AI agent security briefing summary
Many of you asked us to unbundle AI agent security and provide concrete actions, and we delivered. Our inaugural briefing was an absolute blast, with more than 130 people joining to hear about AI agent security. Huge thanks to our partner Info Security Insights for making it possible.
We received 64 questions ahead of the briefing, largely about agentic risks, attack vectors, the control plane, and solutions on the market.
Here are the highlights of what we shared:
- Agents make known security problems bigger. The net new problem is non-determinism × autonomy = a capable autonomous system whose states cannot be enumerated or tested.
- Attackers can reach an agent through six vectors: direct prompt injection, model poisoning, memory poisoning, tool poisoning, indirect prompt injection, and malicious data. The seventh, misalignment, needs no attacker.
- 125 vendors claim to solve AI agent security. They look at the problem from the identity, endpoint, network, API, and data loss perspectives.
- A control plane needs six capabilities: inventory, identity, policy, runtime enforcement, an audit log, and a kill switch.
1. Your company can be held liable for what agents do and say.
Update your threat model with the six negative business impacts: illegal actions, out-of-policy output, data leakage, unauthorized actions, loss of auditability, and manipulated decisions. A Canadian tribunal held Air Canada to a refund policy its chatbot invented. A German court held a clinic liable for its chatbot's false claims about its doctors.
2. AI agent security is a systems problem.
Models are untrusted, and security invariants must be enforced at the system level, the same approach that secured operating systems, browsers, and databases. See Agent Security is a Systems Problem.
3. Agents that run under human identities need only 0.5% of their permissions.
Move from role-based to task-based just-in-time access. The standard exists: RFC 9396 puts book and pay, Berlin, and a $500 cap into the token. What is missing is the mapping from intent to permissions, a finished way to carry the delegation across domains, a shared vocabulary for the limits, and a way for the platform to get the user's yes mid-task.
4. A growing list of static policies gives the dangerous perception of control.
Ask a vendor to show their largest deployment's policy list, the top 10 rules that fire the most, and how many never fired.
5. Precision, recall, and latency. You can't get all three.
Prioritize what matters for a specific agent. Most vendors run a regex, then a BERT-type classifier, then an LLM as a judge. A tool call waits up to 20 ms if the regex settles it, and 0.25 to 1.6 seconds if it reaches the judge.
Ask a vendor for their runtime precision and recall per tool call at different latency budgets, and for the dataset they used to measure them.
The next briefing is in December on AI agent identity. If you know a great researcher or a vendor we need to interview, please let us know.
The recording and the slides from the briefing.