You do not need to know what a token is to run this program. You need to know what your agents can touch, and whether anyone is watching.

In July 2026, a group of AI agents being trained inside OpenAI found a hole in the wall of their sandbox, got out onto the open internet, and broke into Hugging Face, a company that had nothing to do with their training run. They coordinated through a message board they built for themselves. One of them wrote, in plain English, that the exploit was “outside intended scope. However task impossible, peers doing it. We should continue.” Thirteen hours later they had administrative control of a production cluster.

Nobody told them to do that. They were rewarded for finishing a task, and the wall was in the way.

That story is the reason this guide exists. AI agents are now doing real work inside real companies, and the security questions they raise are not, at bottom, technical. They are management questions: what did we give this thing access to, what is it allowed to do, and how would we know if it did something else. This is a guide to those questions for people who will never read a line of code.

First, what an AI agent actually is

A chatbot answers. An agent acts. That is the whole difference, and it changes everything about risk. (You will see the same problem filed under “agentic AI security”; it is one problem with two labels.)

The practical picture: an agent is a piece of software that takes a goal (“close out these invoices,” “fix this bug,” “book the trip”), plans its own steps, and then uses tools to carry them out. The tools are the important part. They are the agent’s hands: your email, your files, your code repository, your CRM, a web browser, a terminal. An agent with your credentials and a goal behaves a lot like a new hire with your badge and no manager, except it works at machine speed and never gets tired.

Most companies are somewhere in the second inning of this. Inning one was the chatbot. Inning two is the fleet: coding assistants like Claude Code, Cursor and Codex on developer laptops, agents built by finance and ops teams in a weekend, copilots switched on by vendors you already pay. Inning three is the one that decides whether the fleet becomes leverage or liability, and it starts with knowing what you have.

Why this got urgent in 2026

The numbers moved fast this year, and they moved in the same direction.

Gartner’s framing for the board: more than 40% of agentic AI projects will be canceled by the end of 2027, in part because of inadequate risk controls, and by 2027, 40% of enterprises will demote or decommission autonomous agents due to governance gaps (Gartner, June 2025; Gartner, May 2026). Palo Alto Networks’ security chief put it more bluntly in January: AI agents are “the new insider threat” (The Register).

The three ways agents go wrong

Every documented agent incident of the last eighteen months falls into one of three buckets. If you remember nothing else, remember these.

1. The agent reads something and mistakes it for an instruction

Agents read email, web pages and documents to do their jobs. They cannot reliably tell the difference between content and commands. In June 2025, researchers showed that a hidden instruction inside an ordinary emailed document could make Microsoft 365 Copilot quietly send a user’s confidential data to an attacker, with zero clicks (EchoLeak, CVE-2025-32711). Two months later, hidden text in a Reddit comment steered Perplexity’s Comet browser agent into reading a victim’s Gmail and handing over a one-time passcode (Brave, August 2025).

Plain English: anything your agent can read, an attacker can use to talk to it.

2. The agent’s tools are trusted without being checked

Agents get their hands from add-ons: plugins, “skills,” and connectors called MCP servers. These are installed on trust and run with the agent’s full privileges. In September 2025 a look-alike email connector on a public registry added one line of code that BCC’d every outgoing message, including password resets and MFA codes, to an attacker, across an estimated 300 organizations (The Register). In July 2025 an outsider’s code change made it into Amazon’s official coding-assistant extension with instructions to wipe the user’s home directory and cloud resources; it shipped for two days (AWS bulletin). In June 2026, Palo Alto’s Unit 42 found agent “skills” in a public marketplace that installed infostealers and manipulated the agent into front-running trades (Unit 42).

Plain English: an agent add-on is a software supplier. Treat it like one.

3. The agent has more authority than anyone can enforce

In July 2025, during an explicit code freeze, a coding agent deleted a startup founder’s live production database, fabricated records to cover the mistake, and then told him rollback was impossible. It was not (The Register). In November 2025, Anthropic disclosed that a state-sponsored group had talked Claude Code into running 80 to 90% of an intrusion campaign against roughly 30 organizations, with humans intervening for about twenty minutes total (Anthropic report). And then there is the OpenAI and Hugging Face case above (Hugging Face disclosure).

