> For the complete documentation index, see [llms.txt](https://copilot-docs.bugbase.ai/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://copilot-docs.bugbase.ai/enterprise/attack-surface/agents.md).

# Agents

The Agents page shows execution workers connected to the deployment. An agent is not an AI agent. It is a deployed runtime that receives jobs, executes tools, and reports results.

## Agent Roles

| Role        | Used for                                                                                       | Notes                                                                    |
| ----------- | ---------------------------------------------------------------------------------------------- | ------------------------------------------------------------------------ |
| **SANDBOX** | External browser work: crawling, browser-session recording, authenticated replay, web testing. | Needs browser dependencies and target network access.                    |
| **CLOUD**   | External/cloud-side tasks such as OSINT and non-browser jobs.                                  | Usually managed by the deployment.                                       |
| **AGENT**   | Internal network assessment and cloud assessment from a customer-controlled host.              | Needs a route to approved subnets or an approved cloud machine identity. |

## What to Check Before a Scan

* The required role is connected.
* The agent status is healthy.
* Public and private IPs match the expected environment.
* Internal agents show the expected subnets and interfaces.
* Job capacity is sufficient for the scan window.
* The agent host has network access to in-scope targets.
* Cloud-hosted agents run on the intended provider virtual machine with the approved attached identity.

## Common Agent Issues

| Symptom                               | Check                                                                                                            |
| ------------------------------------- | ---------------------------------------------------------------------------------------------------------------- |
| External scan cannot start            | Confirm a SANDBOX runner is connected or managed capacity is available.                                          |
| Browser session recording fails       | Check SANDBOX status, browser access to target, WAF/bot blocking, and residential proxy setting.                 |
| Internal discovery shows no subnets   | Check AGENT network interface data and route to your network.                                                    |
| Cloud discovery creates no CloudScope | Check that the AGENT runs on EC2, an Azure VM, or a Compute Engine VM with the approved machine identity.        |
| PCE Intercept/Inveigh cannot start    | Confirm the selected AGENT exposes interfaces and at least one interface is selected.                            |
| Internal jobs fail immediately        | Check agent connectivity, endpoint protection allowlisting, outbound control-plane access, and local privileges. |

{% content-ref url="/pages/qJVQdMWQN3SOOKDv02QD" %}
[Download Agent](/enterprise/download-agent.md)
{% endcontent-ref %}