AI Agents Need More Than a Watchful Eye. They Need a Leash.
Watching what AI agents do inside your systems is useful. Stopping them doing the wrong thing is the harder job, and the one security teams keep tripping over.
Key points
- Security teams can now see what AI agents are doing inside company systems, but stopping them from doing the wrong thing is a separate, unsolved problem.
- Least privilege, the old rule of giving software only the access it truly needs, is proving unusually hard to apply to AI agents that behave differently every time they run.
- Vendors are trying prompt filters, identity checks and behaviour rules, and none of them work alone.
- Understanding what an agent is trying to do, not just what it did, is where the industry is heading.
- For ordinary staff, the practical lesson is simple: an AI assistant with access to your inbox or files is a user, and it needs the same kind of guardrails.
AI agents are the new interns of the corporate network. They log in, read documents, send emails, click buttons and file tickets. And like a real intern, the trouble starts the moment someone forgets to tell them what they are not allowed to touch.
For the last year, security teams have been focused on seeing these agents. Which ones exist, what accounts they use, what data they read. That visibility problem is mostly solved. The next problem, and it is a much harder one, is control.
Why is controlling an AI agent so difficult?
Because an AI agent does not behave the same way twice. A normal piece of software follows a script. Ask it the same question and it does the same thing. An AI agent decides, in the moment, how to reach a goal, and the steps can change every run.
That breaks a rule the security world has relied on for decades. It is called least privilege: give a user or a program only the access it needs to do its job, and nothing more. Easy to say when the job is fixed. Much harder when the "job" is a sentence in plain English like "sort out my calendar and reply to anything urgent."
What counts as urgent? Which inbox? Reply how? The agent decides. And every decision is a place a mistake, or an attacker, can slip in.
What are companies actually trying?
There is no single fix yet, so vendors are stacking approaches. As The Hacker News noted in a recent piece on the same problem, the industry has landed on the idea that intent, not just action, is what needs to be governed.
The main techniques in use right now fall into a few buckets.
| Approach | What it does | Where it falls short |
|---|---|---|
| Prompt filtering | Scans the instructions given to the agent and blocks risky ones | Attackers can rephrase requests to slip past filters |
| Identity controls | Treats the agent like a user account with permissions | Agents often need broad access to be useful at all |
| Behaviour monitoring | Watches what the agent does and flags anomalies | Catches problems after they happen, not before |
| Intent analysis | Tries to understand the goal behind an action | Still early, and hard to do reliably |
None of these on their own is enough. Most serious deployments now combine two or three, which is expensive and complicated, and still leaves gaps.
What does this mean for ordinary staff?
If your employer has rolled out an AI assistant that can read your email, book meetings or touch shared files, treat it as another member of staff with keys to the building. Ask who set its permissions. Ask what happens if it makes a mistake. If the honest answer is a shrug, that is worth raising.
For individuals using AI tools at home, the same logic applies at a smaller scale. An assistant connected to your Gmail or your bank can, in theory, be tricked by a cleverly worded email hidden inside another email. That trick has a name, prompt injection, and it is the AI-era version of phishing, where criminals send fake messages to get someone to hand over access.
Multi-factor authentication, the extra code or tap on your phone when you log in, helps for the human accounts these agents sit on top of. It does not help against an agent that has already been given the keys. The fix there is scope: give the agent access to one folder, not the whole drive.
Where the industry goes next
The short version: from watching to governing. Logging every agent action is table stakes now. The interesting work is happening around policies that can say, in advance, "this agent may draft an email but not send it," or "this agent may read customer records but not export them."
Getting that right is going to take years. In the meantime, the safest AI agent is still the one with the smallest possible set of permissions. Boring advice. Also correct.
