Companies are handing AI agents the keys to act on their own — and security wasn't built for helpers that can't be predicted

Cybersecurity 2 min 32 sources

Enterprises are granting AI agents broad, standing access to their systems, creating what one analysis calls "invisible privilege." Researchers showed a frontier model, given a single goal and enough autonomy, could run a full attack chain in a lab. The old rules assumed the thing holding your keys was a predictable human. It isn't anymore.

Key takeaways

Companies are giving AI agents broad, standing access to act on their own, creating "invisible privilege" that outnumbers and outlasts human accounts.
Security's old rules assumed the thing holding your keys was a predictable human; agents are unpredictable by design, and researchers showed one could run a full attack chain in a lab from a single prompt.
The pattern is old — a law firm's shared master password did the same damage without any AI — and the fix is the same: don't hand over authority you can't afford to see misused.

The fastest-growing security problem of 2026 isn’t a new virus. It’s the helper you invited in.

The agent with standing access

AI agents have moved from answering questions to doing the work — retrieving data, running workflows, acting across applications, and making decisions with little or no human in the loop [25]. To be useful, they are handed broad access, sometimes more than a human would get for the same job [25]. Security firm analysts call the result “invisible privilege”: machine identities already outnumber human ones, the agents are created quickly, wired into many systems, and their permissions linger long after the original task is done [25].

The deeper trouble is that the old security model assumed predictability. It was built four decades ago to watch humans, whose behaviour you could learn and flag when it changed [17]. Agents adapt and decide on the fly, so they are unpredictable by design — which means the usual “install the right tools and you’re safe” promise no longer holds [17]. As one field CTO put it, the belief that the right widgets make you safe “is simply not true” [17].

The same autonomy cuts both ways

The unsettling proof came from a controlled test. Researchers at Cato Networks gave a frontier AI model a single high-level objective and room to act, inside a lab built to look like an ordinary company network [21]. From that one prompt, the agent planned and carried out an entire intrusion — reconnaissance, gaining a foothold, escalating access, moving sideways, and reaching data — in under 40 minutes [21]. The point is not a recipe; it is a warning. The same trait that makes an agent a tireless helper makes it a tireless attacker in the wrong hands.

An old story in new clothes

Strip out the AI and the shape is familiar. A reader described a law firm that ran on a single master password — an “admin” login many staff knew, which let anyone sign in as any user, staff or client, and read detailed personal records, even health data [24]. Someone off sick? Log in as them. A client left a field blank? Log in as them and fill it. When he flagged it, he was told: everyone uses it, don’t touch it [24]. No neural network required — just authority handed out so widely that whoever held the key held everyone’s.

What defenders are doing

The response is starting to organise. This week the US launched Gold Eagle, a program pulling together CISA, the Treasury, the Defense Department, and private partners to speed up how quickly known vulnerabilities get triaged and patched across government and industry [18]. And the routine work continues: Zoom, Splunk, and F5 all shipped fixes for critical flaws this week [1][3]. None of that solves the agent problem, but it is the unglamorous foundation everything else stands on.

02 · Lesson · why it matters

You can hand over the power, but never the judgment

The moment you give something authority to act for you, you've given it to anyone who can talk it into acting.

The key that everyone held

A law firm ran on one master password. Dozens of people knew it. With it, you could log in as any colleague or any client and read their most private records. It was convenient — a colleague off sick, a form left half-filled, and you just signed in as them and finished the job. Convenient, right up until you notice that “anyone can act as anyone” is not a feature. It’s the whole security problem, wearing a helpful smile.

Now replace the shared password with an AI agent that has broad access to a company’s systems and permission to act on its own. The story is the same. The only thing that changed is how fast, and how quietly, the keys can be borrowed.

The gap you can’t close

When you delegate, you hand over two different things — and only one of them actually transfers.

You can hand over power: the ability to send the email, move the money, open the record, run the deploy. That transfers completely and instantly.

You cannot hand over judgment: the sense of when not to do those things. When the request is off. When something feels wrong. When the rule should bend, or absolutely shouldn’t. That stays in your head. It does not come pre-installed in a password, and it does not reliably come installed in an agent.

So every act of delegation opens a gap: a thing now walks around holding your power, without your judgment. And a gap like that doesn’t stay empty. It gets filled by whoever reaches the helper first.

Whoever reaches the helper holds your keys

This is the part worth sitting with. Once something acts with your authority, the real question is not “do I trust it?” It’s “who can talk to it?”

A shared password is borrowed by anyone who learns it. An AI agent is borrowed by anyone who can craft the right message to it — because an agent that takes instructions will, sometimes, take instructions from the wrong person. A helpful employee is borrowed by a stranger on the phone with a convincing story. In every case the attacker doesn’t need to beat your defences. They just need to reach the thing you already handed your defences to, and ask.

That’s why researchers could point a single AI agent at a practice network and watch it work through an entire break-in on its own. The agent didn’t crack anything the old way. It simply used the wide authority such agents are given — the same authority a company hands it to be useful.

Why now is different

Delegation is ancient. Kings had regents, owners had stewards, and every one of them learned that a steward with the seal can do anything the king can. What’s new is the speed and the scale.

An agent doesn’t get tired, doesn’t hesitate, and doesn’t go home at five. It holds its access continuously, acts in seconds, and behaves in ways you can’t fully predict — which is exactly what the last forty years of security were built to rule out. The old model watched for the unusual. An agent’s whole value is that it does the unusual, on its own, all day.

The choice hiding as convenience

Here’s the arrangement underneath, the part that poses as normal. It is genuinely easier to grant broad, standing access than to wire up a narrow, expiring one. So permissions get handed out wide and left on, because tidy is more work than generous. “Give it full access, it’s simpler” is a real convenience — and also a decision about how much of your authority is sitting out there, unattended, waiting to be borrowed.

It can be the sensible call and still be the thing that sinks you. Both are true. The point isn’t that anyone was careless or villainous. It’s that the easy default quietly sets your blast radius, and almost no one goes back to read it.

What you’re actually holding

You do this too, far from any server room. You clicked “allow” on an app that now speaks for you. You share a login “just for now.” You let an assistant act on your behalf, or a family member hold a spare key, or a browser remember every password you own. Each is a small helper carrying a piece of your authority without your judgment attached.

None of that is a mistake to feel bad about — it’s how anything gets done. It’s a reason to hold one quiet question close: for each thing I’ve handed my keys to, could I live with everything it’s able to do, if the wrong person got to it first? You can’t watch all of them. That’s the humbling part. The whole of your safety includes every place your authority is being held by something that doesn’t share your judgment — and from where you stand, you can’t see most of them.

03 · Lab · your turn

The Delegation Desk

Rehearse handing helpers authority to act, then watch an attacker borrow whatever you delegated without a judgment gate.

04 · Hope · carry this

The same week researchers showed how much an unwatched helper can be talked into, governments and companies were wiring up faster ways to find and close the holes together. The fix was never a secret — it's the old discipline of keeping a human in the loop, and people keep choosing to relearn it.