Security can no longer be limited to protecting the person behind the screen. It must also extend to the agent acting on their behalf, Ciprian Istrate on Tuesday. He is responsible for consumer operations at Bitdefender, and the Romanian company has unveiled a VPN designed for AI agents instead of humans.
See also: Bitdefender antivirus: Fake site distributes Venom RAT
It’s in public beta, costs nothing, and only works on macOS. Bitdefender announced it from Bucharest and San Antonio. A conventional VPN keeps a tunnel open for all data on the device. This VPN is only activated when an agent requests it. When that happens, it creates a temporary container for that command. The request goes out through a Bitdefender server.
The container is deleted when the command completes, and no cookies, cache, or session state are carried over to the next one. The rest of the device maintains its normal connection. Your browser continues exactly as before. The infrastructure is a Model Context Protocol. Google used the same protocol last week to open up the Home platform to external agents. It has become the standard way to connect anything to an assistant.
Four clients run at startup: Claude Desktop, Cursor, Codex , and OpenCode. Each is restarted once to receive configuration, and the user consents to telemetry on first run.
Bitdefender lists five claims that apply to every request the agent routes through its tools. It masks the agent’s IP, so that a website sees the exit server instead of a home address. It opens an encrypted tunnel per request, so that whoever manages the coffee shop’s Wi-Fi can’t read what the agent is sending. It isolates sessions, so that a website receiving two requests has no way at the network level to tell that they came from the same command. It provides a clean, non-home exit address. And it can route a single request through a selected country.
See also: Mullvad quietly revamped its Android VPN app — what you need to know
The company suggests three uses: checking whether a geolocalized page is rendered correctly for another market, running a search agent from a conference network, and preventing a website from associating dozens of daily requests with a household.
Bitdefender lists the limits on the product page rather than hiding them. It protects network transport and IP exposure but leaves the command content intact, so the model behind the agent gets everything it would normally get, including account identity. It’s not device-level and it’s not always active. It only covers traffic that the agent routes through Bitdefender tools, so anything an agent retrieves with the built-in browser comes out unprotected. If the tunnel fails, the request dies inside the container. Nothing is silently returned to the user’s real address.
That last detail matters more than it seems. Apple shipped a bug last month in which Private Relay leaked real IP addresses through WebKit, which is the exact flaw this design refuses to allow.
The announcement states that agents can bypass geoblocks and region-locked content without exposing the user's identity. However, the product page clearly states that the tool will not bypass a website's terms of service, rate limits, or an existing IP ban, and that using it to do so may cost a tester access to the beta.
See also: Japanese Digital Service: GSS leak after VPN attack
Websites are already reacting. Amazon blocked Meta’s Muse from its store on Sunday night and is suing Perplexity for buying agents. Payments has reached the same question from the other side. Visa, Mastercard and Ant International have created Know Your Agent schemes, with the principle that a merchant should know who they are doing business with.
