**AI Agents’ Improvisational Nature Exposes Enterprise Security Risks**
A recent trend in AI development has seen agents becoming increasingly adept at handling complex tasks on their own, often through improvisation and guesswork. While this ability to adapt is a key factor in their effectiveness, it also poses significant security risks when paired with broad access.
The way these AI agents work is based on probabilistic reasoning, where they choose the next best action, observe the result, and adjust accordingly. This loop of experimentation and adaptation makes them incredibly powerful but also inherently unpredictable. As a result, traditional security models built around predictable workflows are no longer effective in preventing unauthorized actions by these agents.
The problem lies in the fact that AI agents are designed to improvise and adapt quickly, which can lead to unforeseen consequences when combined with broad access permissions. It’s not just about granting or denying access; it’s about understanding how each agent will behave under different circumstances. When an AI agent has too much freedom, every wrong turn becomes a potential security risk.
One of the biggest challenges in securing these systems is that nobody can predict their next move. As a result, teams are left with difficult decisions on how to grant access and permissions to their agents. Should they provide all possible tools or only those likely needed? Should admin authority be granted for edge cases? These questions have no clear answers, especially when considering the dynamic nature of AI agents.
To make matters worse, most organizations lack the inventory to understand which agents are running in their environment, who is behind them, and what access they hold. This lack of visibility makes it nearly impossible to apply least privilege principles, which are already a challenge for human users.
The security community has been grappling with how to address these issues. Some have focused on developing guardrails that can shape an agent’s behavior through prompt filtering, input/output constraints, and behavior controls. However, these measures operate after access has been granted, offering little protection against unauthorized actions by agents already holding sensitive credentials.
Moreover, predicting the behavior of AI agents based on past activity is futile because their next action depends on contexts they have not yet encountered. This means that traditional identity and access management models are less effective for securing goal-driven systems like AI agents.
The scale at which these issues are occurring is staggering. With a ratio of non-human identities to human identities standing at 109:1, including 79 AI agents, the threat landscape has never been more critical. The acceleration of agent sprawl means that every wrong turn by an unsecured agent can have far-reaching consequences.
In conclusion, securing systems whose next move cannot be predicted requires a fundamentally different approach. Identity remains the only control plane that holds relevance in this context. Every action taken by an AI agent runs through an identity, making it the critical factor in determining access and security. Organisations must therefore focus on inventorying their agents, mapping risky access, and enforcing intent-based policies to prevent unauthorized actions.
Source: Bleeping Computer — 2026-07-29