How to Catch Rogue LLM Agents on a Local Machine?

Description and use

Topgent provides deterministic monitoring of AI agent behavior on local machines, enabling risk assessment and intervention.

Problem

Security professionals need to monitor and control AI agents running locally to prevent unauthorized file access, network connections, or process creation.

Outcome

Topgent provides a unified, deterministic view of AI agent behavior on local machines, enabling security teams to assess risk and intervene when necessary.

Workflow

• Identify installed AI agent executables
• Query OS for file and credential reachability
• Collect network socket information and country destinations
• Detect processes started by the agent
• Assign deterministic risk grade based on observed and reachable data
• Display summary and evidence in UI
• Optionally stop the agent via PID and start time check

Evidence

I could not find one tool that shows all of that in one place. So I decided to make my own, so meet Topgent.

Source

Topgent monitors real behaviour of the AI agents on your local machine.

Source

It runs locally and collects metadata only.

Source