Viskor Demo · What can this agent reach?
Live demo

What can this agent reach?

Knowing an agent exists isn't enough. The question is what it could do if something went wrong. Watch Viskor map one claims agent — its model, its tools, its reach — and spot the combination that matters.

Built from the traffic Viskor already watches. No endpoint agent, no code changes.
The risky combination is outside input + private data + a way out — together, on one agent.
Where Viskor can't see, it says "can't see" — never "safe".
4 acts · ~90 sec

Synthetic data — Viskor never shows customer traffic in demos.

claims-intake-assistant agent · live traffic
Viskor what it can reach
One agent, mapped● live
Claims intake assistantowner: Priya Nair
Brain
anthropic · claude-sonnet (external)
Hands
read-claimant-recordlookup-policysend-email
Reach
claims-db.internaldocs.internal
Exposure chain3 legs
↓ Takes outside inputclaimant emails flow to an external model
▤ Reads private dataread-claimant-record · medical records
↑ Can send outsend-email · outside the boundary
All three at once. An instruction hidden in a claimant's email could make this agent read records and mail them out. That is the shape of the risk — whether or not it has happened.
Happened in a sessionHIGH
Read claimant records, then sent an email — 6 minutes apart, same session
Read
read-claimant-record
Sent
send-email → external
Normal
lookup → internal note

An ordinary lookup followed by a Slack post wouldn't match. This does: sensitive read, then outbound send.

A different agentNightly claims ETL
↓Takes outside input
▤Reads private dataclaims-ledger.internal
↑Can send outseen only by DNS + connection metadata
1 of 3 confirmed. Whether it can send data out is unknown, not absent — this sensor can't see tool calls.
Where it can't see, it says so

An unlit leg on an agent we only see through DNS isn't "safe" — it's "can't see". Add a sensor that reads tool calls (proxy, trace feed, gateway log) and the picture fills in.

no endpoint agent no code changes derived from live traffic
Act 1

The takeaway

Reach, mapped. Blind spots, named.

"An agent isn't risky because it exists. It's risky because of what it can reach."

One screen shows who runs the agent, what it can read, and what it can send out — and marks honestly the parts it couldn't observe.

Book a walkthrough Catch the drift → Block the shadow agent →