Shadow AI
Agents appear with no owner and no review
Any employee can build a GPT or connect an AI app to a drive in minutes. There is no inventory, no owner and no record of which systems it reaches.
Secure · Security teams
See every agent.
Act on every finding.
Employees are pasting customer data into AI apps, creating GPTs nobody reviewed and connecting drives to assistants. Lustena puts one control plane in that path, so every session carries a name, meets a limit and lands where your team already looks.
Your security stack sits outside the agent loop
DLP, CASB, the proxy and the SIEM watch the perimeter. The agent loop runs inside the browser tab and inside your frameworks, where none of them can read it.
Data exposure
Sensitive data leaves in prompts
Customer identifiers, contracts and credentials go out in pastes and uploads that DLP never parses. Nothing in the path classifies them.
Audit trail
Nothing ties the person to the action
When a list leaves or a limit is crossed, nothing links the person, the agent and the action. Reconstruction is a memory and a screenshot.
Every app, GPT and connector, discovered as it is used
The browser extension observes AI use on managed browsers without content leaving the device. Each distinct agent appears in the inventory with the device and the employee behind it, ranked by data exposure, reach and use, so your team knows what to govern first. Devices still outside coverage are counted, so the gap is visible.
Production2026-10-14 · 02:41:07Z
Agents
Every agent this workspace knows about, declared by a person or observed in use, with its owner and connectors.
Inventory · 5 rows
| Agent | Owner · connectors | Status |
|---|---|---|
| GPT · Proposalsana@acme.com | ana@acme.comGmail, Drive | Declared |
| Claude · Finance projectjoao@acme.com | joao@acme.comSheets | Observed |
| Support bot (LangGraph)platform team | platform teamZendesk API | Declared |
| Copilot Studio · HR FAQunknown | unknownSharePoint | Observed |
| Claude Code · repo-assistengineering | engineeringMCP: GitHub | Declared |
Selected · GPT · Proposals
Owner
ana@acme.com · Marketing
Limits
v3 · tools, hosts, data
Last seen
2m ago · chatgpt.com
Every paste and upload, classified as it leaves
Twelve recognizers run on the device and produce content-free findings: category, severity, destination, fingerprint. Findings are attributed to the agent and the session and reach your team through alerts and webhooks.
01Where the agent acts · browser
Client follow-up
clients_q3.xlsxpasted · 3 rowsDraft the follow-up email for each client in this list
+ AttachGPT · Proposals
02Lustena, in the path
Agent session
liveSubject
ana@acme.com · Marketingb7f2a1d4
Verdicts
- Agent IdentityGPT · Proposals · owner ana@acme.comDeclared
- Agent Security1 paste · 3 × card number on deviceFlagged
- Agent Governancelimit v3 · data class: personalAlerted
03Systems reached
Gmail
connector
Drive
connector
HubSpot
connector
Red-team your own agents on demand
Point the scanner at an endpoint you are authorized to test and get a report with ten agent-native checks mapped to the OWASP LLM Top 10, attached to the agent in the inventory and re-run on a schedule.
01Where the agent acts · your stack
svc-support-bot · us-east-1 · 2 vCPU
# started by schedule · no user in session
agent@svc-support-bot:~$ lustena-scan run --target https://api.acme.com/agent --suite core
● Lustena · as svc:support-bot
⏺ prompt-injection ⎿ 14 probes · 0 raised
⏺ system-prompt-leak ⎿ 6 probes · 1 raised (medium)
⏺ endpoint-hygiene ⎿ TLS 1.3 · HSTS · CSP
✓ report attached to agent · 1 finding reopened
02Lustena, in the path
Scan run
liveSubject
svc:support-bot · core suitee5b0d8c2
Verdicts
- Agent Identityplatform team · SDK 0.8Verified
- Agent Securityscan core · 1 mediumReopened
- Agent Governancelimit v2 · 0 crossed · 24hAllowed
03Systems reached
Zendesk
called
Slack
webhook
Jira
ticket
Questions
Can Lustena feed my SIEM?
Yes, through webhooks. Each alert carries the agent, the person, the dimension crossed and one sentence of explanation, never content.
What does the extension send?
Findings with categories, counts, destinations, channels and HMAC fingerprints, heartbeats and session events. By default, prompt text, file contents and file names never leave the device; opt-in capture sends redacted text only.
How fast can we see results?
Most teams see their first agents within an hour of publishing the extension policy. The red-team scanner runs in minutes against one endpoint.