Share This Article
AI agents are outgrowing the chatbot era. Today’s artificial intelligence systems can do a lot more than just answer questions or generate content. They can write and run code, interact with applications and access files, tap into APIs, and complete multi-step tasks with little or no human intervention.
That shift holds the promise of significant productivity gains for businesses, but it also creates a security problem: traditional cybersecurity controls weren’t built for software that can make independent decisions and take actions.
Enterprises are connecting AI agents to internal systems, customer data, cloud platforms, and business applications, increasing the potential attack surface. Security teams now have to ask not only whether an AI system can be compromised, but what that system is capable of if it acts unexpectedly or is manipulated.
AI Agents: A New Kind of Security Challenge
Traditional software usually works based on predefined rules. By contrast, AI agents interpret instructions, reason through problems, and choose tools or actions dynamically.
That independence is what gives them utility—and makes them harder to secure.
An agent that has access to an organization’s email, CRM, cloud storage, or development environment may have the ability to take action across several systems. This means that a compromised or manipulated agent could amplify a relatively small security problem into a much larger incident.
Microsoft has identified a range of risks associated with agentic AI, including unexpected autonomous behavior and security risks stemming from connections to APIs, identity systems, and external tools.
It’s not necessarily a case of an AI agent being malicious. Even an agent following instructions can make a wrong decision, misunderstand a request, or respond to malicious input.
The Risk Is Already Real: Recent Incidents Show
New findings from Anthropic explain why companies are paying more attention.
Anthropic reported a fourth incident on September 9 in which an early version of Claude Opus 4.6 accessed real third-party systems during a cybersecurity evaluation, unintentionally. The incident, which took place in January, was uncovered months later during a wider review. Anthropic said the model was connected to the open internet due to a testing misconfiguration.
Anthropic later expanded its review to include around 481 million transcripts and used a second-stage AI-assisted analysis to examine millions of flagged transcripts. The company said it found no other incidents of similar or greater severity.
These incidents occurred in controlled testing environments rather than typical enterprise deployments, but they demonstrate an important point: once an AI system has access to external tools and networks, its behavior can have consequences outside the model itself.
The Attack Surface Is Bigger Than the AI Model
One of the biggest mistakes an organization can make is to think of the AI model as the entire security problem.
The real attack surface includes everything that is connected to the agent.
What Can Be Part of an AI Agent’s Attack Surface?
- Third-party APIs and services
- Cloud storage
- Databases
- Identity and authentication systems
- Internal business applications
- Email and messaging services
- Development environments
- Confidential business files
Any vulnerability in these connections can potentially become an entry point for abuse.
Another important concern is prompt injection. Attackers can attempt to inject instructions into the content an agent consumes, potentially tricking the agent into executing unintended actions. Prompt injection is a specific concern Anthropic has highlighted for agent-based systems that have access to tools and external information.
AI Is Changing the Economics of Cyberattacks
But the security challenge isn’t just for businesses deploying their own agents.
Increasingly, threat actors are using AI to accelerate cyber operations. Anthropic’s threat intelligence report for September 2026 describes campaigns in which AI was used for reconnaissance, exploitation, and data exfiltration, including multi-agent workflows that could operate with limited human intervention.
Some observed operations were able to complete breaches within hours while handling multiple victims in parallel, Anthropic said. The company says greater autonomy could reduce the cost and expertise needed to carry out attacks, potentially making more targets economically attractive to attackers.
This is a two-sided problem. Organizations are deploying agents to automate work, while attackers can deploy similar capabilities to automate parts of the attack lifecycle.
Why Human Approval Might Not Be Enough
A simple answer is to have an AI agent ask for human approval for every important action it wants to take.
This can help, but it is not the whole solution.
Repeatedly asking users for permission can make them less attentive to the system, Anthropic said. In its own telemetry for Claude Code, the company said that users approved about 93% of permission prompts, showing how approval fatigue can weaken human oversight.
That means enterprises need security controls that don’t rely solely on humans to detect every questionable activity.
Security Controls for AI Agents
Sandboxing, least-privilege access, network restrictions, monitoring, and clear boundaries around what an agent can access can help limit the damage when something goes wrong.
What Businesses Should Do Now
That doesn’t mean organizations can’t continue to deploy AI agents. Instead, they should treat them more like privileged software systems than ordinary productivity tools.
Security teams need to understand what agents are available, what they have access to, and what they can control. Permissions should be limited to what each agent actually needs, while sensitive actions should have additional controls.
Organizations should also monitor agent activity, maintain detailed logs, and have processes in place to quickly disable compromised or malfunctioning agents.
According to the National Institute of Standards and Technology, there is broad consensus that AI agents present new security threats and that current cybersecurity practices must be updated to be effective for agent security.
Security Will Dictate the Next Phase of Enterprise AI
AI agents could be among the most important enterprise technology shifts in the coming years. They can work across applications and execute complex workflows, potentially transforming how companies manage software development, customer service, finance, and operations.
But with greater autonomy comes greater responsibility.
The key security question is no longer simply whether an AI model gives a safe response. It’s about whether an organization can monitor what an agent can perceive, what it can do, and how much damage it could cause if it makes the wrong decisions.
So, the future of AI adoption for enterprises may be less about how autonomous agents can become—and more about how well their blast radius can be contained.
