An employee asks an AI agent: “Pull the biggest expense in each category and send them to our stationery supplier so we can negotiate a discount.”
The agent runs the request exactly as written. It finds the largest expense per category, including one stored in an HR system that the employee was never meant to see, and emails the list to people outside the company. No one planned a leak. The request was vague; the agent took it literally, and its access was far broader than the task required.
For a security team, that is a data breach with a perfectly clean audit trail: valid credentials, authorized systems, no malware, no attacker. Call it the unintentional insider, an agentic AI security risk with more access, autonomy, and trust than the job required.
The perimeter now includes software that takes instructions
AI agents are leaving the pilot phase. By 2028, an estimated 33% of enterprise software applications will include agentic AI, up from under 1% in 2024, and at least 15% of day-to-day work decisions will be made autonomously. Each new connector to Jira, SAP, SharePoint, email, or Teams extends what an agent can read, change, and send. Security teams have long governed what employees can reach. Now, software acting on their behalf raises the same question.
Industry guidance has started to spell out AI security risks, listing Excessive Agency and Sensitive Information Disclosure among the threats to design against. Preparation is lagging: among organizations hit by an AI-related breach, 97% lacked proper AI access controls, and 63% of all breached organizations had no AI governance policy, or were still drafting one.
Three traits make agents harder to secure than traditional software:
- Speed: Decision chains across models and tools in milliseconds, each shaped by the one before. A small deviation early on can end somewhere nobody expected, and a human review arrives only after the action is done. Oversight that depends on someone catching a problem in real time cannot keep up.
- Reach: A single agent can hold the permissions of several teams at once, sometimes through its own service account. That makes it one of the most privileged identities in the company, usually with far less scrutiny than a human administrator.
- Vague requests: Employees talk to agents as they would to a coworker: short, casual, open-ended. “Send the most relevant expenses to the supplier” leaves the agent to define “relevant,” choose where to look, and pick the recipient. As agents become routine, fewer people stop to double-check the result.
Put together, these traits point to one conclusion. A prompt cannot be the safeguard, and neither can the user’s good judgment. The controls have to sit outside the agent, in the architecture around it.
The fix is old school
AI agent security does not call for a new safety philosophy. It calls for applying an established one to a new kind of identity: trust nothing by default, including in-house-built agents.
It starts with identity. Each agent receives its own credentials, scoped to a single task, and never borrows an employee’s session. Isolation comes next, so that an error in one environment stays contained there. Agent activity is logged and monitored in the same way as privileged accounts are. For sensitive operations, such as sending data outside the company, the approval step is built into the software. A prompt telling an agent to “check first” is a suggestion, not a control. What holds up in an audit is a named, accountable reviewer who signs off before the action runs. That is Zero Trust applied to agents: continuous verification, least privilege, no assumptions.
Closing the Door on the Unintentional Insider
Insider-risk programs have traditionally focused on people: vetting who joins the company, spotting conflicts of interest, watching for unusual access, and data extraction. Those defenses still matter, but they were built around motive. An agent has none. It has no grievance to detect, no financial pressure to flag, and no history to screen, so the usual warning signs never appear. What remains is simpler and easier to miss: a system that was given too much autonomy, too little isolation, and too much confidence.
That also makes the risk manageable. The unintentional insider will not break in. Organizations will deploy it themselves, and each decision about its permissions, its environment, and its approvals is a security decision made in advance. Agents built on that foundation can deliver their value without turning into the next incident report.
Every agent an organization connects is a new identity to secure. Globant’s Cybersecurity Studio helps teams map where agents have too much reach and design the controls around them, from scoped access to Zero Trust.
