Why Locking Down What AI Agents Can Do Is Not Enough
A security firm says the real question is not what you told your AI to do. It is how far it can wander if something goes wrong.
Key points
- Zero Networks launched Least Agency Enforcement on Monday, aimed at containing AI agents that get manipulated or misconfigured.
- Nearly 80% of enterprises have already deployed internal AI agents, yet roughly two-thirds have no formal governance policies for them, according to Zero Networks' own research.
- The product restricts which systems an AI agent can communicate with at the network level, not just through software-level rules.
- Just-in-time multi-factor authentication means a human must approve certain sensitive actions in real time, even inside an automated process.
- The capability is available now and will be demonstrated publicly at Black Hat USA 2026.
Most of the conversation around making AI agents safer focuses on what you ask them to do and whether their answers are appropriate. Zero Networks thinks that framing misses the point.
So what is the actual problem?
AI agents are software programs that can take actions on their own, like booking meetings or running business processes, without a human clicking every button. That independence is the feature. It is also the exposure.
Prompt injection is the attack: a hidden instruction hijacks what the AI thinks it was told to do. Once that happens, or once an agent is simply misconfigured, the question stops being "what did we ask it to do" and becomes "how much of our internal network can it now reach?"
In a lot of organisations right now, the honest answer is: quite a lot.
"If an agent gets fooled or misused, it should hit a wall almost immediately, not wander around the network looking for something valuable," said Benny Lakunishok, CEO of Zero Networks, in a press release issued ahead of Monday's announcement.
What does this product actually do?
Least Agency Enforcement maps which systems a given AI agent is supposed to talk to, then enforces that boundary at the host firewall, the point where traffic enters and leaves a machine. Everything outside that approved list is blocked by default.
The approach extends a principle called least privilege, which says any user should only access the specific tools their job requires. Zero Networks applies the same logic to software agents automatically, because agents move faster than a human admin can keep up with.
Sensitive actions get routed through MFA too. As field CTO Chris Boehm explained to CSO Online: "A compromised agent identity can't quietly use RDP or WinRM to move sideways" through a network. Both are Windows communication protocols that attackers routinely abuse. SMB, a third such protocol, is also covered.
The distinction matters. Standard identity and access management tools check whether something is allowed in at the door. Once an agent has valid credentials, those tools generally stop watching. Zero Networks claims its enforcement keeps watching, at the network layer, for the entire session. That is where our July reporting on agent containment found security teams consistently falling short.
Should ordinary employees care about this?
Yes. The failure mode here is not exotic. An agent with access to HR systems and finance workflows, because nobody mapped a tighter boundary, is a real risk the moment it gets manipulated. The post-mortem will say the agent had far more access than its job required. We made the same point on 28 July in "Your AI Safety Certificate Is Worthless the Moment the Agent Goes Live."
Staff don't need to do anything differently today. But when you're asked to approve a security policy governing which systems your company's AI tools can reach, take it seriously.
Map what your agents can touch before an incident gives you a far less pleasant reason to find out.
The vendor framing here is clean and the underlying principle is sound. What I'd watch is whether enforcement at the host firewall holds up as agent architectures get more distributed, multi-cloud, spanning Lambda functions and Cloud Run jobs that never touch a Windows host firewall at all. That's the harder problem, and Monday's announcement doesn't address it.
