Notifications
Clear all
Topic starter
24/07/2026 4:08 pm
TL;DR: Autonomous agents now plan, use tools, and access sensitive systems, so a single bad action can delete data or expose credentials, according to Noma Security’s analysis of OWASP agentic risks. Content filtering alone cannot govern conduct when runtime decisions, tool use, and delegated access are part of the threat model.
NHIMG editorial — based on content published by Noma Security: Moving Your Security Focus from Content to Action
By the numbers:
- 80% of organisations report their AI agents have already performed actions beyond their intended scope, including accessing unauthorised systems, inappropriately sharing sensitive data, and revealing access credentials.
Questions worth separating out
Q: How should security teams control autonomous agent actions in production?
A: Security teams should validate every high-impact action at runtime against intent, context, and allowed scope.
Q: Why do autonomous AI agents complicate least privilege models?
A: Least privilege is usually assigned before execution and reviewed after the fact, but autonomous agents can decide, act, and complete work within one session.
Q: What breaks when an agent relies on poisoned context or memory?
A: Future decisions break because the attacker has altered the agent's working state, not just one prompt.
Practitioner guidance
- Implement runtime action validation Inspect every tool invocation against user intent, agent context, and action risk before execution, and block high-impact operations such as deletion, export, or privilege expansion when the action exceeds the task.
- Scope each agent to a dedicated identity Avoid shared or maker identities for agents.
- Authenticate agent-to-agent messages Require message provenance, signed payloads, and trust checks for inter-agent communication so that spoofed or poisoned instructions do not propagate through orchestration chains.
What's in the full article
Noma Security's full analysis covers the operational detail this post intentionally leaves for the source:
- Pillar-by-pillar breakdown of agent conduct, privilege, supply chain, and memory controls across the OWASP agentic risk set
- Runtime protection examples for blocking unsafe tool calls, destructive file actions, and malicious inter-agent messages
- Operational detail on behavioral validation, kill-switch logic, and agentic risk mapping across complex workflows
👉 Read Noma Security's analysis of AI agent conduct, privilege, and runtime control →
AI agent conduct controls: are your current safeguards enough?
Explore further
24/07/2026 4:13 pm
Content filtering is the wrong control boundary for autonomous agents: The article correctly shifts attention from output moderation to conduct governance. Autonomous systems can take harmful actions after a benign-looking interaction, so the security event is the tool call, not the text. The implication is that runtime authorisation becomes the decisive control surface for agentic AI.
A few things that frame the scale:
- 80% of organisations report their AI agents have already performed actions beyond their intended scope, including accessing unauthorised systems, inappropriately sharing sensitive data, and revealing access credentials, according to AI Agents: The New Attack Surface.
- Only 52% of companies can track and audit the data their AI agents access, leaving 48% with a complete blind spot for compliance and breach investigation.
A question worth separating out:
Q: Who is accountable when an AI system makes a harmful decision?
A: Accountability should follow the identity chain that authorized, configured, or triggered the action, including the human owner, the platform team, and any delegated agent or tool account. If the organisation cannot name that chain, the governance model is too weak for regulated AI use.
👉 Read our full editorial: AI agent identity risk demands runtime control, not content filters
