Exabeam doubles AI detection coverage and adds Anthropic Claude support

Behavior intelligence company Exabeam Inc. today expanded its security operations platform with new capabilities for detecting and investigating artificial intelligence agents, doubling its AI-focused detection coverage to 90 and adding monitoring support for Anthropic PBC’s Claude.

The update builds on a year of agent-security releases from the company and targets a growing blind spot for security teams. AI agents now access systems, invoke tools and act on behalf of users at machine speed, often using approved applications and valid credentials. That makes risky activity hard to spot because it can look legitimate until the behavior is analyzed over time.

The new detections flag anomalous interactions between people and AI agents along with unauthorized autonomous activity, including suspicious prompt behavior, unusual tool invocation sequences, abnormal consumption patterns and what Exabeam calls denial-of-wallet indicators. Shadow AI use and unauthorized configuration changes are also covered.

Claude support is the headline addition, but Exabeam already watches most of the field. ChatGPT from OpenAI Group PBC, Google LLC’s Gemini, Microsoft Corp.’s Copilot have been covered since April and the platform also supports GitHub Copilot

The Open Worldwide Application Security Project also figures into the release. Exabeam added coverage aligned to the OWASP Top 10 for Agentic AI back in April and that mapping now runs inside Outcomes Navigator, the tool security teams use to gauge where their detections hold up and where they fall short.

Exabeam extended its Nova AI capabilities too. A new Nova Rules Creator lets detection engineers build and tune correlation and analytics rules in natural language and convert existing Sigma rules. Then there’s Nova Related Cases, an early-access feature that ties together related cases and the entities they share, such as IP addresses or hosts, so analysts spend less time stitching the picture together by hand.

The company also released Observra. The open-source library is a telemetry layer for AI agents and it captures activity across major frameworks, normalizes it into events, enriches it with cost, redaction and risk signals and then routes the result to any security operations platform. Exabeam’s own platform draws on the library to sharpen agent observability.

Observra follows Praxen, the open-source agent verification tool Exabeam released on June 23. Praxen checks an agent before deployment, while Observra captures what it does once running.

“Organizations are rapidly moving from AI experimentation to autonomous AI agents operating across the enterprise,” said Chief Executive Pete Harteveld. “Security teams need visibility not only into human activity, but into how agents behave, interact and make decisions.”

The release also expands LogRhythm SIEM integrations across Microsoft, cloud, identity and email technologies, and adds security operations center enhancements, including phishing email ingest and new cloud data collectors.

Photo: Exabeam