> For the complete documentation index, see [llms.txt](https://copilot-docs.bugbase.ai/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://copilot-docs.bugbase.ai/enterprise/attack-surface/agents.md).

# Agents

The Agents page shows execution workers connected to the deployment. An agent is not an AI agent. It is a deployed runtime that receives jobs, executes tools, and reports results.

<figure><img src="/files/Ni9433kOLZlKUfADWwzD" alt=""><figcaption></figcaption></figure>

## Agent Roles

| Role        | Used for                                                                                       | Notes                                                             |
| ----------- | ---------------------------------------------------------------------------------------------- | ----------------------------------------------------------------- |
| **SANDBOX** | External browser work: crawling, browser-session recording, authenticated replay, web testing. | Needs browser dependencies and target network access.             |
| **CLOUD**   | External/cloud-side tasks such as OSINT and non-browser jobs.                                  | Usually managed by the deployment.                                |
| **AGENT**   | Internal discovery and internal assessment from inside your network.                           | Must be deployed where it can route to approved internal subnets. |

## What to Check Before a Scan

* The required role is connected.
* The agent status is healthy.
* Public and private IPs match the expected environment.
* Internal agents show the expected subnets and interfaces.
* Job capacity is sufficient for the scan window.
* The agent host has network access to in-scope targets.

## Common Agent Issues

| Symptom                             | Check                                                                                                            |
| ----------------------------------- | ---------------------------------------------------------------------------------------------------------------- |
| External scan cannot start          | Confirm a SANDBOX runner is connected or managed capacity is available.                                          |
| Browser session recording fails     | Check SANDBOX status, browser access to target, WAF/bot blocking, and residential proxy setting.                 |
| Internal discovery shows no subnets | Check AGENT network interface data and route to your network.                                                    |
| PCE Intercept/Inveigh cannot start  | Confirm the selected AGENT exposes interfaces and at least one interface is selected.                            |
| Internal jobs fail immediately      | Check agent connectivity, endpoint protection allowlisting, outbound control-plane access, and local privileges. |

{% content-ref url="/pages/qJVQdMWQN3SOOKDv02QD" %}
[Download Agent](/enterprise/download-agent.md)
{% endcontent-ref %}