Bitdefender ships a per-prompt VPN for AI agents on Mac

Bitdefender opened a free macOS public beta of VPN for AI Agents, a tool that spins up a disposable private connection for each agent task so assistants can browse and research without tying every hop to the user’s own IP.

SECURITY desk — agents already borrow human credentials and shared IPs; a per-prompt tunnel is the first mass-market attempt to give the assistant its own network identity so geo research and browsing do not paint the human’s home address on every hop.

What the newsroom says the product is. It is a consumer offering. It gives each task its own private, temporary connection, so an agent can work past geo-blocks and region-locked content without exposing the user’s identity. An agent, here, is software that takes steps for a person — browse, research, transact — not only a chat reply. A geo-block is a site rule that shows or hides a page based on where the connection appears to come from. These lines are the company’s. This desk did not watch an agent cross a border, and it did not test a blocked page.

The worry the page cites, and whose numbers they are. The newsroom says 71 percent of adults in the United States believe increased use of artificial intelligence will make their personal information less secure, according to Pew Research Center, and that the concern is likely shared across the globe. The page prints “Seventy-one percent.” That is about seven in ten. The page does not name the Pew study, the year of the survey, or how many adults answered. Do not invent them. The same paragraph says the Cloud Security Alliance has found that AI agents often operate in an “identity gray area,” borrowing workload identities, shared service accounts, or a human user’s own credentials. A workload identity is a login for a job, not for a person. A shared service account is one login many programs use. Without separation, the page says, every task an agent completes, and every network it touches, stays tied to the user’s own IP address. An IP address is the number a network uses to tell one connection from another. It is not a home street address, but it can point at the network the person is on. These sentences are Bitdefender’s account of Pew and of the Cloud Security Alliance. This desk did not open either study.

How the tool is supposed to turn on. It is a standalone offering, initially for macOS. Once installed, the newsroom says it works automatically with Claude Desktop, Cursor, Codex, and OpenCode. Claude Desktop is Anthropic’s app. Cursor is the coding editor. Codex is OpenAI’s coding agent. OpenCode is the other coding agent named on the page. The page does not define OpenCode further. Do not add a vendor it left off. The tool is built on a Model Context Protocol server. Model Context Protocol, shortened to MCP, is a shared plug so an assistant can call a tool. The server stays dormant until an agent calls it to finish a task. Dormant means it is installed and waiting. It is not a tunnel that stays open all day. When the agent calls it, the page says it spins up a disposable, isolated container for that single prompt and discards the container when the task ends, so nothing carries over from one interaction to the next. A container, in the page’s parenthesis, is a private digital workspace. A prompt is the one request the person, or the agent, just made. File that life cycle as the newsroom’s. This desk did not open a container.

What it hides, and what it leaves alone. The newsroom says VPN for AI Agents protects network transport and IP exposure, not prompt content. Prompt content stays between the user and their AI provider. Network transport is the path the bits take. IP exposure is which address the far site sees. The words of the prompt, and the account the person already has with Claude, Cursor, Codex, or OpenCode, are not what this product says it conceals. File that split as the company’s.

How this differs from a VPN a person leaves on. A classic VPN, the newsroom says, is persistent. It keeps one continuous connection for everything on the device, whether or not that level of protection is wanted. VPN for AI Agents establishes a private connection for each prompt. The rest of the device stays on its regular connection. Persistent means always on. Per prompt means the tunnel exists for that one task and then goes away. These lines are the company’s. This desk did not compare the two on a Mac.

Three benefits, in the newsroom’s order. A dedicated connection, built for the agent, masks the agent’s IP address and keeps its traffic separate from the person’s. The page says that is useful for researching a health or legal question, comparing prices across regions, or working over public Wi-Fi. Automatic and frictionless: no manual setup. It activates only when needed and closes the connection the moment the task ends. A work enabler, not just a privacy patch: it lets agents complete multi-region research and transaction tasks in a single pass, work the page says would otherwise take a manual, country-by-country effort. Useful, and single pass, are the company’s. This desk did not time a price check.

The quote, as the company’s, not as a measured result. Ciprian Istrate, senior vice president of operations for the Consumer Solutions Group at Bitdefender, said AI agents are quickly becoming an extension of the people who use them, in work and in personal life. He said security can no longer stop at the person behind the screen. It has to extend to the agent acting on their behalf. He said the product gives students, workers, and everyday consumers the confidence to let their agents work freely, knowing their identity and activity stay protected. File the name, the title, and those sentences as the release’s. A quote is not a count of beta users, and it is not a test this desk ran.

