Citrix has announced planned controls for organizations deploying autonomous AI agents, including isolated execution environments, agent-specific access policies and detection of automated browser activity. The additions span Citrix SecurSpaces and SecurAccess, alongside a credit-based licensing model for the company’s broader platform. Citrix’s announcement, reported by Help Net Security describes the capabilities as forthcoming or expanding rather than documenting a completed production deployment.

The proposed security model separates an agent’s authority from the permissions of the employee who starts it. Citrix says SecurSpaces will run agents in isolated environments with access limited to task-required resources, while keeping sensitive application credentials outside the execution environment. Its SecurAccess ZTNA controls are intended to restrict an agent through Model Context Protocol to specified tools and actions—for example, allowing an agent to review disputed-payment records without allowing it to approve or modify payments. SecurAccess with Chrome Enterprise is also expected to identify when browser activity is automated and let administrators monitor, notify, record or block it. The announcement says Session Insights will highlight potentially risky moments, but does not report detection rates, false positives or results from a customer evaluation.

That distinction matters because a separate Help Net Security report describes access and lifecycle problems found in thousands of agents in customer production environments during a 12-week analysis by Arrakis Security. The report says 76% of enabled agents had not run in 60 days, 22.9% had at least one unsecured trigger, and 19% used non-expiring API keys or tokens embedded in configurations. It also reports that 99.4% of agents connected to sensitive integrations lacked verified data-loss-prevention coverage on those connections. Those figures are reported findings from Arrakis’s analysis, not an independent test by this publication.

For buyers, Citrix’s controls map directly to those stated exposure types: isolation and credential protection address execution scope, while policy enforcement and activity recording address what an agent can do and how investigators can reconstruct it. However, the fetched announcement does not specify general availability dates for the new SecurAccess features, pricing for the credit model, or evidence that the proposed controls reduce the reported exposures. Citrix also says it plans to release its Knowledge Worker Agent for SecurSpaces under Apache 2.0, which is a planned release rather than evidence of operational readiness.