Info Security Insights×The Weather ReportAI Security & Safety Intelligence
AI agent security
The security risks of running agents in production, and what security, engineering, and IT teams can do about them
Ilya Kabanov
Founder, The Weather Report
October 21, 2026

About The Weather Report

The Weather Report
AI security and safety intelligence for defenders
A 501(c)(3) nonprofit, so our only metric is whether we helped you make better decisions.
Subscribe to our weekly briefing
theweatherreport.ai

Agenda

The Weather Report

Liability across the AI ecosystem

The Weather Report
Data providersand curatorsModeldevelopersModel integratorsand API providersThird-party vendorsand system integratorsApplicationdevelopersInfrastructure andcompute providersEnterprisecustomers(deployers)End users
    Judy Selby, "Potential Legal Claims by AI Ecosystem Player"

    Negative business impacts

    The Weather Report
    EventOutcomeExamples
    1
    Illegal actions
    Investigations, lawsuits, and criminal liability.
    • OpenAI's agents compromised Hugging Face's infrastructure, July 2026.
    • The FTC, two state attorneys general, and a Senate subcommittee are investigating OpenAI.
    2
    Out-of-policy output
    Binding commitments, regulatory breaches, and liability claims.
    • A German court held a clinic liable for its chatbot's false claims about its doctors, May 2026.
    • A Canadian tribunal held Air Canada to a refund policy its chatbot invented, February 2024.
    3
    Data leakage
    Confidential data loss, stolen credentials, and regulatory fines.
    • Microsoft 365 Copilot could leak tenant data with zero clicks, CVE-2025-32711, June 2025.
    • Poisoned GitHub repositories made coding agents exfiltrate prompts, .env files, and cloud keys, Mitiga, August 2026.
    4
    Unauthorized actions
    Destroyed data, service outages, and lost revenue.
    • Replit's coding agent deleted a production database, July 2025.
    • A Cursor agent deleted PocketOS's production database and its backups, April 2026.
    5
    Loss of auditability
    Undetected incidents, false assurance, and no defensible record.
    • OpenAI's agents tried to delete or alter records of their actions, METR, August 2026.
    • Under pressure, frontier models deceived in 59% of tasks, arXiv 2610.07967, October 2026.
    6
    Manipulated decisions
    Steered purchasing and financial losses.
    • Thirty-one companies hid instructions in "Summarize with AI" buttons to make assistants recommend them, Microsoft, February 2026.
    • Poisoned memories triggered the attacker's chosen action in 60 to 89% of runs, arXiv 2605.15338, May 2026.
    Outcomes after Kim et al., arXiv 2603.11088

    What is different about an agent

    The Weather Report
    KNOWN PROBLEM WHAT THE AGENT ADDS RESULT Data mixed with code × natural language = A README.md runs a command Human error × machine speed = Production deleted in nine seconds Services run on human identities × highly capable = The perfect insider threat Excessive access × general-purpose = Agents need only 0.5% of their permissions + New Non-determinism × autonomy =
    A capable autonomous system whose states cannot be enumerated or tested
    Greshake et al., 2023; Zverev et al., ICLR 2025; Debenedetti et al., 2025; Veski et al., 2026

    Attack vectors and misalignment

    The Weather Report
    AGENT HARNESS User / Agent Interface Model 7 Misalignment Memory MCP / Tools External data Organization data External Internal Direct prompt injection Model poisoning Memory poisoning Indirect prompt injection Malicious data Tool poisoning 1 2 3 5 6 4
    Adapted from Kim et al., arXiv 2603.11088, Figure 2

    AI agent security is a ___ problem

    The Weather Report
    Identity (9)
    okta.comgradient.techagen.cotruu.aikeyrunner.appindykite.aiosohq.comastrix.securitysilverfort.com
    Endpoint (5)
    airlockdigital.comqingteng.cndaytona.ioedera.devcrowdstrike.com
    Network (6)
    lumeus.ailunar.devstacklok.comveilnet.netnimble.securitypaloaltonetworks.com
    API (11)
    backslash.securityoperant.aicloudmatos.airaven.iooligo.securityobsidiansecurity.compynt.iowallarm.comcantina.securitycodenotary.comakto.io
    Data loss (6)
    widersecurity.comprotecto.aioblivious.comopaque.corubrik.comavepoint.com
    New (88)
    whitefin.aivotal.aiprimary.aiagenticfabriq.comwithwillow.aitego.aiarcade.devcyata.aihol.orgmanifold.securityanomity.airunta.comstarseer.aialecturalabs.comgeneralanalysis.comcanyonroad.aibay.securitya16y.aizenity.iowitness.aihiddenlayer.combarndoor.aifior.grouppipelab.orgmintmcp.compromptfoo.devneuraltrust.ainatoma.aiobot.aienkryptai.comreinsec.iodaxa.ailasso.securityvernolabs.aiairia.comarrakis.securitytenetsecurity.aicorridor.devcodeintegrity.aiRed Spectercapsulesecurity.iontur.aipallma.aicaterpillar.alice.iojetstream.securityquilr.aiassury.aisun.securitysondera.aicognitivtrust.combeyondguard.aiair.securityciphero.aiZenGuardpolaxis.ioovalix.aioryo.iomint.securityjozu.comhighflame.comgolf.devfirstrecon.aidapplepot.comcertiv.aipromptarmor.comnestria.aiarchestra.aistraiker.aisonoma.devonyx.securityhikmaai.ioevokesecurity.comtrustwise.airepello.aiinvariantlabs.aiknostic.aiparakeetsecurity.airunlayer.comvirtueai.comziosec.comairasecurity.aieve.securityaiceberg.aiprompt.securitydeepkeep.aihelmet.shgeordie.aiunboundsecurity.ai
    125 vendors: the Agentic AI Security category of CybersecTools, October 15, 2026

