WHEN AI STOPS ANSWERING AND STARTS ACTING
The New Cybersecurity Problem: Who Controls the AI Agent?
President - Founder PT SYDECO Sovereign Cybersecurity & AI | We Stop API Attacks Before They Reach Systems | No Foreign Cloud
August 12, 2026
Created by Patrick HOUYOUX LL.M. - August 2026
The next cybersecurity challenge is not simply protecting AI. It is controlling what AI is allowed to do.
For years, cybersecurity professionals have been concerned about outsiders.
Attackers trying to penetrate the network. Malware attempting to establish persistence. Stolen credentials. Vulnerable applications. Compromised APIs.
Then came Zero Trust, built around a fundamental principle: trust should never be assumed simply because somebody or something is already inside the perimeter.
Today, another actor is entering our information systems: The AI agent. And unlike the traditional software applications we are accustomed to securing, an AI agent may be able to observe, interpret, decide and act.
That changes the security equation.
An AI assistant that answers a question is one thing.
An AI agent capable of accessing files, consulting databases, communicating with APIs, using tools, sending messages, executing commands or interacting with other systems is something fundamentally different.
From a cybersecurity perspective, we should therefore begin treating the AI agent for what it increasingly is: a non-human insider.
FROM AI THAT ANSWERS TO AI THAT ACTS
Traditional generative AI was relatively easy to conceptualise.
A user submitted information. The model processed it. The model generated an answer.
The security boundary was primarily around the information entering and leaving the model.
Agentic AI changes this architecture.
An agent can potentially receive an objective, determine intermediate steps, select tools, interact with external resources and perform actions intended to accomplish that objective.
NIST now explicitly describes AI agents as systems capable of autonomous actions and has launched work concerning AI-agent identity, authorization and security. In its 2026 analysis, NIST reported broad agreement among respondents that AI agents introduce novel security threats and that established cybersecurity practices, although still relevant, will have to be adapted to address them.
This distinction is essential:
Cybersecurity is no longer concerned only with:
“Can this system be attacked?”
We must also ask:
“What can this system itself do?”
AN EMPLOYEE HAS AN IDENTITY. WHAT ABOUT AN AI AGENT?
Consider how organisations manage human employees.
An employee normally receives an identity.
That identity receives certain permissions.
Those permissions depend upon the employee's function.
Accounting personnel do not necessarily have administrator privileges over cybersecurity infrastructure.
Marketing employees do not automatically receive access to confidential legal documents.
A newly recruited employee should not be able to export an entire customer database simply because that database exists inside the company.
This is ordinary access control.
But now imagine an AI agent operating across several corporate systems.
It can access email.
It can search documents.
It can query a database.
It can interact with an API.
It can generate code.
Perhaps it can execute that code.
Perhaps it can contact another service.
Perhaps it can make decisions without requiring human approval for every individual operation.
What is its identity?
What exactly is it authorised to access?
Which actions can it perform?
For how long?
Under whose authority?
And what happens if the agent is manipulated?
These are no longer theoretical governance questions. They are cybersecurity questions.
THE INSIDER DOES NOT HAVE TO BE MALICIOUS
Calling an AI agent an insider does not mean that the AI itself has malicious intentions.
That would misunderstand the problem.
A human employee does not have to be malicious to create a security incident either.
An employee can open a dangerous attachment.
Send confidential information to the wrong recipient.
Misconfigure a server.
Use an unauthorised cloud application.
Or unknowingly follow instructions provided by an attacker.
An AI agent introduces a comparable problem at machine speed and potentially at machine scale.
OWASP's work on agentic AI identifies risks including goal hijacking, tool misuse, identity and privilege abuse, memory and context poisoning, insecure agent-to-agent communication and rogue-agent behaviour.
One particularly important threat is indirect prompt injection.
An agent may consume information from a website, email, repository, document or another external source. Malicious instructions can be embedded within that information with the objective of influencing the agent's subsequent behaviour.
NIST's agent-security research specifically highlights the possibility of an attacker hijacking an agent through data it processes, potentially causing unintended actions such as disclosure of sensitive information or execution of malicious code.
The attacker may therefore no longer need to compromise the AI model itself.
The attacker may only need to manipulate what the agent sees.
THIS IS WHY “THE AI IS INSIDE OUR NETWORK” IS NOT A SECURITY ARGUMENT
YOUR AI AGENT IS AN INSIDER — TREAT IT LIKE ONE
For decades, organisations implicitly trusted many systems because they were located inside the corporate network.
Cybersecurity learned the danger of that assumption.
Zero Trust emerged partly from the recognition that location is not identity, and internal presence is not proof of legitimacy.
We should not repeat the same mistake with AI.
- An AI system should not receive unlimited access merely because the organisation owns it.
- It should not receive unlimited access because it is running locally.
