Prisma AIRS and Cursor Hooks: Test the Control at the Point of Action

Sources checked: 10 November 2026. FailSafe Research.

A control can recognize risky content and still allow the agent's action. Evaluation should establish which enforcement point observes the request, which policy applies and whether the side effect occurs. A useful report separates an alert, a blocked attempt and an action that completed.

What the vendors describe

Palo Alto Networks' November Prisma AIRS release notes describe dynamic skill analysis in a sandbox. The notes say dynamic rules initially alert without blocking, can return skipped or error states, and may take up to 45 minutes for a first scan. An initial verdict can reflect static rules while dynamic work is unfinished. A buyer should check both completion and enforcement mode.

HiddenLayer's November 5 Cursor integration post describes hooks around prompts and actions such as shell, file and MCP activity, with policy evaluation over session behavior. These are vendor descriptions rather than matched effectiveness results. The deployment's actual hook coverage and configured behavior remain assessment questions.

Validate a complete control decision

For a fictional repository assistant, approve a synthetic fixture and a harmless marker. Record the request entering the harness, the control's verdict and the actual filesystem or network effect. Capture whether policy was in alert or enforce mode. A missing side effect could come from a failed tool, not a security decision, so retain the reason and an allowed control.

FailSafe's AI security assessment workflow examines the agent with its tools and runtime boundaries. We test approved action sequences, identify reproduced boundary failures and retest corrections. For a coding-agent engagement, that can include poisoned repository content, composed tool authority and the controls the customer has configured. Specific products, access and integrations are agreed in scope.

Check what happens outside the obvious hook

Inventory the routes by which the agent can act: approved tools, background work and customer-enabled integrations. Identify where a session starts and ends and whether policy state follows a delegated action. The goal is to learn which paths the control actually covers. A vendor's list of supported hooks does not establish the customer's configuration of those hooks.

Use at least one allowed sequence so protection is not confused with a broken environment. Where a sequence is expected to stop, document which state or permission makes it disallowed. Keep synthetic content and approved destinations in the test fixture. Public examples do not need working payloads or private repository material.

Retest the deployed change

After a rule, hook or runtime update, repeat the relevant case and its allowed control on a recorded version. Preserve skipped, error and inconclusive outcomes instead of labeling them secure. See the monitoring-to-containment evaluation for timing evidence, and the portable skill assessment for configuration boundaries. The result should explain what the control prevented under the tested conditions and what remains outside visibility.