Garnet is a runtime security platform designed for ephemeral workloads such as CI/CD environments, agent sandboxes, and short-lived containers. It employs an eBPF-based runtime agent to monitor kernel-level process ancestry, network flows, and file operations in real-time. This provides visibility and control over untrusted code from external dependencies and AI agents by mapping outbound network connections to their originating process. The system operates without requiring application code changes and is architected for low performance overhead.
The platform enforces network boundary controls by matching outbound connections against curated blocklists and automatically blocking malicious egress traffic. Garnet translates observed behavioral profiles into network policies and can enforce runtime assertions. For incident response, it records detailed telemetry enriched with pipeline metadata, which is presented through unified lineage views to help identify supply chain tampering, data exfiltration attempts, and prompt injection consequences.
