Uncover Critical Risks. Stop Breaches.

Generative AI is evolving from answering questions to AI Agents that can autonomously access systems, use applications, and execute workflows. As AI shifts from providing answers to taking action, it also introduces greater cybersecurity risks. This makes AI Governance increasingly important. It establishes policies, responsibilities, and risk controls to ensure AI is used securely and in compliance with organizational and regulatory requirements, covering areas such as data, access permissions, security controls, monitoring, and auditing. Before deploying AI Agents, enterprises should assess not only their capabilities, but also three key questions: What data can they access? What permissions do they have? Is their operating environment secure? How Are AI Agents Different from Generative AI? Traditional generative AI typically receives a prompt from a user and generates text, code, or other content in response. AI Agents, however, can go a step further by connecting to internal enterprise systems, browsers, APIs, and other tools, allowing them to autonomously plan and execute tasks based on defined objectives. This means that AI Agent risks are not limited to the AI model itself. They also extend to account permissions, endpoint devices, data access, and integrations with other tools. If permissions are improperly configured or vulnerabilities exist in the endpoint environment, the automation capabilities of AI Agents may amplify existing security issues. Five Common Cybersecurity Risks of AI Agents 1. Sensitive Data Leakage AI Agents may access corporate documents, source code, customer data, account information, and other sensitive resources while performing tasks. If access privileges are too broad or appropriate controls are not in place, sensitive information could be unintentionally accessed, processed, or transmitted. 2. Prompt Injection and Malicious Instructions AI Agents may retrieve information from external sources such as websites, documents, and emails. Attackers can embed malicious instructions within this content to manipulate an Agent into ignoring its original rules, accessing unauthorized information, or even performing unintended actions. 3. Excessive Permissions To enable AI Agents to complete tasks autonomously, enterprises may grant them permissions to access files, operate systems, or call APIs. If the principle of least privilege is not followed, a manipulated or misused Agent could significantly expand the potential impact of a security incident. 4. Unpredictable Autonomous Behavior AI Agents can independently plan multiple steps to accomplish a task, but their execution paths may not always align with user expectations. Without appropriate restrictions and human approval mechanisms, incorrect decisions can quickly propagate through automated workflows. 5. Endpoint Environment and Configuration Risks AI Agents ultimately operate on enterprise computers, servers, or other endpoint environments. If these devices contain vulnerabilities, insecure configurations, excessive privileges, or insufficient security controls, they may introduce new attack surfaces even if the AI Agent itself has not been directly compromised. What Risks Should Enterprises Assess Before Deploying AI Agents? AI Agent security cannot be fully addressed by a single product or tool. Instead, it should be incorporated into the organization’s existing AI Governance, identity and access management, data security, and cybersecurity management processes. Before deployment, enterprises can begin by assessing the following questions: Which endpoints are currently using or preparing to deploy AI Agents? What corporate data and systems can these AI Agents access? Have they been granted permissions beyond what is required for their tasks? Do the endpoints running AI Agents contain vulnerabilities or high-risk configurations? Has a security baseline been established, and can endpoint compliance with that baseline be continuously verified? Do high-risk actions require human approval or other control mechanisms? Build an AI Agent Security Baseline Through Endpoint Risk Assessment Comprehensive AI Governance covers policies, data, models, permissions, auditing, and risk management, with endpoint security assessment serving as an important technical control . Before deploying AI Agents at scale, enterprises should assess their usage, configurations, and vulnerabilities to establish a security baseline and prioritize remediation. TeamT5 ThreatSonar Plus helps identify AI Agent-related risks through endpoint, vulnerability, and configuration assessments, giving security teams greater visibility before deployment. AI Agents offer powerful automation, but the key question is not only “Can we use them?” but “Can we use them securely?” Understanding endpoint risks, permissions, and configurations provides a stronger technical foundation for broader AI Governance.

