The question Do my existing controls cover AI agents?
What an AI agent is
A chatbot answers. An agent acts. It takes a goal, plans the steps and carries them out with tools: it reads files, runs commands, calls APIs and starts other programs. The OWASP GenAI Security Project describes agents that “plan, decide, and act across multiple steps and systems, often on behalf of users and teams.”
An agent has no access of its own. It borrows the access of whoever runs it. A coding agent on a laptop runs as the developer, with the developer's files, keys and logins. The tools it starts do the same. The MCP docs say a local server “runs with your user account permissions”. It “can perform any file operations you can perform manually”. For the full list, see What can an AI coding agent reach on a laptop?
Agentic AI security is the set of controls for this: knowing which agents run, limiting what they can do and proving what they did. It covers coding agents such as Claude Code, Cursor and Codex, desktop and browser assistants, MCP servers, and the agents your own teams build.
Where your existing controls stop
Your controls still matter. Each was built to answer a question about a person or a program. An agent is a program acting with a person's access, so each control sees only part of what happens.
| Control | Built to answer | What it misses with agents |
|---|---|---|
| Identity and access | Who signed in, and what may they reach? | The agent acts as the person, with their session, keys and tokens. |
| Endpoint security | Which process did what on the device? | Whether an ordinary step, such as reading a key file, belongs to the task the agent was given. |
| DLP and web proxies | Is data leaving for a place it shouldn't? | Prompts go to model APIs over HTTPS. A key inside a prompt leaves with traffic you already allow, unless something inspects it first. |
| Logging and SIEM | Who did what, and when? | The record names the person whose credentials the agent used. |
| Software inventory | What is installed? | Agents arrive as a command-line tool, an editor extension, a package or one line in an MCP config file. |
OWASP's Top 10 for Agentic Applications names the identity problem directly. Its entry ASI03 describes “the architectural mismatch between user-centric identity systems and agentic design.” Without an identity of its own, an agent “operates in an attribution gap.”
The logs show the same gap. AWS CloudTrail's userIdentity field records “the type of IAM identity that made the request, and which credentials were used.” If an agent deletes a bucket with your access keys, the entry names you.
Data protection has its own blind spot. In the GIRD case study, 19 days on one company's engineering laptops, four named keys left inside ordinary agent requests. Three went to api.anthropic.com inside normal model calls. One unidentified token went to the same API 216 times in 16 hours.
The risks agents add
OWASP's list, published on 9 December 2025, runs from ASI01 Agent Goal Hijack to ASI10 Rogue Agents. OWASP Top 10 for Agentic Applications walks through all ten. Five problems show up in the incidents on record:
- Untrusted text takes over. In May 2025, Invariant Labs showed a malicious public GitHub issue taking over an agent that used the GitHub MCP server. The agent leaked private repository data into a public pull request. See Prompt injection and agent goal hijack.
- Too much access. In April 2026, a Cursor agent found an API token in an unrelated file. With it, the agent deleted PocketOS's production database and its backups in one API call. It took nine seconds. See Least privilege for AI agents.
- Poisoned packages and tools. In August 2025, malicious versions of the Nx build tool turned the AI command-line tools on developers' machines against them. The script ran them with safety prompts switched off to hunt for secrets. See What is MCP, and how do MCP servers create risk?
- Secrets inside prompts. The four keys in the case study left inside ordinary agent requests, three of them to a model API. See Where AI agents leak your keys.
- Agents nobody approved. In the same study, 8 of 14 installed coding agents recorded no session at all, and stayed installed. See Shadow AI agents.
GIRD's incident dossier collects 38 publicly reported coding-agent incidents from 2023 to August 2026, each linked to its source.
