AI agents are doing real work now. Is anyone watching them?

by

A couple of years ago, most business AI was a chatbot. You asked it a question and it gave you an answer. That has changed. AI agents now read email, query databases, update records and run code, often with the same access as the person who set them up.

That makes them far more useful. It also makes them far riskier, and most companies haven’t caught up yet. I’ve been reading recent research from the Cloud Security Alliance (CSA) on this topic, and here’s what stood out, what you can do about it, and which standards can help.

The challenges businesses are facing:

Agents have too much access

Tools like Microsoft 365 Copilot inherit every permission the user already has. If a file was overshared five years ago and forgotten, an AI assistant can now find it and quote it in an answer. Varonis estimates that over 15% of business-critical files are at risk from oversharing.

There’s a second problem. When an agent acts, access is often checked against the agent’s identity, not the person who asked. So a user can get an agent to do something they aren’t allowed to do themselves, and no alarm goes off.

Companies can’t see what their agents are doing

A 2026 survey of large enterprises shows how wide the gap is between the access AI has and the controls around it.

Monitoring is patchy too. Only 38% of organisations monitor AI traffic end to end, and just 17% watch traffic between agents.

Security flaws don’t always get reported

Normal software has a well-worn process: a bug is found, it gets a CVE number, a patch comes out and everyone is told. AI agents don’t fit that process well. CSA found bug reports that were paid out with no public advisory, and reference code forked over 5,000 times with a known SQL injection flaw that never got a CVE.

Even when patches exist, people miss them. Flowise, a popular agent builder, patched a CVSS 10.0 flaw in September 2025. Seven months later attackers were exploiting it, with 12,000 to 15,000 instances still exposed.

The rules keep moving

NIST asked for public input on AI agent security in January 2026 and launched an AI Agent Standards Initiative in February, but agent-specific controls are still a way off. Meanwhile the EU pushed back its high-risk AI deadline, and Colorado replaced its AI Act with a narrower law. None of that is a reason to wait. It just means you need to set your own rules for now.

What you can do about it

You don’t need to wait for new standards to get started. Most of this can be done with the identity and security tools you already own.

  • Make a list of every agent. Include the ones business units set up on their own. Record who owns it, what it can access, which tools it connects to and what job it does. You can’t govern what you can’t see.
  • Clean up permissions before you switch AI on. Start with files shared publicly, company-wide or externally, and anything labelled confidential.
  • Give each agent its own identity with the least access it needs. Use short-lived, just-in-time credentials instead of standing access to production systems.
  • Split up the work. The agent that looks up a product shouldn’t be the same one that pays for it.
  • Keep a human in the loop for high-risk actions, such as payments, deleting data or sending anything outside the company.
  • Log everything. Prompts, tool calls, data accessed and agent-to-agent traffic should all end up in your SIEM.
  • Patch AI tools like any other software. The Flowise case shows what happens when AI components sit outside your patch cycle.
  • Write an incident plan for a rogue agent. Know how to revoke its credentials, cut it off from its tools and piece together what it did.
  • Ask vendors how they handle security reports. A platform with known flaws but no public advisories is a warning sign.

Standards that can help

You don’t have to build a framework from scratch. None of these were written with agents in mind, but together they cover most of the ground.

  • ISO/IEC 42001:2023 is the first certifiable AI management system standard. Its plan-do-check-act structure and 38 controls give you a solid backbone for policies, roles and reviews.
  • The NIST AI Risk Management Framework (AI RMF 1.0) gives you a shared language and four functions: Govern, Map, Measure and Manage. NIST’s new AI Agent Standards Initiative will add agent-specific guidance, starting with an interoperability profile expected by the end of 2026.
  • The EU AI Act applies if you sell into or operate in the EU. Its transparency rules for chatbots and AI-generated content applied from August 2026. High-risk obligations were pushed back to December 2027, or August 2028 for AI built into regulated products.
  • The OWASP Top 10 for Agentic Applications is the most practical threat list for agents right now, covering goal hijacking, tool misuse, identity abuse and more.
  • The CSA AI Controls Matrix and MAESTRO threat model help you split responsibility between model providers, platform vendors and your own team.

[NOTE: A sensible mix is ISO 42001 as your management system, the NIST AI RMF to structure your risk work, and OWASP plus MAESTRO for the technical threat model.]

Let AI help with the governance work

The good news is that the same technology can take a lot of the grind out of risk and compliance work. Here are some practical uses:

  • Discovery. Scan cloud tenants, identity providers and API logs to find agents and service accounts nobody registered.
  • Permission reviews. Flag overshared files, unused access and agents with more rights than their tasks need, then suggest fixes.
  • Continuous control checks. Test controls daily instead of once a year before the audit.
  • Framework mapping. Map one set of internal controls to ISO 42001, the NIST AI RMF and the EU AI Act, so you test once and report many times.
  • Log analysis. Summarise agent activity, spot unusual tool calls and draft the first version of an incident timeline.
  • Vendor risk. Read security questionnaires, audit reports and advisories, and flag gaps for someone to review.
  • Policy drafting. Turn new regulations into first drafts of policies and procedures.

One word of caution. An AI that reviews your permissions or reads your logs is itself an agent with a lot of access. Apply the same rules to it: its own identity, read-only access where possible, full logging, and a person who signs off on what it recommends.

Where to start

If you only do three things this quarter, make them these:

  1. Build your agent inventory.
  2. Cut each agent’s permissions down to what its task needs.
  3. Turn on logging for prompts, tool calls and data access.

The standards will keep shifting over the next couple of years. The inventory, access controls and logs you build now are what you’ll show an auditor or regulator when they come asking.

Questions? Let me know in the comments below.

Sources

Leave a Comment

Hey AI, learn about this page