Notifications
Clear all
Topic starter
14/09/2026 10:10 am
TL;DR: The most damaging AI failures now come from agents that plan, choose tools, and execute directly against real systems, with dangerous capabilities, weak validation, and almost no execution gates in common agent stacks, according to Capsule. That shifts identity governance from prompt control to runtime authorisation, because approval loops and static least-privilege assumptions break once an agent can act faster than review.
NHIMG editorial — based on content published by Capsule: When Agents Go Rogue
By the numbers:
- In our State of AI Agent Security 2026 report, roughly one in ten of the repositories we examined hand agents genuinely dangerous capabilities such as shell execution, code evaluation, raw SQL, filesystem access.
- Among the tools with explicit definitions, 76.4% had no input validation, and almost none had a gate that could block a dangerous action before it ran.
- The Model Context Protocol concentrates the problem: 92.4% have no confirmation gate before a tool executes.
Questions worth separating out
Q: What breaks when an AI agent is allowed to call tools without strict scope controls?
A: The main failure is privilege expansion.
Q: Why do approval workflows fail as a control for rogue AI agents?
A: Approval workflows assume the reviewer can see the action, understand it, and stop it before execution.
Q: How can security teams tell whether agent access is actually under control?
A: Look for evidence that the team can trace every tool call, secret use, and cross-system action back to a named owner and a valid approval path.
Practitioner guidance
- Enforce tool-call interception at runtime Place policy checks at the moment an agent requests a tool, API, or command so the action can be denied before any system effect occurs.
- Split credentials by task and tool boundary Stop using broad shared credentials for agent workflows.
- Instrument destructive-action blocking, not just approvals Verify that your controls can block delete, write, permission-change, and exfiltration actions directly rather than relying on a person to notice the request in time.
What's in the full article
Capsule's full article covers the operational detail this post intentionally leaves for the source:
- The specific agent failure examples, including the Meta OpenClaw incident and the PocketOS database deletion.
- The reported findings on tool validation gaps, confirmation gates, and dangerous capability exposure in agent repositories.
- The argument for runtime enforcement at the tool call boundary and how the Agent Control Standard is positioned around it.
- The underlying discussion of why approval loops degrade as a governance mechanism once agents act at machine speed.
👉 Read Capsule's analysis of rogue AI agents and runtime control gaps →
Rogue AI agents and the runtime governance gap teams are missing?
Explore further
14/09/2026 10:11 am
Runtime authorisation is now the governing problem for AI agents. The article shows that the relevant failure is not whether a model is clever, but whether it can turn a decision into a side effect before a human or policy layer intervenes. That makes execution-time control the identity boundary, which is where OWASP Agentic AI Top 10 and OWASP NHI concerns converge. Practitioners need to treat the tool call as the real authorisation event.
A few things that frame the scale:
- The Model Context Protocol concentrates the problem: 92.4% have no confirmation gate before a tool executes, according to The State of Non-Human Identity Security.
- 85% of organisations lack full visibility into third-party vendors connected via OAuth apps, leaving delegated access paths poorly governed.
A question worth separating out:
Q: What is the difference between human approval and time-limited access for AI agents?
A: Human approval is a control point that requires a person to review or authorise a sensitive action. Time-limited access is a constraint that automatically expires the credential or permission after a short window. Used together, they reduce standing privilege and make agent activity easier to contain when tasks are high risk.
👉 Read our full editorial: Rogue AI agents expose the runtime gap in identity governance