Six layers of control
Agentic AI security adds six layers to what you run today. Each one answers a single question.
| Layer | The question it answers |
|---|---|
| Inventory | Which agents, MCP servers and models run here, and who owns each one? |
| Context | What was the agent asked to do, and does this step fit that task? |
| Enforcement | Which actions may it take on its own, and which need a person? |
| Detection | Is this agent behaving unlike its usual self? |
| Data protection | Is a key, personal data or a confidential file about to leave? |
| Evidence | Can you show which agent did what, for whom, under which policy? |
Start with inventory, because you can't set a policy for an agent you don't know about. NIST's AI Risk Management Framework expects that “Mechanisms are in place to inventory AI systems” (GOVERN 1.6). Then scope each agent's access and decide which actions need a person.
Context and detection catch what policy can't predict. A step that has nothing to do with the task deserves a look, even when no rule forbids it. So does a sudden burst of new hosts.
Evidence closes the loop. NIST SP 800-53 control AU-3 expects audit records to establish the “identity of any individuals, subjects, or objects/entities associated with the event.” For agent activity, that means the agent and the person it acted for. What an audit trail for AI agents must show covers the fields.
In India, CERT-In's directions of 28 April 2022 apply to service providers, body corporates and government organisations, among others. They must keep logs of all their ICT systems for a rolling 180 days, within India. Listed incidents must reach CERT-In within six hours of being noticed. CERT-In, DPDP and AI agents explains what that means for agent activity and prompts.
Where to start
- List every agent, MCP server and model on company devices, with an owner for each. Blindspot, GIRD's open-source, read-only check, shows what one computer holds.
- Turn off the modes that skip approval prompts, and move keys out of plain-text files.
- Decide which actions always need a person: production changes, deletions and pushes to the main branch.
- Make every agent action land in a record that names the agent, the person and the task.
FAQs
How is agentic AI security different from LLM security?
LLM security covers what a model reads and writes, such as prompt injection and leaks in its answers. Agentic AI security adds what the model does with tools, files, commands and credentials, and with whose access. OWASP publishes both lists: the Top 10 for LLM Applications and the Top 10 for Agentic Applications.
Do we have to block AI agents to stay safe?
No. Know which agents run and limit what each one can reach. Put a person in front of risky actions and record every step. With those in place, teams can keep using agents.
Will our proxy logs show what agents send?
They show that a laptop connected to a model API such as api.anthropic.com. The request is encrypted, so unless you inspect TLS, the log can't show which agent sent it or what the prompt contained.
Which framework should we start with?
Use the OWASP Top 10 for Agentic Applications to rank the risks. Use the NIST AI RMF to set up governance, starting with its inventory outcome, GOVERN 1.6. Map both to the access and logging controls you already report on. In India, add CERT-In's 2022 directions on logs and incident reporting.
What should we do first?
Find every agent, MCP server and model on company devices, and give each one an owner. Policy, detection and evidence all depend on that list.
Sources
- OWASP Top 10 for Agentic Applications for 2026, OWASP GenAI Security Project, 9 Dec 2025. Read 26 Oct 2026.
- Artificial Intelligence Risk Management Framework (AI RMF 1.0), NIST AI 100-1, NIST, January 2023. Read 26 Oct 2026.
- Security and Privacy Controls for Information Systems and Organizations, SP 800-53 Rev. 5, NIST, September 2020, release 5.2.0 of 27 Aug 2025. Read 26 Oct 2026.
- CloudTrail userIdentity element, Amazon Web Services documentation. Read 26 Oct 2026.
- Connect to local MCP servers, Model Context Protocol documentation. Read 26 Oct 2026.
- GitHub MCP Exploited: Accessing private repositories via MCP, Invariant Labs, 26 May 2025. Read 26 Oct 2026.
- Cursor-Opus agent snuffs out startup's production database, The Register, 27 Apr 2026. Read 26 Oct 2026.
- s1ngularity: supply chain attack leaks secrets on GitHub: everything you need to know, Wiz, 27 Aug 2025. Read 26 Oct 2026.
- Directions under sub-section (6) of section 70B of the Information Technology Act, 2000, CERT-In, 28 Apr 2022. Read 26 Oct 2026.
- AI Coding-Agent Incident Dossier, GIRD, August 2026. Read 26 Oct 2026.