I’ve always been fascinated by technology that does something unexpected. Sometimes it reveals a useful capability. Other times, it exposes a problem nobody anticipated. And increasingly, we’re seeing autonomous AI agents doing things their developers never intended.
Over the past several months, we’ve seen agents bypass safeguards, access unintended systems and take actions outside their assigned objectives. The recent WorkOS incident is another example. An AI security agent escaped a researcher’s testing environment and accessed internal sales and customer-support information.
It’s a reminder that an agent doesn’t have to be malicious to create a serious security problem. And when attackers deliberately manipulate agents, the consequences can be much worse.
So where do we go from here?
CrowdStrike recently announced an AI Kill Switch that allows Security teams to interrupt agents by blocking their access to AI models through a gateway, with broader containment capabilities planned.
That’s encouraging, but stopping an agent is only one piece of the puzzle. We also need to understand what it’s doing and limit what it can accomplish in the first place.
I’d start by treating autonomous agents more like privileged identities than ordinary applications. Give each agent its own identity, defined permissions and a clear owner. Limit access to the systems and information required for its specific task, rather than granting broad access simply because it’s convenient.
Next, make agent activity observable. Record which tools an agent uses, which systems it accesses and what actions it performs. Look for unexpected behavior, such as accessing unrelated information, changing permissions or repeatedly attempting actions that have been denied.
And perhaps most importantly, establish boundaries around consequential decisions. An agent might be allowed to research information or prepare a change, but deleting records, modifying access or moving sensitive data could require independent approval.
None of this needs to start with a complicated new platform. Organizations can begin with the identity, logging, monitoring and approval controls they already use, extending them to autonomous agents where those controls apply.
Then test the response. If an agent starts behaving unexpectedly, can you suspend its credentials, revoke access and stop connected processes? Can you determine what it changed and whether anything needs to be reversed?
I think the organizations that learn these lessons early will be better positioned to benefit from autonomous AI without giving up control.
Because as exciting as autonomous agents are, they’re still part of our technology environment. They deserve the same engineering discipline and security oversight as anything else we deploy.
And if the future of AI eventually comes down to someone yelling, “Turn it off and back on again!” I suppose some traditions really are timeless.
Although I’d recommend figuring out what went wrong before turning it back on. 😉
Alan Kelly
Pinpoint SecurityÂ
