Why Locking Down What AI Agents Can Do Is Not Enough

Key points

• Zero Networks launched a product called Least Agency Enforcement on Monday, aimed at containing AI agents that get manipulated or misconfigured.
• Nearly 80% of enterprises have already deployed internal AI agents, yet roughly two-thirds have no formal rules governing them, according to Zero Networks' own research.
• The product restricts which computer systems an AI agent can communicate with, at the network level, rather than relying solely on software-level rules.
• It uses just-in-time multi-factor authentication (MFA), meaning a human must approve certain sensitive actions in real time, even for an automated process.
• The capability is available now and will be shown publicly at Black Hat USA 2026.

Most of the conversation around making AI agents safer focuses on what you ask them to do and whether their answers are appropriate. Zero Networks thinks that framing misses the point.

So what is the actual problem?

AI agents are software programs that can take actions on their own, like booking meetings, querying databases, or running business processes, without a human clicking every button. That independence is the feature. It is also the exposure.

If a criminal tricks one of those agents through a technique called prompt injection (where a hidden instruction hijacks what the AI thinks it was told to do), or if the agent is simply misconfigured, the question stops being "what did we ask it to do" and becomes "how much of our internal network can it now reach?"

In a lot of organisations right now, the honest answer is: quite a lot.

"If an agent gets fooled or misused, it should hit a wall almost immediately, not wander around the network looking for something valuable," said Benny Lakunishok, CEO and co-founder of Zero Networks.

What does this product actually do?

Least Agency Enforcement maps out exactly which systems a given AI agent is supposed to talk to, then enforces that boundary at the host firewall level, the point where traffic enters and leaves a computer. Everything outside that approved list is blocked by default.

The approach borrows from a well-established security principle called least privilege, which says humans should only have access to the specific tools they need for their job, nothing extra. Zero Networks is applying that same logic to software agents.

The company also routes sensitive actions through MFA, so a specific network protocol (the communication language two computers use) cannot be used silently even if an agent's identity has already been authenticated. As field CTO Chris Boehm put it, as first reported by CSO Online: "A compromised agent identity can't quietly use RDP, SMB, or WinRM to move sideways" through a network. Those three are common Windows communication protocols that attackers frequently abuse.

The distinction the company draws is worth understanding. Standard identity and access management tools (software that checks whether someone or something is allowed in at all) mostly answer the question at the door. Once an agent has valid credentials and the door is open, those tools generally stop watching. Least Agency Enforcement claims to keep watching, at the network layer, for the entire session.

Should ordinary employees care about this?

If your organisation uses AI tools for internal tasks, this matters. The failure mode here is not exotic. An agent that has access to HR systems, finance workflows, and internal email, because nobody ever mapped out a tighter boundary, is a meaningful risk if it gets manipulated. One thing the post-mortem will say is that the agent had far more access than its actual job required.

In practice, staff do not need to do anything differently today. But if you are asked to approve a security policy governing which systems your company's AI tools can access, that is a prompt worth taking seriously.

The operational takeaway: map what your agents can reach before an incident gives you a much less pleasant reason to find out.