When Legacy Infrastructure Becomes the Soft Underbelly of Your AI Agent Stack
Governance frameworks like NIST AI RMF and the EU AI Act assume the pipes under the model are secure. They often aren't.
AI governance is racing ahead of AI security. That gap is where attackers are setting up shop.
Roughly 71% of organizations are now piloting AI agents in production or near-production workflows, according to figures shared at this month's Gartner Security & Risk Management Summit. The governance scaffolding around those deployments — model cards, red-team exercises, acceptable-use policies — has matured quickly. The infrastructure underneath has not.
That asymmetry matters for compliance officers reading the NIST AI Risk Management Framework or mapping controls to the EU AI Act, which entered into force on 1 August 2024 with staggered obligations through August 2026. Both frameworks place heavy weight on model behavior. Neither prescribes hardening for the legacy identity stores, file shares, and service accounts that agents pull from at runtime.
Here is the practical problem. An AI agent is, by design, an over-privileged user. It reads from SharePoint. It queries databases. It calls APIs through service principals that were provisioned years ago and never rotated. When an attacker compromises a stale account or an unpatched connector, they do not need to break the model. They feed it.
Prompt injection through a poisoned document is the most-discussed vector. It is not the only one. Token theft from a legacy SSO integration, lateral movement via an agent's tool-use permissions, and exfiltration through MCP servers running on unmanaged hosts all sit outside the typical AI risk assessment.
Regulators are starting to notice. The SEC's cybersecurity disclosure rule, finalized in July 2023 under Item 1.05 of Form 8-K, requires registrants to disclose material cybersecurity incidents within four business days of a materiality determination. An incident triggered through an AI agent is still an incident. There is no carve-out. CIRCIA, the Cyber Incident Reporting for Critical Infrastructure Act, remains in proposed-rulemaking status at CISA following the comment period that closed 3 July 2024, with a final rule expected in 2025. Covered entities should assume agent-mediated breaches will fall inside its 72-hour reporting window.
What does that mean for security programs writing AI policy this quarter?
Four items worth pulling forward: inventory every service account and API key an agent can reach, not just the ones it actively uses; apply the same patch SLAs to MCP servers and vector databases that you apply to domain controllers; require that any agent action touching regulated data flow through a logged, attributable identity; and treat prompt-injection findings as security incidents under your existing IR playbook, not as model-quality bugs.
The AI Act's Article 15 obligations on accuracy, robustness and cybersecurity for high-risk systems take effect 2 August 2026. That is not far. Programs that treat the legacy plumbing as out of scope will find their AI governance binders worth less than the paper they are printed on.
