Apollo Research Watcher

Watcher is a runtime monitoring and control system from AI-safety lab Apollo Research that records coding-agent sessions, grades each proposed action with LLM monitors, and blocks or escalates risky ones before they execute. It is for security and platform teams that want developers to run Claude Code or Codex with fewer permission prompts but central guardrails.

Watcher is Apollo Research's commercial product for overseeing AI coding agents, launched February 17, 2026 alongside an integration with Tailscale's Aperture AI gateway. Apollo Research, a public-benefit corporation known for evaluating frontier models for scheming and deception, built Watcher to turn its monitoring research into production security. A lightweight client installs hooks into Claude Code and OpenAI's Codex (remote Claude Code sessions are covered through Claude Tag), records every session and trajectory, and routes each proposed tool call through a staged blocking-review pipeline: deterministic always-allow and always-deny thresholds and command rules first, then a cheap triage grader that can only approve, then a deep-review LLM grader that scores risk from 1 to 10, and finally human escalation. Calls are allowed, denied or held for approval, and a separate asynchronous trailing review grades whole trajectories for cross-turn problems such as a wrong diagnosis. Apollo says it detects more than twenty failure modes, including instruction violations, deception, dangerous code execution, data deletion and actions exceeding instructions, and claims 100% recall on critical-severity failures with under 1% false positives on benign tool calls, at an estimated 3-5% added cost and 6-8% added latency. It runs as a cloud service hosted in Western Europe or self-hosted on the customer's own infrastructure with bundled AWS Terraform, customer-supplied LLM keys and no phone-home telemetry. Apollo reports monitoring billions of agent tokens a month at agent-building scale-ups, trading firms and multinational enterprises; pricing is not published.

Category

Governance & Security

Pricing

Contact for pricing

Target Market

CISOs, CTOs, Platform Engineering Teams, Application Security Teams

Deployment

Cloud-first, Self-hosted

• ✓
  Blocking review

  Gates each proposed tool call before execution through rules, a triage grader, deep LLM review and optional human approval.

• ✓
  Trailing review

  Asynchronously grades whole session trajectories for cross-turn problems and surfaces findings in the Analyzer without slowing the agent down.

• ✓
  Custom graders

  Versioned LLM grading rubrics with score dimensions; teams can build their own graders and roll them out for live blocking or on-demand grading.

• ✓
  Analyzer dashboard and Slack alerts

  Investigate sessions, review security decisions, manage monitors and organisation settings, and push grading findings to Slack for fast response.

• ✓
  Self-hosted deployment

  Run the backend on your own infrastructure with bundled AWS Terraform, your own Postgres and LLM keys, and no telemetry sent to Apollo.

• ✓
  Fleet rollout via MDM and containers

  Deploy the client to managed Macs, shared VM images and dev containers with MDM scripts, headless sign-in and organisation API keys.

• ✓
  Python SDK and HTTP API

  Programmatic ingest, grading and session queries let teams feed Watcher from custom agents or pipe results into existing security tooling.

• •
  Safer auto-approval for coding agents

  Engineering organisations let Claude Code run with fewer permission prompts while Watcher blocks destructive commands and escalates risky calls to a human.

• •
  Preventing data leakage

  Security teams catch agents attempting to send private code or data to outside destinations and stop the tool call before it executes.

• •
  Incident investigation

  When an agent deletes files or breaks a build, teams replay the recorded trajectory in the Analyzer to see exactly what happened and why.

• •
  Org-wide agent visibility

  Paired with Tailscale Aperture's identity-linked gateway logs, security leaders get high-level summaries of agent behaviour while developers see real-time detail.

• •
  Self-hosted monitoring for regulated firms

  Trading firms and enterprises keep full agent transcripts, including source code, inside their own network by running the self-hosted deployment.

Apollo Research does not publish list pricing; access is arranged by contacting the company, and the February 2026 launch was offered as early access on request. Apollo estimates monitoring adds 3-5% to agent running cost, and self-hosted deployments also carry their own LLM provider bills because the graders run on customer-supplied API keys for OpenAI, Anthropic and Google models.

This page was written from 8 sources, 7 on domains other than watcher.apolloresearch.ai.

1. 1.watcher.apolloresearch.ai — watcher.apolloresearch.aivendor
2. 2.watcher-docs.apolloresearch.ai — blocking and trailing review.md
3. 3.watcher-docs.apolloresearch.ai — security.md
4. 4.watcher-docs.apolloresearch.ai — supported agents.md
5. 5.apolloresearch.ai — introducing watcher for ai oversight
6. 6.techcrunch.com — the fix for rogue ai agents could be more ai
7. 7.tailscale.com — aperture partners update
8. 8.siliconangle.com — secure networking startup tailscale launches identity linked