AI agents are quickly moving from experimentation into everyday business operations. Unlike traditional generative AI tools that wait for a user to ask a question, agents can take action: accessing systems, processing information, communicating with applications and completing tasks with varying degrees of autonomy.
That ability creates enormous opportunities for productivity. It also changes the security equation.
The danger is not simply that artificial intelligence can make existing cyberattacks more effective. Organisations must now contend with attackers using AI, attacks specifically designed to manipulate AI systems, and AI agents operating inside their own environments with access and permissions that may not always be fully understood.
For security teams, there are four areas in particular that demand attention.
1. Attackers are using AI to strengthen familiar techniques
Many of the cyber threats organisations face today are not fundamentally new. Phishing, social engineering, vulnerability exploitation and malware remain familiar parts of the threat landscape.
What AI changes is the speed, scale and level of personalisation attackers can achieve.
Generative AI can help criminals produce highly convincing social engineering content with far less effort. Instead of sending one generic phishing message to thousands of people, attackers can potentially tailor communications to individual targets, adapting language, context and tone to make a message considerably more believable.
AI tools can also accelerate vulnerability research and help attackers automate parts of the intrusion lifecycle. Increasingly autonomous systems can potentially assist with activities ranging from identifying targets and researching weaknesses to creating malicious content and coordinating subsequent stages of an attack.
For defenders, this creates a speed problem. Processes designed around human attackers manually conducting reconnaissance or crafting campaigns may struggle when automation allows the same work to happen significantly faster.
2. AI systems themselves are becoming attack surfaces
The second challenge is that AI is no longer simply a tool being used by attackers. It is also something attackers can target.
Every AI system introduced into an organisation potentially creates additional pathways that security teams need to consider. That becomes particularly important when an AI agent is connected to email, files, internal applications or other business systems.
Prompt injection is one example. An attacker may be able to place malicious instructions inside information an AI system is expected to process. If the agent cannot reliably distinguish between legitimate instructions and untrusted content, those instructions could influence its behaviour.
Other risks include poisoning the data or memory an AI system relies upon, exploiting the privileges assigned to an agent, manipulating underlying models or abusing third-party components and APIs.
Consider an AI assistant that can read email, access a calendar and perform actions on a user’s behalf. An attacker may not need to compromise the assistant in the traditional sense. Manipulating the information the agent consumes could potentially be enough to cause unintended behaviour.
The fundamental security question therefore changes. It is no longer simply: Can an attacker access this system?
Security teams must also ask: Can an attacker influence what this system decides to do?
3. Shadow AI could become the next shadow IT problem
Organisations have spent years dealing with shadow IT: applications, cloud services and devices introduced into corporate environments without formal approval or oversight.
AI presents a similar challenge, but potentially with greater consequences.
Employees are understandably interested in tools that make their jobs easier. Browser extensions, productivity assistants, meeting tools and other applications are increasingly adding AI functionality, sometimes without users fully appreciating how those capabilities interact with corporate information.
This creates the possibility of “shadow AI”: AI-enabled tools operating inside an organisation without security teams having sufficient visibility into them.
At the same time, AI agents frequently need considerable access to perform useful work. An agent designed to automate administrative tasks, for example, may need permission to read data, authenticate to applications or make changes across multiple systems.
That combination — limited visibility and significant permissions — deserves particular attention.
If an agent has extensive privileges, compromising or manipulating it could give an attacker access far beyond the AI tool itself. Connected agents can also create opportunities for attackers to chain smaller weaknesses together, turning apparently minor issues into broader security incidents.
The principle of least privilege therefore becomes just as important for AI identities as it is for human users.
4. Security controls need to move at the speed of AI
Organisations do not need to respond to these risks by preventing employees from using AI altogether. The objective should be to adopt it with appropriate visibility, governance and controls.
That starts with knowing what is actually running inside the environment.
Periodic inventories may not be sufficient in a world where new AI-enabled tools can appear quickly. Security teams should be working towards continuous visibility of the agents and AI applications interacting with corporate systems, the data they can access and the permissions they hold.
Organisations should also establish clear policies around how AI tools are approved and deployed. Access should be proportionate to the task an agent needs to perform, rather than granting broad permissions simply because doing so makes implementation easier.
Threat modelling will also become increasingly important. Frameworks such as MITRE ATLAS, the NIST AI Risk Management Framework, the OWASP guidance for generative AI and large language model applications, Google’s Secure AI Framework and ISO/IEC 42001 can give organisations useful structures for thinking systematically about AI-related risks.
Finally, defenders need to consider whether their existing controls can respond at machine speed. If automated systems can discover, exploit or respond to opportunities faster than a human team can realistically intervene, security automation and AI-assisted defence will increasingly form part of the response.
AI adoption and AI security have to happen together
AI agents are likely to become a normal part of the digital workforce.
That makes securing them less of a specialist AI problem and more of a fundamental cybersecurity issue.
Security leaders need visibility into which agents exist, what they can access, what actions they are permitted to take and how those actions can be monitored. They must also account for an adversary that can use the same technology to move faster and personalise attacks at greater scale.
The organisations that benefit most from AI will not necessarily be those that deploy agents fastest. They will be those that can embrace autonomy without losing control of the identities, privileges, data and actions behind it.
AI security cannot be something added after adoption. It needs to develop alongside it.
Read the full blog from Erich here.
