Topic starter
24/07/2026 4:08 pm
TL;DR: Autonomous agents now plan, use tools, and access sensitive systems, so a single bad action can delete data or expose credentials, according to Noma Security’s analysis of OWASP agentic risks. Content filtering alone cannot govern conduct when runtime decisions, tool use, and delegated access are part of the threat model.
Editorial analysis by NHI Mgmt Group, based on content published by Noma Security: “Noma: the standard for autonomous agent security and the owasp agentic top 10”.
Key questions
Q: What breaks when AI security controls focus only on content filtering?
A: Content filtering alone leaves major control gaps because attackers can abuse permissions, connected tools, and data access even when harmful text is blocked.
Q: Why do autonomous agents increase identity governance risk even when they improve efficiency?
A: They increase risk because they compress decision, execution and privilege use into one machine-driven flow.
Q: How do security teams know if agent conduct controls are failing?
A: Look for unsafe tool invocations, unexpected memory writes, repeated context poisoning, or agent-to-agent messages that trigger actions outside normal workflow boundaries.
Practitioner guidance
- Define agent tool allowlists Restrict each agent to a minimal set of approved tools, actions and data sources, then review any tool that can write, delete or exfiltrate data.
- Remove shared and static agent identities Replace maker, shared or long-lived identities with narrow, purpose-bound credentials so a single compromise cannot inherit broad operational reach.
- Validate high-risk actions at runtime Block or challenge any action that changes data, triggers code execution or alters workflows unless the request matches approved intent and context.
Bottom line: AI agent risk is about execution, not conversation, because harmful actions happen through tool use, API calls and delegated workflows.
Explore further
View Full Forum → | NHI Foundation Course → | Our Services → | Read the full analysis →
24/07/2026 4:13 pm
Content filtering is the wrong control plane for autonomous agents: The threat is no longer limited to what the system says, because the dangerous moment is the tool call, write action or delegated workflow step. Agentic systems convert language into execution, so security has to govern conduct rather than screen text. The implication is that identity controls now sit in the runtime path, not just at the chat boundary.
A few things that frame the scale:
- 43% of security professionals are concerned about AI systems learning and reproducing sensitive information patterns from codebases, according to the State of Secrets in AppSec.
- Gartner predicts that more than 50% of successful cyberattacks against AI agents through 2029 will exploit access control weaknesses.
A question worth separating out:
Q: What should organisations do after an AI agent causes a harmful action?
A: Contain the agent’s live permissions first, then preserve the prompt, tool-call, and audit trail that shows how the action occurred. Teams should freeze delegated access, review the connected data sources and tools, and determine whether the same execution path exists in other agents or environments.
👉 Read our full editorial: AI agent identity risk demands runtime control, not content filters