Your AI Agent Activates Capabilities Without Your Knowledge, Thereby Endangering the Organization Even Without a Malicious Attack
Every employee today enjoys access to AI tools, particularly those that enable code generation. However, this exposes the organization to severe cyber threats and may even cause AI agents to perform tasks other than those defined for them
Until recently, a familiar cyberattack scenario would involve an infected file, an unpatched vulnerability, or a link that someone clicked by mistake. These threats have not disappeared, but alongside each of them a new front has opened: AI tools that employees use daily, which are sometimes connected to files, corporate folders, internal systems, and cloud services.
This connectivity provides attackers with a new path for exploitation. Instead of necessarily breaking in through the front door, they might try to hide within the instructions, permissions, or resources to which the agent has already been granted access. If corporate secrets exist in this environment, or if a hostile directive has been injected into the agent, it might read information not intended for it, access sensitive systems, or perform actions entirely different from those for which it was activated. This is why AI security and endpoint security are becoming the very same conversation today.
An Attack That Can Be Read
This risk is far from theoretical. In two tests we recently conducted in large organizations, we encountered the same blind spot: the "Skills" used by AI agents when they require new capabilities to fulfill their assigned task. Skills are packages that consolidate instructions, scripts, and resources, teaching the agent how to execute a specific task. They enable fast and efficient automation, but precisely for this reason, security discipline within them is easily neglected.
In those environments, API keys, access tokens, and connection credentials were found stored for convenience, so that the process would run seamlessly without pausing at every step. Sometimes this is human error. In other cases, an external component exploits the trust placed in it to insert instructions that should not be there. In both scenarios, a corporate secret can become part of the context that the agent can read and act upon.
Herein lies the fundamental shift: the attack does not have to look like malicious code or a suspicious file. It can hide inside completely readable text masquerading as an explanation, professional guidance, or part of a routine workflow. In other words, the boundary between instruction, identity, and permission is blurring. And when the agent is built from the ground up to listen, interpret, and assist, it becomes vastly more difficult to detect the moment it begins listening to someone who shouldn't be giving it instructions in the first place.
Development Has Leaked to Every Computer
To understand the scope of the risk, one must look beyond R&D departments. Until recently, a security officer could single out developer computers as a distinct risk group: that is where code executes, where keys are stored, and where sensitive services are connected. Today, this boundary is eroding rapidly.
Marketing, finance, sales, and operations personnel are using agents that can write scripts, edit files, connect to systems, and execute sequences of actions. Not every AI user becomes a developer, but more and more users are running tools with capabilities that were previously reserved for development environments.
From an attacker's perspective, these are the exact raw materials of an attack: access, permissions, execution capability, and data. Therefore, the assumption that security only needs to protect developer workstations no longer holds water. Protection must encompass every endpoint where an agent operates, and every workspace where it receives access to perform actions on behalf of the user or the organization.
It’s Not Just What the Agent Is, But What It Does
The challenge isn't limited to the question of which files or permissions exist in the environment. It is equally crucial to examine the behavior of the agent itself and the gap between its assigned task and the actions it actually performs. This gap can be termed Intent Drift – a deviation between the intention defined for the agent and the course of action it chooses.
If an agent is asked to summarize a document or edit code, but begins searching for access keys, reading secret stores, or accessing information unnecessary for the task, this is not necessarily proof of an attack. Sometimes it stems from a flawed instruction, over-improvisation, or an agent's attempt to achieve a result at any cost. But from a security standpoint, there is no need to wait to figure out what the intent was. The behavior itself already warrants a halt, an alert, and an investigation.
The ability to detect this gap is a game changer. Instead of settling for whether a malicious file was detected, one can ask whether the sequence of actions performed by the agent makes sense relative to the task it received. This is a more effective way to deal both with prompt injections and with the simple, yet dangerous, failure of an agent trying to be overly helpful.
AI Security Is Not a Single Product
Hence, it is also clear why there is no single silver bullet for AI security. Risk is distributed across endpoints, the cloud, the network, and data, with each layer requiring a different defense. At the endpoint, one must have visibility into the agent, the execution environment, the Skills, and the permissions it executes. In the cloud, services and identities must be protected. On the network, anomalous traffic must be identified. At the data layer, control must be maintained over what the agent is permitted to view, process, or exfiltrate.
Legacy attacks have not disappeared, but attackers quickly identify new layers that have not yet received the same controls. Today, they inspect instruction files, skills, permissions granted to agents, and the gap between what the user requested and what the machine actually executed. This is why security priorities are shifting so rapidly.
Your Agent Requires Oversight
The goal is not to put AI back in a closed box or relinquish the immense value it brings. The goal is to stop treating it as just another installed software program. An agent is an active identity: it reads, interprets, decides, executes, and sometimes improvises.
Once these capabilities run on endpoints across the organization, securing them becomes an integral part of working with them. In the age of agents, the question is who sees the agent in real time, and who can stop it the moment it starts doing something no one asked it to do.
By Shahar Mann, CEO, Backslash, Duns & Bradstreet