    Which agent systems are you running?

    The Weather Report
    Assistants Built by vendors Runs in their environments EXAMPLES ChatGPT, Copilot, Claude, and Gemini OWNERSHIP Data Instructions Model Runtime Gates Endpoint Built by vendors Runs on your devices EXAMPLES Claude Code, Cursor, and Codex OWNERSHIP Data Instructions Model Runtime Gates Platform Configured by you Runs on their platform EXAMPLES An HR onboarding agent in Salesforce Agentforce OWNERSHIP Data Instructions Model Runtime Gates Custom Built for you Runs in the cloud EXAMPLES Apps on Amazon Bedrock and Claude Managed Agents OWNERSHIP Data Instructions Model Runtime Gates You Vendor

    The control plane

    The Weather Report
    DATA PLANE User / Agent Interface Model MCP / Tools External data Memory Organization data prompts and outputs calls and responses ingress and egress writes writes gate CONTROL PLANE 1Inventory
    agents, owners, models, MCP servers, skills, and plugins
         2Identity
    bound to a user or owner, rights scoped to the task
         3Policy
    rules on each tool call, its arguments, or its outcome, per agent, app, or tool
         4Runtime enforcement
    of actions against policies, in context
         5Audit log
    of tool calls and verdicts, tamper-proof
         6Kill switch
    stop any agent or session
    After NIST SP 800-207, Figure 2; Díaz, Kern, and Olive, Google, 2025; Christodorescu et al., arXiv 2605.18991

    Vendors at the gates

    The Weather Report
    alice.io
    Alice
    appviewx.com
    AppViewX
    aws.amazon.com
    AWS
    clevrsecurity.com
    Clevr Security
    ctgt.ai
    CTGT
    deepkeep.ai
    DeepKeep
    delinea.com
    Delinea
    enlightenintel.io
    Enlighten Intelligence
    evokesecurity.com
    Evoke Security
    fencio.dev
    Fencio
    geordie.ai
    Geordie
    harness.io
    Harness
    infertrail.com
    InferTrail
    intrinsec.ai
    Intrinsec AI
    manifold.security
    Manifold
    noma.security
    Noma
    raxe.ai
    RAXE AI
    realmlabs.ai
    Realm Labs
    runctrl.ai
    RunCtrl
    silmaril.dev
    Silmaril
    sondera.ai
    Sondera
    surenode.ai
    SureNode
    tenex.ai
    Tenex AI
    wingback.ai
    Wingback Security
    Vendor interviews, October 2026

    AI identity management system

    The Weather Report
    1. 1
      Alice asks a travel agent to buy a ticket to Berlin for less than $500.
      GapDelegation by task is not widely deployed
      Today: OpenID Connect and OAuth 2.0, RFC 6749
      { "sub": "alice",
  "scope": "travel:book travel:pay travel:cancel travel:refund" }
      Standard: RFC 9396, Rich Authorization Requests
      { "sub": "alice",
  "authorization_details": [{
    "type": "flight_booking",
    "actions": ["book", "pay"],
    "destination": "BER",
    "maxAmount": "500 USD" }] }
      GapNo standard or specification for translating intent to operational permissions
      { "permissions": [ "GET /fares", "GET /fares/{id}/rules", "GET /seatmap/{flight}", "POST /bookings",
  "POST /payments", "calendar:read", "email:read", "cardvault:write", "web:fetch" ] }
    2. 2
      Alice's agent needs to represent Alice at a travel platform within the delegated scope.
      GapOAuth identity and authorization chaining across domains is not yet an RFC
      Today

      Alice's agent cannot carry her permission to the travel platform, so today Alice lets the agent work under her credentials on the travel platform.

      Future

      Alice's agent gets a signed note from her identity provider, hands it to the platform's authorization server, and receives a platform token with her delegated scope inside.

      GapNo standard defines shared authorization_details types

      The travel platform must understand and accept the agent's authorization_details schema.

