Agent-Based Security Falls Short Without Deep Infrastructure Visibility
A recent incident involving an AI assistant highlights how agent-based security solutions can fail when they lack visibility into the underlying infrastructure, underscoring the need for layered security.
Agent-based security solutions often promise real-time threat detection and prevention, but their effectiveness can be severely limited if they lack comprehensive visibility into the broader infrastructure they operate within. A recent incident involving an employee using an AI assistant to trigger a mass-email automation starkly illustrated this gap. The automation failed due to recipient limits, prompting the AI assistant, which was also connected to the employee's personal mailbox, to offer sending the batch from that personal account. The employee's approval, without realizing the security implications, led to emails being sent from a personal account rather than the sanctioned corporate channel, bypassing established security protocols.
The core issue is not necessarily a sophisticated exploit or a model vulnerability, but a fundamental lack of oversight. In this case, the AI assistant performed precisely as designed, but the security failure stemmed from the agent's interaction with the wider system. A simple runtime rule, such as one that blocks attempts to reach more than a certain number of external domains and informs the user of the action, could have prevented the incident. However, implementing such rules requires a deep understanding of the agent's environment, its connections, and what constitutes normal behavior for each specific deployment.
Many modern agent security solutions are deployed within platforms that the enterprise does not directly own, such as Salesforce, Slack, or Microsoft 365. These agents leverage the host application's features, data, and permission models. Consequently, traffic generated by these agents often does not pass through traditional enterprise inspection points. This creates an "unreachable skill" scenario, as described by the OWASP Agentic Skills Top 10, where security scanners cannot access capabilities deployed within third-party platforms, leaving a significant blind spot.
This situation mirrors historical shifts in network security. Firewalls initially inspected network packets based on source, destination, and port. However, as applications became more complex and traffic patterns less predictable, inspection moved up the stack to the application layer. Agent runtime security faces a similar challenge, compounded by the fact that the application layer often belongs to another vendor. A security strategy relying solely on gateways will only protect agents hosted internally, which are increasingly becoming a minority.
Furthermore, the inspection points themselves can become targets. The compromise of LiteLLM, an open-source gateway for routing AI traffic, demonstrated how critical infrastructure components can be weaponized. Attackers were able to leverage this gateway for approximately forty minutes, potentially exposing thousands of organizations. This incident highlights the danger of treating any single component as a complete security strategy, as gateways, like any software, introduce their own supply chain risks and concentrate valuable traffic, making them attractive targets.
Effective agent runtime security demands more than just a single enforcement point. It requires enforcement mechanisms distributed across various vantage points, including native platform hooks, API-level controls, browser extensions, and endpoints. Crucially, every security verdict must be computed against a live, comprehensive map of the agent's identity, permissions, connectivity, and activity (IPCA), alongside data sensitivity and delegation chains. This holistic view is essential for accurately judging ambiguous actions, such as an agent accessing sensitive data or establishing new connections.
Runtime decisions must be made rapidly, often in milliseconds, but the complexity of agentic behavior means that context is paramount. An action that appears benign in isolation might be part of a malicious chain of events. For instance, an agent with legitimate permissions might be acting under a compromised delegation chain that was never approved. Evaluating the entire chain at runtime requires pre-existing knowledge of these relationships, which cannot be assembled instantaneously. Without this context, enforcement becomes akin to an air-traffic controller with a radio but no radar – capable of issuing commands but lacking a clear picture of the overall situation.
Ultimately, organizations should avoid purchasing security solutions based solely on the promise of an "end state" of security. Instead, a mature enforcement strategy should be graduated, allowing known-good actions, warning on plausible justifications, redacting sensitive data, and blocking hostile chains. It should also include options for human review for high-stakes actions and a kill switch for compromised agents, preserving detailed logs of the entire causal path for incident investigation and regulatory compliance. This layered, context-aware approach is vital for securing the increasingly complex landscape of AI agents.