# Agent Security - Teleport Beams

Canonical page: https://www.beams.run/agent-security/

## Find risky agent behavior.

Beams records AI agent conversations and tool-call messages. Teleport classifiers flag risky behavior and link findings to the recorded evidence.

[Join the waitlist](https://www.beams.run/agent-security/). Launching November 9, 2026.

The product example shows a secrets-exposure finding linked to tool call #13: a deploy script printing an example AWS access key ID.

## Capture

The Teleport LLM Gateway records LLM requests, responses, and tool-call messages.

## Classify

Flag credential exposure, privilege changes, and risky actions when the session is summarized.

## Investigate

Open a finding and follow the recorded evidence to the exact tool call.

Classifiers review sessions after summarization. Findings identify activity to investigate; they do not block execution.

MCP tool-call review is planned.

[How to read a session](https://www.beams.run/agent-security/session-review/).

## Follow the evidence.

Trace a classifier finding to the tool call, command, and recorded activity.

The product capture links a secrets-exposure finding to the deploy.sh tool call, its command, and the classifier evidence.

[Explore this session](https://www.beams.run/agent-security/session-review/#evidence).

## Start with a security question.

- [Did the agent access or expose secrets?](https://www.beams.run/agent-security/credentials/)
- [Did the agent gain more access?](https://www.beams.run/agent-security/privileged-access/)
- [Did the agent delete or overwrite data?](https://www.beams.run/agent-security/destructive-actions/)
- [Where did the agent send data?](https://www.beams.run/agent-security/data-movement/)

## Packaging

Session summaries and risk scoring are included with Enterprise. [See pricing and packaging](https://www.beams.run/pricing/).

## Can I define my own classifiers?

Duplicate a built-in classifier and describe the behavior you want to review. Choose session kinds, resource filters, and match actions: flag for review, raise risk, or emit an audit event.

Contact us about classifier availability and deployment requirements.