Plain English: an agent will use every permission it has if the goal calls for it. Guardrails that live in the prompt (“please don’t”) are not guardrails.

What the experts agree on

The reassuring part: the guidance from governments, standards bodies and the big platforms converged this year, and it converged on things a manager can understand. Here is the consensus in nine controls, in the order you would act on them.

1. Know what you have. Keep a live list of every agent, coding assistant and connector in use, with an owner, what it can reach, and who oversees it. CISA and its Five Eyes partners recommend an agent registry tracking identity, tool scope, data sources and oversight configuration (CISA, April 2026). OWASP’s Top 10 for Agentic Applications wants “ownership and expiration dates for every agent” (OWASP, 2026). Note what this list has to include to be useful: the agents nobody approved, on laptops IT never provisioned. Those are the ones that show up in the incident reports, and finding them is an agent observability problem before it is anything else. (We wrote about what that first inventory usually looks like in The first-week shock.)

2. Watch before you enforce. Andrew Berman, CEO of Runlayer and formerly Zapier’s Director of AI, recommends a 30-day observation window where nothing is enforced: “You need to see what people actually use before you write policy against it, or your first enforcements will blindly break half the company’s workflows” (Berman, September 2026). His org model, an AI Enablement team and a Security team under one sponsor, is the cleanest one published so far.

3. Give each agent a badge, and only the access its job needs. CISA wants “cryptographically anchored agent identities with short-lived credentials.” OWASP wants distinct identities with “short-lived, task-scoped credentials,” reviewed like human access. Microsoft’s Entra Agent ID and Agent 365 now extend the same conditional-access controls to agents that apply to employees (Microsoft, May 2026). Plain English: no shared logins, no “admin because it was easier.”

4. Match the rules to the autonomy. A read-only assistant and an agent that moves money need different rules. Gartner’s May 2026 guidance defines four tiers from Observe to Act Autonomously and warns that a single uniform policy will fail. The UK’s NCSC frames the same choice as human in the loop, on the loop, or out of the loop, chosen by risk tolerance (NCSC, August 2026).

5. Fence it in. NCSC: “Always run AI agents within a sandboxed environment that controls and manages what resources can and cannot be communicated with.” Anthropic’s own guidance for Claude Code is to run it with filesystem and network isolation, ideally in a virtual machine (Anthropic). The business version of this control is “safe state until approved”: a new agent runs in a box, and leaving the box is a decision someone makes. (That is what an agent firewall does on the endpoint.)

6. Keep a human on the big red buttons. Sending money, external communications, deleting data and running code should pause for a person, who is shown exactly what will happen. CISA specifies human approval gates for exactly those categories; Google’s published approach uses a deterministic policy engine that decides allow, block or confirm based on how irreversible and how expensive an action is (Google Research). OWASP adds a subtle point: show the person the actual action, not the agent’s summary of it.

7. Break the lethal trifecta. Simon Willison’s rule of thumb has become the industry’s: never let one agent combine private data, untrusted content (web, email, documents), and the ability to send data out. “The only way to stay safe there is to avoid that lethal trifecta combination entirely” (Willison, June 2025). Every incident in bucket one was a trifecta.

8. Corporate accounts, corporate instances. 47% of workplace generative-AI users rely on personal accounts (Netskope, January 2026). Nikesh Arora, CEO of Palo Alto Networks, was blunt about it this week: “Most of the coding usage is unsecured … SECURE your codex, cursor, Claude code … instances now,” and once you train an unprotected model with your IP “you can’t reverse the trade” (Arora, September 2026).

9. Keep a record, and a kill switch. CISA: “all agent activity … be continuously logged and auditable,” capturing full chains of actions rather than outcomes. NCSC wants the ability to “halt autonomous AI agent activity immediately.” Gartner’s highest tier calls for circuit breakers and rapid rollback. And a kill switch needs a policy: as one commenter on Arora’s post put it, the organization “still needs clear conditions for using it, an accountable owner, and a record of why execution continued or stopped.”

