Patched but Not Safe: Fortinet Symlink Persistence and the Cost of Old Vulnerabilities
April 15, 2025You Cannot Investigate What You Did Not Log
April 29, 2025Through the first half of 2025, AI moved from answering questions to taking actions. Agentic systems that can browse, call APIs, run code, and chain steps toward a goal began appearing in real business workflows. They promise genuine productivity gains, but they also introduce a security question many organizations have not confronted: what happens when an autonomous system is given credentials and told to get things done?
New capabilities, new attack surface
A traditional application does what it is programmed to do. An AI agent decides how to accomplish a goal, and that flexibility is exactly what attackers can exploit. Prompt injection, where malicious instructions are hidden in content the agent processes, can redirect an agent to leak data or misuse its permissions.
Risks to plan for
- Over-permissioned agents. Convenience tempts teams to grant wide access so the agent is not blocked.
- Prompt injection. Untrusted content, such as a web page or an email the agent reads, can carry instructions.
- Weak auditability. If you cannot reconstruct what an agent did and why, investigation and accountability suffer.
Governing autonomy
Give agents the least privilege required, scoped to specific tasks and short-lived credentials rather than broad standing access. Keep a human in the loop for high-impact actions such as moving money, changing access, or deleting data. Isolate what agents can reach, treat data an agent ingests as untrusted input, and log every action it takes for review.
Takeaway
Agentic AI turns your access controls into decisions made by a manipulable system. Scope agents to least privilege, keep humans in the loop for consequential actions, treat everything an agent reads as untrusted, and log its actions so you can hold it accountable.