Kavach adds EDR monitor for AI workspaces

This feels like one of the more practical answers to agent safety on desktop: assume the model will eventually do something dumb, then make the blast radius smaller and the evidence richer.

• –Phantom Workspace, honeypot files, and rollback are strong primitives for catching destructive writes and secret-hunting behavior without pretending the agent is fully trustworthy
• –The real value is the combo of visibility and response: audit logs, clipboard inspection, child-process tracking, CPU throttling, and one-click restoration
• –Because it sits at the application layer, it can slow damage down but not fully prevent it, so it is better read as guardrails than as true containment
• –The v1.2 roadmap is telling: eBPF, Windows minifilters, and macOS ESF are what it will take to move from monitor to real enforcement
• –Best fit is teams experimenting with autonomous coding agents on local machines, not anyone who needs airtight security guarantees today