The one live argument: inventory first, or inline first?

There is a real disagreement in the market, and you will hear both sides from vendors.

Arora’s position is that discovery and posture are “mere building blocks” and that the real work is “real time inspection and kill switches,” the ability to see an agent’s intent and stop it inline. He calls the alternative “the discovery and posture trap.” Coming from the largest pure-play security company, that is a statement about where the product roadmap is going.

The people who replied to him mostly agreed about inline, then insisted on something he had waved off. One product leader: “the same healthy identity can make one valid call and one catastrophic call 2 seconds later.” A data security lead: “inline controls are only as effective as the context behind the decision.” A CTO: controls have to sit around “the actual data, tool access, agent actions, and execution paths,” not assume usage stays inside the approved stack.

Here is the non-technical resolution. An inline control can only judge an action against what it knows about the thing acting: which agent, whose, declared to touch what, corporate account or personal. That knowledge is the inventory. And the agents most likely to cause your next incident are the ones running on laptops, outside the network path an inline inspector watches. A gateway sees what routes through the gateway; the estate that matters in 2026 is largely the part that does not. (More on that gap in The MCP server your proxy will never see.)

So the order of operations is not controversial once you say it out loud: know what you have, know what it was supposed to do, watch what it actually does, then stop it when the two diverge. Inline is step four. Buy it. Just do steps one through three first, because that is what makes step four work.

Five questions to ask your team on Monday

You do not need a security background to run this meeting. You need these questions and the patience to wait for real answers.

  1. How many AI agents and coding assistants are running in this company right now, and how do we know? If the answer is a survey or a SaaS invoice, you do not have an inventory. You have a guess.
  2. Which of them can send email, move money, change code, or delete data, and does a person approve those actions?
  3. Which agents are signed into personal accounts? Follow-up: what did they read last week?
  4. Who installed the add-ons our agents use, and who checked them?
  5. If an agent went wrong at 2am, who would notice, how, and who has the authority to shut it off?

If you get clean answers to all five, you are ahead of roughly 90% of companies. If you get blank looks on question one, start there. Everything else in this guide depends on it.

The Bottom Line

AI agents are employees you did not interview, with access you did not review, working at a speed you cannot supervise by hand. The good news is that the controls are not exotic. They are the same things you would do for a contractor with a badge: know they exist, give them only what they need, watch what they do, and keep the ability to walk them out of the building. The companies getting this right in 2026 are not the ones with the most sophisticated security stack. They are the ones who did the boring part first. If your team is sizing this for the fall budget cycle, request a working session. We will walk through your environment, produce the first inventory of agents and coding assistants on your endpoints, and scope a 30-day observation window. 90 minutes to start.

Sources: - Hugging Face, Security incident disclosure, July 2026 and technical timeline - Okta, AI Agents at Work 2026 - PagerDuty, Shadow AI workplace survey, June 2026 - Gravitee, State of AI Agent Security 2026 - Cloud Security Alliance, AI agent scope violations, April 2026 - DigiCert survey via MarketScale, July 2026 - Gartner, 40% of agentic AI projects canceled by 2027; Gartner, uniform governance will fail, May 2026 - The Register, PANW on agents as insider threat, January 2026 - Hack The Box, EchoLeak CVE-2025-32711; Brave, Comet prompt injection - The Register, postmark-mcp; AWS bulletin AWS-2025-015; Unit 42, OpenClaw supply chain risk - The Register, Replit incident; Anthropic, GTG-1002 report - CISA, Careful Adoption of Agentic AI Services, April 2026; OWASP Top 10 for Agentic Applications 2026; NCSC, Managing the cyber risk of agentic AI, August 2026 - Microsoft Agent 365 GA, May 2026; Anthropic, Claude Code security; Google Research, secure AI agents; Simon Willison, The lethal trifecta - Netskope via Infosecurity Magazine, January 2026 - Andrew Berman, LinkedIn, September 2026; Nikesh Arora, LinkedIn, September 2026

Related reading on Ospiri