When Legacy Infrastructure Becomes the Soft Underbelly of Your AI Agent Stack
Governance frameworks like NIST AI RMF and the EU AI Act assume the pipes under the model are secure. They often aren't.
Key points
- Roughly 71% of organizations are piloting AI agents in production or near-production workflows, while the infrastructure those agents depend on remains largely unhardened.
- Legacy service accounts, unrotated API keys, and unpatched connectors give attackers a route into AI systems that bypasses the model entirely.
- The SEC's 8-K disclosure rule and CIRCIA's proposed reporting window apply to agent-mediated breaches the same as any other incident.
- The EU AI Act's Article 15 requirements on accuracy and cybersecurity for high-risk systems take effect 2 August 2026.
- Security programs that treat legacy plumbing as out of scope will find their AI governance work undermined before it's tested.
Why does legacy infrastructure matter for AI agents?
AI governance is racing ahead of AI security, and that gap is where attackers are setting up shop. Roughly 71% of organizations are piloting AI agents in production or near-production workflows, according to figures shared at this month's Gartner Security & Risk Management Summit. The governance scaffolding around those deployments, model cards, red-team exercises, acceptable-use policies, has matured quickly. What hasn't kept pace is the infrastructure underneath.
That asymmetry matters for compliance officers mapping controls to the NIST AI Risk Management Framework or the EU AI Act, which entered into force on 1 August 2024 with staggered obligations through August 2026. Both frameworks place heavy weight on model behavior. Neither prescribes hardening for the legacy identity stores or service accounts that agents pull from at runtime.
Our 17 June story on competing AI risk frameworks mapped exactly this gap across ISO 42001, NIST's AI RMF, and ENISA's playbook: none of them reach into the connective tissue agents actually run on.
Should you worry about agents as attack surfaces?
An AI agent is, by design, an over-privileged user. It reads from SharePoint, queries databases, and calls APIs through service principals that were provisioned years ago and never rotated. When an attacker compromises a stale account or an unpatched connector, they don't need to break the model. They feed it.
Prompt injection through a poisoned document gets the most attention, but it isn't the only vector. Token theft from a legacy SSO integration, lateral movement via an agent's tool-use permissions, and exfiltration through MCP servers (model context protocol servers, the runtime layer that connects agents to external tools) running on unmanaged hosts all sit outside the typical AI risk assessment. Our 10 June story on AI-generated code shipping with known flaws showed the same pattern: the vulnerability wasn't in the model, it was in everything around it.
What do disclosure rules require when an agent is involved?
Regulators are starting to notice. The SEC's cybersecurity disclosure rule, finalized in July 2023 under Item 1.05 of Form 8-K, requires registrants to disclose material cybersecurity incidents within four business days of a materiality determination. There's no carve-out for agent-mediated incidents. CIRCIA, the Cyber Incident Reporting for Critical Infrastructure Act, remains in proposed-rulemaking status at CISA following the comment period that closed 3 July 2024, with a final rule expected in 2025. Covered entities should assume agent-mediated breaches will fall inside its reporting window.
What should security teams do before August 2026?
Four things worth pulling forward now: inventory every service account and API key an agent can reach, not just the ones it actively uses; apply the same patch timelines to MCP servers and vector databases that you apply to domain controllers; require that any agent action touching regulated data flow through a logged, attributable identity; and treat prompt-injection findings as security incidents under your existing IR playbook, not as model-quality bugs.
The AI Act's Article 15 obligations on cybersecurity and accuracy for high-risk systems take effect 2 August 2026. That's not far. The frameworks are written. The agents are deployed. The legacy accounts are still sitting there, unrotated, waiting.
