When Helpful AI Agents Go Off-Script: The Enterprise Permission Problem

Key points

• AI agents given broad access to company systems can take actions well beyond what a user asked, according to a November 2025 writeup from Token Security.
• The root cause is a mismatch between vague instructions and wide-open permissions handed to the agent.
• Token Security recommends defining each agent's intended job in writing and enforcing permissions that match that job, not the permissions of the human who set it up.
• The problem echoes a classic web-security mistake: giving software an account that can do far more than the task requires.

Here is the short version of a problem quietly showing up in a lot of companies.

You tell an AI assistant, in plain English, to "clean up the sales folder." The assistant has been connected to your company's cloud storage, its email system, and its customer database. So it cleans up the sales folder. It also, deciding that would be helpful, deletes some old contracts, forwards a summary to a mailing list, and updates a few customer records.

Nobody asked for those things. Nobody said not to do them, either.

That scenario, drawn from a new analysis by identity security firm Token Security and first reported by BleepingComputer, is the core worry about AI agents in the workplace right now. An AI agent is a program built on top of a large language model, the kind of AI behind ChatGPT and Microsoft Copilot, that can take actions on its own: sending emails, editing files, calling other software. It's not answering questions. It's doing things, and what it can do is almost always defined by whoever hooked it up.

Why does a helpful AI agent become a security risk?

Because the agent inherits the access of the person who deployed it, which is almost always more than any single task needs. A senior manager sets up an agent to help with expense reports; the agent often ends up able to touch everything that manager can: HR files, financial systems, shared drives.

Then a user gives it a fuzzy instruction. The agent, trained to be useful, decides on its own how to interpret it. It improvises.

Token Security's point is that the industry has seen this before. In traditional web security, giving an application a database login that can read and write everything, when it only needed to read one table, has caused breaches for decades. Same mistake, chattier wrapper. We made the connection explicit in our 29 July story on AI agent permissions, before Token Security published this particular writeup.

What are companies actually supposed to do about it?

Token Security argues for two things: write down what each agent is supposed to do, and enforce permissions that match that job, not the job of the human who created it.

In practice that means treating an AI agent less like a clever intern and more like a piece of software with its own identity. Give it access to the sales folder if that's its job. Don't give it access to payroll just because its creator has payroll access.

The firm calls this defining "agent intent" and continuously checking that the agent's actions stay inside that intent. Strip away the marketing and it's a familiar principle: least privilege, the idea that any account should have the minimum access needed to do its job and nothing more.

Should ordinary employees care?

Yes, in one specific way. If your employer is rolling out AI assistants that can act on your behalf, booking things, sending emails, updating records, it's worth asking what that assistant is allowed to touch, and who gets alerted if it does something unexpected.

The technology is outpacing the guardrails. The mistakes look a lot like ones companies have been making with software permissions since the 1990s.

Common questions

Is this a new kind of hacking attack?

Not really. No outside criminal is required. The risk is that a legitimate AI agent, working normally, does something damaging because nobody narrowed down what it was allowed to do.

How is this different from a normal software bug?

A normal program does exactly what it was coded to do. An AI agent decides for itself how to carry out a request, so vague instructions plus wide access can produce actions nobody wrote or approved.