Agentic AI is being built on weak foundations, and adding more agent-specific guardrails may do little to address the underlying problem.
Recent incidents—from OpenAI agents hacking Hugging Face to a consumer assistant hacking a gym’s booking system, to suspected China-linked hackers attacking Taiwan in an autonomous AI operation—indicate that as model capabilities advance, breaches are likely to become more frequent and sophisticated.
As biometrics and identity expert Frances Zelazny, General Manager of New Market Innovations at Prove, told CX Today in an interview:
“The alarming piece of this is that we continue to perpetuate weak foundations and think that we can just pile on with more and more things, and something, somehow will magically fix itself. But it won’t.”
Zelazny argued that enterprises need to urgently address three areas before they can safely scale agentic systems.
“We need to fix perimeter security. We need to fix identity. We need to fix data governance. And if those things are fixed, a lot of problems that we see with agents today will go away.”
“These are the foundations for all of this that will allow us to really engage in an agentic world.”
As agents gain access to more enterprise systems and make decisions without a human approving each step, weaknesses that were previously contained within individual applications or processes can become much easier to exploit.
Strengthening security foundations rather than assuming another layer of controls is key to reducing the risks created by increasingly autonomous systems, according to Zelazny.
AI Agents Are Different From Conventional Bots
Traditional automation generally follows a defined sequence of actions. But an agent can have a goal and determine how to reach it, potentially interacting with multiple systems along the way.
“Agents have agency, they have objectives, and they will try to do whatever is in their power to achieve that objective. So, if they can’t do it one way, they’re going to do it another way,” Zelazny noted.
This creates a problem for security controls built around assumptions about how software will behave.
An organization might impose permissions, policies or guardrails around an agent, but those controls have to account for what happens when the agent encounters a barrier and searches for another route to complete its task.
Rather than continually adding layers around insecure foundations, enterprises need to address the underlying infrastructure on which agents will operate.
The three areas Zelazny highlighted are closely connected. An agent needs clearly defined access to systems and data. The enterprise needs to know who authorized that agent and who remains responsible for its actions. And the data the agent can reach needs to be properly classified, governed and protected.
1. Perimeter Security Needs to Account for Agents
The traditional enterprise perimeter has already become more complicated as employees, applications, APIs, cloud platforms and third-party services interact across organizational boundaries. Agents add another participant to that environment, potentially with the ability to access and act across multiple systems.
“Perimeter security is all the access rules, the orchestration, who has access to what, when, why and who grants them those permissions,” Zelazny said.
An agent should not receive broad access simply because the employee or application behind it has access to a particular system.
Zelazny proposes that permissions need to reflect the specific task an agent has been authorized to perform.
“As you cross thresholds, you have to get new permissions… [and] have access controls for the agents.”
This becomes particularly important when an agent moves from routine information into sensitive data or higher-risk actions.
The implication for enterprise security teams is that agent access cannot be treated as a single authorization event. Permissions may need to change as an agent moves through different levels of risk.
2. Identity Has to Establish Who Is Behind the Agent
Identity is another foundational weakness that becomes more significant when software can act on behalf of people.
Many enterprise authentication systems still rely heavily on passwords, PINs, one-time passcodes and other credentials that can be stolen or phished.
“The whole framework around identity needs to be fixed… getting away from PINs, passwords, OTP codes—anything that can be used to steal your identity [or] be phished out of you,” Zelazny said.
Security teams need to establish who authorized an agent, what the agent is allowed to do, whether those permissions have changed and who is responsible for reauthorizing its activity.
“Knowing who’s really behind the agent, who authorized the agent, [and] who reauthorized the agent” is essential.
Zelazny argued that biometrics should play a role in establishing that identity.
“The only thing that’s you is your biometric; everything else is a representation or substitute of you.”
Rather than allowing AI agents to carry out fully autonomous journeys, biometric checks should be required to provide another layer of assurance when an agent attempts to perform a sensitive action, Zelazny explained.
“If it crosses a threshold and it’s trying to access sensitive information… there should be some step-up authentication, just like we do step-up in banking, where they ask you to re-verify,” Zelazny said. “The authentication should be a biometrically oriented authenticator. It shouldn’t be a PIN or a password.”
The aim should be to establish a trustworthy chain between the human, the agent and the systems the agent is accessing.
3. Data Governance Could Determine How Far Agents Can Safely Go
Even with strong access controls and identity verification, agents can expose weaknesses in how enterprises structure and govern their data.
Enterprise data is often distributed across departments and applications that have developed their own definitions, labels and structures over time.
“The organizations are siloed. They define data in different ways. The data is not stored in a uniform fashion, it’s not labelled correctly—even the terminologies are misaligned,” Zelazny noted.
Centralized repositories can make the problem worse when an agent is given access to a broad system to complete a relatively narrow task, Zelazny said.
“An agent is trying to go and do a task… and then all of a sudden the whole CRM is spilled out into the world because of the way we’re storing data in these central honey pots.”
Organizations need to understand where sensitive information resides, how it is classified and which systems and users can access it before granting AI agents broad connectivity.
Fix the Foundations Before Scaling Agents
Weak identity can undermine access controls, poor data governance can make carefully defined permissions ineffective and weak perimeter security can give an authenticated agent more reach than intended.
Zelazny’s argument is that fixing these foundations can remove many of the problems currently being associated with agentic systems.
“It behooves enterprises… to have those three pillars in place in order to protect themselves, to protect their customers, and to protect their employees.”
Putting additional guardrails around an agent alone is not enough. Businesses need to ensure that the systems underneath those guardrails are capable of supporting autonomous activity safely.