Where the newsroom says a person can get it. VPN for AI Agents is available now for macOS, with additional operating-system support planned. The initial release is in English only. Access is free throughout the public beta. The page says visit the company’s website for more, or to get started. It does not print that address in the paragraph this desk read. The product page at ai.bitdefender.com/vpn-for-agents is the second company record. Do not treat a missing URL on the newsroom as a second product.

What the product page adds, and where the dates do not match. That page lists itself as last updated on 21 Sep 2026. It calls the status an external beta on macOS. It says each prompt gets a fresh container scoped to a specific location, destroyed when the prompt ends, so cookies, cache, and session state do not carry over. A cookie, here, is a small file a site uses to remember a browser. It says the product covers what Claude Desktop, Cursor, Codex, and OpenCode route through Bitdefender’s MCP tools. Requests the agent makes with its own built-in tools, outside that MCP server, are not routed through the VPN. It says the beta is free, with no traffic caps, and that it is a standalone sign-in with no dependency on another Bitdefender subscription. It says Windows is to follow. The newsroom’s phrase is additional operating-system support planned. This filing does not merge those into a ship date. The page says the floor is Apple silicon, M1 or later, and that Intel Macs are not supported. Apple silicon is the chip in recent Macs. Intel is the older Mac processor. The same page says the external beta starts on September 16 and runs for one month. It does not print a year on that September 16 line. The newsroom’s “today” is 22 Sep 2026. This desk did not pick one start date. File the September 16 sentence as the product page’s, and the 22 Sep announcement as the newsroom’s.

Limits the product page states, still the company’s, not a control this desk tested. It changes the network path. It is not a device-wide VPN. The browser and other apps stay on the regular connection, which matches the newsroom. It is not a way to hide prompts from the AI provider. The model still receives the prompts and the account identity as normal. It does not guarantee every request is protected. Only traffic the agent sends through Bitdefender’s MCP tools is covered. It is not an always-on tunnel. It is not a way to bypass a site’s terms of service, rate limits, or an existing IP ban. The page says using it to evade rate limits, bans, or scraping restrictions is against Bitdefender’s acceptable-use policy and can cost the account its beta access. If the tunnel fails, the request is dropped inside the container. There is no automatic fallback to the person’s own IP. The agent may retry another exit, abandon the request, or ask the person whether to continue without the VPN. If the prompt does not name a place, the page says the agent picks the closest or best exit by latency. If the person names a country, the agent honors it, as long as the target site is not geo-blocked. That last clause sits next to the newsroom’s line about working past geo-blocks. This filing does not collapse the two. A named country is not a bypass this desk confirmed.

Plain English for the rest of the card: VPN = a private path that shows a different network address than the one at the person’s desk. agent = software that browses, researches, or transacts, not only a chat reply. MCP = Model Context Protocol, the plug the agent uses to call this tool. container = a private workspace for one prompt, thrown away when the task ends. dormant = installed and waiting, not an all-day tunnel. IP address = the number the far site sees. It can point at a network. It is not a street address. prompt content = the words sent to Claude, Cursor, Codex, or OpenCode. Those stay with that provider. Apple silicon = the chip this beta requires. Intel Macs are not supported, on the product page. English only, and free during the public beta, are the newsroom’s. Seventy-one percent is Pew’s figure as Bitdefender’s newsroom prints it, with no sample size on that page. September 16 is the product page’s beta-start line, with no year printed. 22 Sep 2026 is the newsroom announcement. This filing is those two company pages.

PRIMARY here: Bitdefender’s 22 Sep 2026 newsroom page, “Bitdefender Unveils VPN for AI Agents, Giving Autonomous Assistants Their Own Path to Privacy,” datelined Bucharest and San Antonio — Tier A PRIMARY, the company’s own record. The page did not print an hour. The public-beta announcement, the per-task private connection, the geo-block and region-locked sentence, the Pew 71 percent line with no study name, the Cloud Security Alliance identity-gray-area sentence, the macOS standalone line, Claude Desktop, Cursor, Codex, and OpenCode, the dormant MCP server, the disposable container, the network-transport split, the classic-VPN contrast, the three benefit lines, the Istrate title and quote, English only, free during the public beta, and additional operating-system support planned are the newsroom’s. The product page at ai.bitdefender.com/vpn-for-agents, last updated 21 Sep 2026, is the company’s own product record for the Apple silicon limit, Intel Macs not supported, no traffic caps, the built-in-tools exclusion, the no-fallback rule, the terms-of-service limit, and the September 16 line with no year. NOT claimed: that this desk installed the beta, ranked a “leader” or a first, opened the Pew study or the Cloud Security Alliance finding, timed a price check, confirmed a geo-block bypass, picked a year for September 16, found a price after the beta, a customer count, a stock tip, or investment advice. Distinct from the already-filed microsoft-eviltokens, salt-security-aidr, and outerlimit-16m.