- It should not receive unlimited access because its purpose is legitimate.
- And it should not receive unlimited access because somebody authenticated before activating it.
Authentication answers one question:
Who or what are you?
Authorization answers another:
What are you permitted to do?
Agentic AI makes the second question critical.
THE PRINCIPLE SHOULD BE SIMPLE
An AI agent should never receive more freedom than the task requires.
If an agent needs to read five documents, giving it access to five million documents is not convenience.
It is unnecessary exposure.
If an agent needs access to one API endpoint, unrestricted access to every corporate API creates avoidable risk.
If an agent does not need internet access, it should not have internet access.
If an operation involves sensitive data, financial transactions, security configuration, deletion of information or external communication, an organisation should determine whether explicit human approval is required before execution.
And if an agent starts behaving differently from the behaviour expected for its assigned task, the infrastructure must be capable of detecting it.
The objective is not to prevent AI from operating.
The objective is to define its operational boundaries.
ZERO TRUST MUST NOW INCLUDE NON-HUMAN INTELLIGENCE
Zero Trust is frequently summarised as “never trust, always verify.”
Agentic AI gives this principle a new dimension.
Verification cannot occur only when the agent enters the system.
Security increasingly needs to evaluate its operations continuously.
Which resources is the agent requesting?
Which service is it contacting?
What information is leaving the environment?
Is this action necessary for the assigned task?
Is the requested privilege proportionate?
Has its behaviour changed?
Is another agent asking it to perform an operation?
Should the operation require human authorization?
In other words:
- Do not simply authenticate the agent.
- Constrain the agent.
- Observe the agent.
- Segment the agent.
This is where traditional cybersecurity architecture and AI security begin to converge.
SEGMENTATION BECOMES EVEN MORE IMPORTANT
Imagine a compromised employee account in a completely flat network.
The damage can spread because the attacker can move.
Now imagine an AI agent connected to numerous applications, databases and external services under the same philosophy.
The potential attack surface multiplies.
Segmentation provides boundaries.
An agent assigned to one operational environment should not automatically be capable of reaching another.
A system that processes legal documents does not necessarily need access to financial infrastructure.
An education-related AI service does not necessarily need unrestricted communication with administrative systems.
A local analytical engine does not necessarily require permanent external connectivity.
The network architecture should reflect the actual mission of the system.
This is one of the reasons I believe AI security cannot be separated from infrastructure security.
Protecting the model alone is insufficient.
The environment in which the model is authorised to act must also be protected.
DATA SOVEREIGNTY BECOMES AN AI SECURITY QUESTION
There is another consequence.
AI agents consume information.
Often, a great deal of information.
Organisations therefore need to know not only where their data is stored but where an agent can send it.
An organisation can encrypt a database perfectly and still lose information after an authorised process decrypts it for legitimate use.
Encryption remains essential.
But encryption alone cannot answer:
“Should this information be leaving this environment at all?”
Data-loss prevention, controlled communications, local processing where appropriate, network restrictions, strong authorization and monitoring therefore become part of AI governance.
Data sovereignty is no longer simply a question of where a server is geographically located.
It increasingly concerns who — human or machine — can access information, under what authority, and where that information is permitted to travel.
WHAT THIS MEANS FOR SYDECO
At SYDECO, we did not originally develop ARCHANGEL, MiniFW-AI, SydeCloud or SST because somebody predicted today's agentic-AI discussion.
Their origins are cybersecurity.
But the architectural principles behind them are becoming increasingly relevant to this new environment.
ARCHANGEL is based upon layered protection, observation, segmentation and control of communications.
MiniFW-AI is based upon the idea that security restrictions should correspond to the environment and its operational context.
SydeCloud is based upon retaining organisational control over sensitive data and infrastructure.
SST addresses the protection of information through a different approach to cryptography and transmission security.
None of those technologies, individually, constitutes a complete answer to AI-agent security.
Nor should anyone seriously claim that one product can solve such a complex emerging problem.
But the underlying philosophy is becoming increasingly important:
- control the environment,
- limit unnecessary access,
- observe behaviour,
- protect communications and
- never grant more trust than necessary.
THE QUESTION FOR 2026
Organisations are rapidly asking:
“How can we use AI agents?”
That is understandable.
The productivity possibilities are extraordinary.
But cybersecurity professionals must simultaneously ask another question:
“Once we give an AI agent the ability to act, how do we control its authority?”
Because the next major cybersecurity problem may not begin with somebody breaking through the firewall.
It may begin with a perfectly authorised artificial intelligence, operating inside the organisation, being permitted to do something that it should never have been permitted to do.
The AI agent is becoming an insider: It is time we secured it like one.
The Sydeco Security Brief Cybersecurity intelligence, architecture and doctrine from PT SYDECO.
Aucun commentaire:
Enregistrer un commentaire