Run agents securely
Run an approved agent in an isolated microVM with governed authority.
Explore this feature →AIrspace / AI Agent Session Recording Analyzer
Under Development
Find the moments that matter in an agent session
AI Agent Session Recording Analyzer is being developed to turn an authorized recording into an evidence-linked investigation, with a timeline and jump-to clips for review.
What this means for your team
- Prepare a recording by identifying relevant frames, extracting screen text and building an event timeline before applying deeper analysis.
- Bring together administrator-configured rules, specialized vision models and language-model reasoning to identify patterns across a session.
- Map applicable findings to MITRE ATT&CK or ATLAS, and calculate risk using a defined formula rather than an unconstrained model-generated score.
- Present a risk heat map and jump-to clips, with findings linked to timestamps and supporting frames, screen text or events.
- Support evidence-based questions about the recording, including indicating when something was not observed.
- The proposed staged approach is intended to focus more expensive analysis on relevant activity; actual cost and coverage will depend on the recording, models and deployment.
From a recording to evidence
The planned analyzer first identifies meaningful frames, screen text and events, then examines relevant activity in context. Findings link back to evidence in the recording so a reviewer can investigate the source.
A practical example
A security reviewer investigates whether an agent followed suspicious instructions displayed on a web page, then jumps to the relevant moments and reviews the evidence.
How it works
Select a step to read its explanation
- Begin with a recording the reviewer is authorized to access. The proposed analyzer prepares it for investigation without asking one model to watch the entire session at once.
- Identify useful frames, extract visible text and collect an event timeline. These are the evidence the later analysis can reference.
- Combine configurable rules, vision analysis of selected frames or short clips, and reasoning over the timeline to investigate behavior that spans moments.
- Map applicable findings to MITRE ATT&CK or ATLAS and apply a defined scoring formula. A model does not invent the numerical risk score.
- Show a timeline and jump-to clips for review. Each supported finding points to evidence; questions should distinguish observations from things not seen in the recording.
1 / 5
This example illustrates the journey. Select any step to explore it at your own pace.
Explore more AIrspace features
Images & workers
Prepare approved agent images and connect the hosts that run them.
Explore this feature →Model, tool & peer gateways
Control which models, tools and peer agents a run may reach.
Explore this feature →Live sessions & recordings
Follow a live run and review its recording with the right access.
Explore this feature →Agent threat intelligence
Correlate evidence from independent observers to investigate agent behavior.
Explore this feature →