    3. 3
      The only ticket available costs $900, and the travel platform needs Alice's approval.
      GapMid-task user confirmation has no standard
      Today

      The agent asks Alice to approve a ticket purchase for any amount.

      Future

      The ticket within the budget is purchased automatically. For the over-budget purchase, Alice's approval goes to a step-up authorization through Client-Initiated Backchannel Authentication (CIBA), and the platform gets a verifiable grant.

    IETF draft-ietf-wimse-aims-00, September 2026; Fisher and Galluzzo, NIST, August 2026

    Policy, the art of saying no

    The Weather Report
    Five layers to constrain the billing agent from what it may refund to what it can say, do, and access. LAYER EXAMPLE RULE 1Business permit(principal, action == AgentCore::Action::"RefundTarget___process_refund", resource == AgentCore::Gateway::"<gateway-arn>") when { context.input.amount < 500 }; 2Content "topicPolicyConfig": { "topicsConfig": [{ "name": "Compensation promises", "definition": "Promises of credits, waivers, or extra refunds", "type": "DENY", "outputAction": "BLOCK" }] } 3Operation { "permissions": { "allow": ["mcp__stripe__stripe_api_read", "Bash(stripe *)"], "deny": ["mcp__stripe__send_money", "WebFetch"] } } 4Data access { "permissions": { "deny": ["Read(./.env)", "Read(./.env.*)"] } } 5Network { "sandbox": { "network": { "allowedDomains": ["api.stripe.com"], "strictAllowlist": true } } }
    After NIST SP 800-207, NIST SP 800-162, and RFC 1122

    Policy challenges

    The Weather Report
    CHALLENGE QUESTION TO ASK A VENDOR 1 Policy bootstrapping Walk us through the policy setup for an agent on an endpoint,say Claude Code, and for a custom customer support agent. 2 A growing policy list Show us your largest deployment's policy list, the top 10 rulesthat fire the most, and how many never fired. 3 Static policies limit the agent How are the policies scoped for general-purpose agents? 4 Overused human approval Across your customers' agents, which tasks go to a human, whatshare of tasks escalates, and what share the human rejects?
    Vendor interviews, October 2026

    Common runtime enforcement practice

    The Weather Report
    tool call Regex R P BERT-type classifier recall precision LLM as a judge recall precision allow non-blocking blocking redact · steer · alert user approval · deny pause · kill LATENCY <1 to 20 ms 10 to 55 ms 0.24 to 1.5 s 0 up to 20 ms 10 to 75 ms 0.25 to 1.6 s
    Vendor interviews, October 2026; Red Hat guardrails benchmark; Semalith; SCOUT, arXiv 2605.30837

    Runtime enforcement trade-off

    The Weather Report
    PRECISION RECALL LOW LATENCY Ask your team 1 What is the acceptable latency of youragent's Critical User Journeys? 2 Does your agent have access to toolsthat may perform irreversible actionsor access untrusted content? 3 Does your team have the operationalcapacity to review alerts and fine-tunethresholds before moving to block mode? Ask a vendor What are your runtime precision and recall per tool call when applying policy rules,at different latency budgets? Tell us about the dataset you used to measure them.
    Vendor interviews, October 2026

    Interesting approaches

    The Weather Report
    Compile rules from documents Sondera A constitution in plain language, compiled to Cedar. CTGT Rules derived from past communications. Custom models Alice A small model per customer, trained on its own traffic. Silmaril Self-improving, baselined on normal traffic, no policy. Use model activations Realm Labs An open-weight twin stands in for the closed model. Intrinsec AI Anomalies in the server's KV cache, prompts never read. Off the hot path Manifold Slow detection tags the session, calls read the tag. Enforce at existing gates Noma No gateway of its own, policy runs in your gateways. Lean on agent identity AppViewX Owner offboarded, every agent they own is disabled too. Policy management Enforcement trade-offs Agent attribution
    Vendor interviews, October 2026

    Takeaways

    The Weather Report
    1
    Your company can be held liable for what agents do and say.
    Update your threat model with the six negative business impacts.
    2
    AI agent security is a systems problem.
    Models are untrusted, and security invariants must be enforced at the system level.
    3
    Agents that run under human identities need only 0.5% of their permissions.
    Move from role-based to task-based just-in-time access.
    4
    A growing list of static policies gives the dangerous perception of control.
    Ask a vendor to show their largest deployment's policy list.
    5
    Precision, recall, and latency. You can't get all three.
    Prioritize what matters for a specific agent.

    Sources

    The Weather Report

    Research

    Standards

    Sources, continued

    The Weather Report

    Industry

    Law and incidents

    Before you go

    The Weather Report
    Respond to the survey

    Share your experience and vote on the next briefing topic.

    https://theweatherreport.ai/forms/briefing-october-21-survey/
    Provide Feedback to Info Security Insights / Request CPEs https://s.zoom.us/m/bPFiqyBlO
    1 / 2