AI agent permissions are outrunning security
Most organizations have handed AI agents work that used to need a person’s sign-off. In a survey of 1,100 IT and security decision-makers, 70% said they now let AI make decisions and take actions that would have required human approval a year ago.
That new authority is already causing trouble. Three in four organizations ran into at least one AI-related security issue or warning sign in the past year. In a lot of those cases, an agent simply went somewhere it wasn’t supposed to. It connected to a system without security approval, got into data it shouldn’t have seen, or kicked off an action nobody had approved. About a quarter of respondents ran into each of those.
An AI agent is different from a chatbot that drafts your emails. It acts on what it decides, calling other systems, changing configurations and working through multi-step tasks. Roughly three in ten organizations would let one run a security investigation or change a production environment with nobody checking its work.
Confidence runs ahead of what teams can see
Ask security leaders whether they know what their AI is doing, and most say yes: 84% claim visibility into how AI systems access data and systems. Ask a narrower question, whether they can see and audit every action an agent takes, and the answer drops to 49%.
That gap matters most after something goes wrong. An agent whose actions you can’t trace is an agent you can’t investigate. Sixty-two percent of respondents also agree they deployed AI tools before setting up the right safeguards.
The control everyone believes in ranks last
Here’s the odd part. Most respondents agree that limiting what AI can access matters more than trying to predict every threat. Yet when asked to name their two main controls for AI, explicitly defining what an agent is permitted to do came in last, picked by a quarter of them. Guardrails, the instructions and constraints built into the AI itself, sat near the top with outside containment and human oversight.
Guardrails work when the AI follows its instructions. The incidents above are what happens when it doesn’t. An allow-list, a short written list of the systems, data and actions an agent may touch, is enforced from outside the agent, so it holds even when the agent misbehaves.
Raghu Nandakumara, VP of industry strategy at Illumio, thinks the gap comes down to friction. “It’s hard to define what a new agent should be allowed to do, and no one wants to disrupt the workflow that made it useful in the first place. So, organizations decide to lock things down once they understand the agent better, but that day rarely comes.”
Who answers when an agent breaks something
Handing an agent authority leaves open the question of who owns its mistakes. “Regulators and courts have been consistent that deploying an AI agent doesn’t transfer accountability, so the vendor is never the answer and the organization that switched it on owns what it does,” Nandakumara told Help Net Security.
“Within the organization, the business leader who approved the use case should own the outcome. Making security the default owner of business decisions is a mistake, but it’s what happens when nobody else is named. The CISO owns the guardrails, including what the agent can access, what it’s allowed to do, and how quickly it can be stopped.”
“Regulators are starting to force the questions. Financial services are furthest ahead, with the UK’s senior managers regime and Australia’s APRA both expecting a named person accountable for AI outcomes. On the other hand, most boards still aren’t asking them before agents go live. If you can’t name who owns an agent, it shouldn’t be in production.”
Where to start
Nandakumara’s advice is aimed at teams that already have agents running. “You don’t need to start with a complete inventory because, when you take AI out of the picture, it’s the familiar problem of a new identity with broad credentials and no role. Organizations should start with the agent that can access data you can’t afford to lose – one boundary, enforced this quarter, will do more for you than a perfect agent policy next year. Write down the three or four things the agent needs to do, then limit it to those actions, systems and data.”
Download: The IT and security field guide to AI adoption
