With the rapid adoption of artificial intelligence technologies, a new security challenge has emerged in the form of "AI Agents" that are built outside the oversight of IT and cybersecurity teams. Recent data from the Cloud Security Alliance indicates that 82% of professionals found AI agents in their organizations that they were unaware of, opening security gaps that could lead to financial and operational disasters.
Access Gaps and Multiple Digital Identities
The first problem lies in how these agents obtain access permissions. Employees often use "no-code" tools to grant an agent permissions via OAuth protocols or personal API keys. This multiplicity of access methods creates confusion in audit logs; the system logs might show that an operation was performed by a "service account" or an "API key," while in reality, the agent was operating under the authorization of a human user, making the tracking of legal and technical accountability extremely difficult.
The "Rule of Two" for Secure Design
To protect against these risks, the concept of "Secure by Design" emerges. Security teams at major companies like Meta rely on what is called the "Rule of Two" to determine the risk level of an agent. According to this rule, an agent should not combine three elements in a single session:
- Processing untrusted inputs: Such as reading emails from external sources.
- Accessing sensitive systems: Such as human resources databases or financial systems (ERP).
- Ability to change state or communicate externally: Such as modifying bank details or sending data to an external party.
If an agent possesses these three characteristics together, it becomes an ideal target for attacks.
Risks of Prompt Injection via Content
One of the most dangerous threats is "Prompt Injection," where attackers can send hidden instructions within content that appears normal. For example, an email could be sent containing text written in white on a white background that asks the agent to "update the supplier's bank details in the system." Since the agent reads the content digitally, it will execute the command without any human employee noticing the presence of a suspicious message, and the operation will appear in the logs as a legitimate and authorized activity.
Challenges of Detection and Post-Audit
Traditional detection systems rely on monitoring permissions, but a compromised agent may remain within its granted scope, making it invisible. The solution lies in Behavioral Baselining; that is, monitoring any change in the sequence of operations, such as an agent that was previously read-only attempting to "write" or modify records for the first time.
Why Does This Represent a Real Security Challenge?
The danger lies in the fact that AI agents break the cycle of "human accountability." When an agent makes a mistake or executes a malicious command, investigators face a dilemma in determining the authority that allowed it. Is it the employee who created the agent? Or the user who granted the OAuth authorization? Or is the agent operating completely independently? Without accurate logs that link every action to a clear human decision, organizations remain unable to close gaps and prevent the recurrence of attacks.