast: Conservative $8k MRR (60 paying orgs, mostly Team tier). Base $35k MRR (200 orgs, mix of Team/Business, 2 enterprise deals). Optimistic $90k MRR (500 orgs, 8 enterprise). CAC estimate: $400–$900 via content + open-source funnel (much lower than typical security CAC of $5k+ because the OSS core does the selling). Payback: 3–6 months on Team tier, immediate on Enterprise.

MVP Blueprint

Build a working egress monitor in 5–7 days. Cut everything that isn't "detect and alert."

Core features (only these):

1. Local HTTP/HTTPS proxy (mitmproxy-based) that intercepts agent traffic to LLM APIs.
2. Payload inspection: flag requests containing >N files, known secret patterns (regex for AWS keys, .env content, private keys), or repo-wide context blobs.
3. Destination allowlist/denylist.
4. Local dashboard (simple web UI) showing flagged egress events with payload snippets.
5. One-click "block" mode.

Tech stack: Go for the proxy (fast, single binary, cross-platform), SQLite for local event storage, React + Vite for the dashboard, mitmproxy patterns for TLS interception with a locally-generated CA. Ship as a brew install / npm i -g binary.

Fastest path to launch: publish the OSS proxy on GitHub, post to Hacker News and r/netsec with a demo video showing a prompt-injection attack being caught in real time. That single demo is your entire go-to-market for week one. Skip cloud sync, skip SIEM, skip SSO — those are Team-tier features for v2. The MVP's job is to prove detection works and generate the waitlist for the paid control plane.

Commercial Opportunities

1. Agent Egress Firewall (SaaS). Central policy + audit for teams running multiple agents. Target: security engineers at 100–1,000-dev companies. Expected: $8k–$30k MRR within 12 months. Why it beats alternatives: vendor-neutral and agent-aware, unlike DLP (human-only) or platform-native guards (single-vendor).

2. Compliance Evidence API. Sell an API that generates "agent egress audit reports" for SOC 2 / ISO auditors — timestamped logs proving no unauthorized code left the perimeter. Target: compliance officers. Expected: $3k–$12k MRR. Why: auditors will demand this within 18 months; being first means you define the evidence format.

3. CI/CD Agent Guardrail. A GitHub Action / GitLab CI plugin that sandboxes agent egress in build pipelines. Target: platform teams running autonomous agents in CI. Expected: $2k–$10k MRR. Why: CI is where whole-repo uploads are most catastrophic and least monitored.

Product Ideas

🥇 EgressGuard — "See and stop what your AI agents send out." A cross-platform local proxy + cloud dashboard that monitors egress from Claude Code, Cursor, Cline, and CI runners, with policy-as-code and audit logs. Target user: security/platform engineer at a 100+ dev company. Why now: agents are deployed, auditors are asking, and no vendor-neutral tool exists.

🥈 AgentDLP API — "Egress inspection as an API call." A hosted API that any agent framework can call before sending a payload, returning allow/block/redact decisions. Target user: agent framework builders and platform teams. Why now: frameworks need a drop-in trust layer, and building it in-house is a distraction from their core product.

🥉 RepoLeak Scanner — "Find out what your agents already leaked." A one-time scan that analyzes LLM API logs and network traces to surface past egress incidents. Target user: CISO doing incident review. Why now: as a lead-gen wedge — the scan reveals a problem, the subscription fixes it. Cheapest possible entry point.

SEO Opportunity

Search volume for "agent egress," "AI agent data leak," and "prevent codebase upload AI" is low today (SEO difficulty 0/100) but growing at the same 200% clip as mentions. Long-tail keywords to own now: "stop Cursor sending whole repo," "Claude Code data leak prevention," "AI coding agent egress monitoring," "prompt injection code exfiltration," "agent DLP open source." Competition is near-zero — a handful of blog posts. Content strategy: publish one deep technical post per week showing real attack demos and mitigation, optimized for these terms. You'll rank in weeks, not months, and own the category vocabulary before anyone else shows up.

Risk Assessment

Thesis is wrong if: (1) agent platforms ship robust native egress controls within 12 months, making third-party tools redundant; (2) enterprises decide agent egress is a feature of existing DLP and refuse to buy a point solution; (3) the whole "agent leaks code" narrative turns out to be overblown and buyers don't feel pain.

Top 3 risks: Tech — TLS interception breaks agents or slows them, killing adoption. Market — buyer education cost is high; you're creating a budget line, which takes 12–18 months. Execution — a well-funded security vendor (Wiz, Snyk) launches a competing product with 100x distribution.

Cheap validation: before writing code, publish the attack demo and collect emails. If 200+ security engineers sign up for a waitlist in 30 days, build. If fewer than 50, walk away.

Walk away when: a major platform ships native cross-tool egress control, or 6 months of content marketing yields under 100 qualified leads.

Action Plan

Today: Write a 1,500-word technical post titled "How prompt injection exfiltrates your entire codebase through Cursor and Claude Code," with a real demo. Post to Hacker News, r/netsec, and the Casbin community. Add a waitlist CTA.

Week 1: Ship the OSS local proxy MVP (5–7 days per the blueprint). Publish the repo. Run the demo live on a Twitter/X thread. Target: 100 GitHub stars, 50 waitlist emails.

Month 1: Ship the cloud control plane beta (policy sync + audit log). Onboard 10 design partners free. Goal: 3 paying Team-tier customers, $500 MRR. Publish weekly content targeting the long-tail keywords.

Month 3: Launch publicly on Product Hunt. Add SIEM export and SSO. Goal: 50 paying orgs, $10k MRR, 2 enterprise pilots. Hire one part-time content marketer if MRR exceeds $8k. Decision point: if MRR is under $3k at month 3, reassess whether the category is real or pivot the proxy into a broader agent observability tool.

Related Terms

AI Agent Observability — the broader category (tracing, cost, latency) that egress monitoring plugs into; buyers often want both, so integration is a wedge. Prompt Injection Defense — the attack vector that makes egress monitoring urgent; complementary, not competitive. AI Gateway / LLM Proxy — the infrastructure layer (Portkey, LiteLLM) where egress inspection naturally lives; partnering beats competing. Together these three form the emerging "agent security stack," and egress monitoring is the missing enforcement layer.