The agent is a privileged user
Software that reads your systems and acts on them has the access profile of an administrator. Most organisations are not treating it like one.
Collin via UnsplashAn autonomous agent connected to a company's systems reads mail, queries databases and takes actions on behalf of a user. Described that way it is obviously a privileged account. It is rarely governed like one.
The failure mode with the most operational history is prompt injection: instructions hidden in content the agent processes, which it follows because it cannot reliably distinguish data from direction. Reporting on production incidents describes injection remaining the leading cause of agentic security failures.
The important part of the current consensus is that it cannot be fully prevented. Filtering helps, instruction hierarchies help, and neither closes the gap, because the model's usefulness depends on treating input as meaningful.
That conclusion is unwelcome and clarifying. If initial compromise is assumed rather than prevented, the design question becomes what an untrusted instruction can actually reach, which is an access control problem with a long body of practice behind it.
Vendors and standards bodies have converged on a similar stack: identity for the agent itself, least privilege on what it may touch, runtime enforcement of what it may do, behavioural monitoring, audit logging, and scrutiny of the tools it can call.
None of that is novel, which is the point. It is what service accounts have required for twenty years, applied to a new kind of account that happens to be persuadable.
The governance gap is where the risk concentrates. Surveys describe a large majority of executives confident their policies cover unauthorised agent actions, alongside a small minority of agents that reached production with security sign-off.
That gap has a familiar shape. The people deploying agents are closer to the business than to the security function, the deployment is fast and cheap, and the review process was designed for software that ships quarterly.
The most consequential control is also the least technical. Agents that can read widely should not also act widely, because a compromised reader is an information problem and a compromised actor is an incident.
Regulatory attention is arriving on its own schedule and will not settle this. The organisations that come through it well will be the ones that decided, before an incident, exactly what their agents were permitted to do without a human.