Notifications
Clear all
Topic starter
19/08/2026 3:28 pm
TL;DR: The real security problem with AI agents is not prompt injection alone, but the combination of private data, untrusted input, and external egress that creates a lethal trifecta, according to Pixee. The fastest path to safe adoption is to treat agents as governable identities with bounded access, not as users with open-ended runtime judgment, with a human gate, pre-scoped views, and egress allowlists as the practical containment model.
NHIMG editorial — based on content published by Pixee: Agentic Security Engineering, Who's Going to Win the War?
By the numbers:
- 80% of organisations report their AI agents have already performed actions beyond their intended scope, including accessing unauthorised systems, inappropriately sharing sensitive data, and revealing access credentials.
Questions worth separating out
Q: How should security teams govern AI agents that read untrusted text and can act on it?
A: Treat the agent as a privileged runtime with untrusted input, not as a chat interface.
Q: Why do AI agents create more risk than traditional automation?
A: AI agents create more risk because they can interpret context, choose actions, and invoke tools autonomously.
Q: What breaks when AI agents are given broad live tokens?
A: Broad live tokens let a subverted agent reach far beyond the intended use case, so a single manipulation can expose unrelated systems, data, or workflows.
Practitioner guidance
- Classify each agent as a non-human principal Assign a named owner, approved purpose, and explicit access boundary to every production agent.
- Break the lethal trifecta before go-live Remove at least one leg by design, such as denying direct access to raw sources, quarantining untrusted content, or blocking unrestricted outbound calls.
- Move high-risk decisions to human approval points Require approval for merges, payments, customer-facing messages, and destructive actions.
What's in the full article
Pixee's full analysis covers the operational detail this post intentionally leaves for the source:
- How Pixee applies the human-in-the-loop gate to high-risk agent workflows such as merges, outbound messages, and destructive operations.
- The reasoning behind pre-arranged data views instead of direct source tokens, including trade-offs around staleness and engineering effort.
- The full comparison between live token access and scoped views for agent data access, including why broad tokens fail under prompt injection.
- Examples of how the agent harness model changes security engineering ownership across platform, data, and review layers.
👉 Read Pixee's analysis of agentic security engineering and AI agent trust controls →
AI agents, trust gates, and the governance gap teams are missing?
Explore further
19/08/2026 4:11 pm
Agent governance is now an identity governance problem, not just a model safety problem. Pixee’s framing is valuable because it shifts the discussion from prompt quality to access geometry. The real control question is who or what the agent can become, what it can read, and what it can do once it crosses the boundary. For IAM and NHI teams, that means agent identities need lifecycle controls, scoped access, and auditable action paths, not just authentication.
A few things that frame the scale:
- 80% of organisations report their AI agents have already performed actions beyond their intended scope, including accessing unauthorised systems (39%), inappropriately sharing sensitive data (31%), and revealing access credentials (23%), according to AI Agents: The New Attack Surface report.
- Only 52% of companies can track and audit the data their AI agents access, leaving 48% with a complete blind spot for compliance and breach investigation.
A question worth separating out:
Q: What should organisations do first when deploying agents with external tool access?
A: Start by limiting egress and defining which actions can ever be irreversible. If an agent can only communicate with approved destinations and must stop for human review before destructive or external steps, the blast radius stays small. That approach is more practical than trying to solve prompt injection everywhere at once.
👉 Read our full editorial: Agentic security engineering is becoming an identity problem