A Nine-Second Lesson An engineer at a car-rental software startup asked a Cursor AI agent to help with a coding task. Without human confirmation, the agent made its own judgment and took action, deleting the company’s entire production database in just nine seconds and causing more than 30 hours of system downtime. Afterward, the AI agent wrote an apology letter. The real warning from this incident is not that “Cursor malfunctioned.” It is that an AI agent was granted excessive system privileges and, without any human confirmation mechanism, was able to autonomously execute operations far beyond what should have been permitted. Before it acted, the company did not even know that such an agent was running on its endpoints, much less how much authority it had been given. A Fundamental Shift in Risk: From “Giving the Wrong Answer” to “Taking the Wrong Action” To understand why AI agents represent a fundamentally new cybersecurity issue, we first need to recognize how they differ from conventional AI tools: Chatbot AI Agent / Agentic AI Operating Environment Runs within a standalone browser tab Runs as a primary application within the system Memory Limited to a single conversation Persistent memory across tasks Autonomy Passively waits for user instructions Makes decisions and takes actions autonomously based on defined rules Access Permissions Confined to a closed environment Broad access to files and private accounts In the past, the primary concern around AI “hallucinations” was that a system might provide an incorrect answer, which a human could then review and correct. Once AI gains the ability to act and is granted system privileges, however, the risk escalates from “saying the wrong thing” to “doing the wrong thing” — often with irreversible consequences. More importantly, for most enterprises, the permissions these agents hold and the data they can access remain a largely opaque black box. Most Enterprises Lack Visibility into AI Agents According to Gravitee’s State of AI Agent Security Report 2026, the situation is more serious than many organizations may realize: •       The number of AI agents deployed by enterprises has nearly doubled since the end of 2025, with 38% of organizations now running more than 100 agents. •       54% of organizations experienced or suspected an AI agent-related security incident in the past 12 months, including 34.9% that reported confirmed incidents. •       Yet only 9.5% of organizations can secure more than 80% of their deployed agents. •       Only 7.2% of organizations have assigned a dedicated person to be accountable for agent behavior. In other words, AI agents are rapidly becoming part of everyday enterprise operations. More than half of organizations have already experienced or suspected related security incidents, yet the vast majority still lack adequate visibility and governance mechanisms. At its 2026 Security & Risk Management Summit, Gartner described this phenomenon as “Shadow AI.” It is more difficult to manage than traditional shadow IT: shadow IT is unauthorized software, while shadow AI can act autonomously and leave behind activity that is difficult to trace — effectively becoming an “invisible employee.” From Principles to Rules: Governments and Industry Bodies Begin Addressing AI Agents AI governance discussions have traditionally centered on principles such as fairness, transparency, and accountability. Since late 2025, however, regulators and cybersecurity authorities around the world have increasingly focused on a more concrete subject: AI agents that can act autonomously. In less than a year, agentic AI has evolved from a technical term into a risk category explicitly addressed in governance and security guidance. Issuer Document Key Points Related to AI Agents Date Taiwan Ministry of Digital Affairs (MODA) Artificial Intelligence Risk Classification Framework Established under Article 16 of the Artificial Intelligence Basic Act. Among 20 risk subcategories, it explicitly identifies unauthorized actions by autonomous AI agents. 2026/7 Five Eyes Alliance Careful Adoption of Agentic AI Services The first multinational agentic AI security guidance jointly issued by cybersecurity agencies from the U.S., U.K., Canada, Australia, and New Zealand, covering 23 risk categories and more than 100 best practices. 2026/5 Singapore IMDA Model AI Governance Framework for Agentic AI The world’s first governance framework designed specifically for agentic AI. 2026/1 發布、6 月更新 European Union AI Act Article 50 Transparency Obligations Requires clear disclosure when users are interacting with an AI system. 2026 U.S. NIST AI Agent Standards Initiative Focuses on red-team testing and compliance guidance for autonomous systems. 2026 OWASP Top 10 for Agentic Applications The industry’s first dedicated risk list for agentic AI applications (ASI01–ASI10), accompanied by the AIVSS scoring mechanism. 2025/12 Under Article 16 of Taiwan’s Artificial Intelligence Basic Act, the Ministry of Digital Affairs (MODA) published the Artificial Intelligence Risk Classification Framework in July 2026. The framework divides AI risks into three major categories and 20 subcategories. Under “post-deployment operational issues,” it explicitly includes “unauthorized actions by autonomous AI agents.” This marks the first time an official Taiwanese document has identified loss-of-control behavior in agentic AI as a distinct risk category that organizations need to identify and manage. Notably, the first of the framework’s four recommended steps is to “inventory application scenarios.” Government agencies are required to complete risk assessments and establish corresponding management rules within one year. A Common Language Across Frameworks: Visibility, Explainability, Control, and Resilience These documents come from different countries and institutions and focus on different aspects of AI governance. Yet their underlying requirements are highly consistent and can be summarized in four areas: •       Visibility: Eliminate monitoring blind spots by identifying which agents exist in the environment and what permissions each one holds. •       Explainability: Build digital trust by ensuring that agent actions and decisions are traceable and explainable. •       Control: Preserve human decision authority by maintaining human review and intervention for high-risk operations. •       Resilience: Implement defense in depth, assume that agents can make mistakes, and ensure that failures can be reversed. The core principle is simple: AI must operate within a secure and controlled environment. These four areas also follow a clear sequence: visibility is the prerequisite for the other three. You cannot establish an audit trail for an agent you do not know exists, nor can you design approval controls for permissions that have never been inventoried. This is precisely why MODA places inventory as the first step in its four-step approach. The First Step Is Always Knowing What You Have A fundamental principle of cybersecurity governance is simple: you cannot manage what you cannot see. Before discussing AI agent risk management, enterprises must first answer a more basic question: which AI agents are actually installed and running on our endpoints? This is where ThreatSonar Plus, TeamT5’s comprehensive endpoint risk assessment platform, comes in. ThreatSonar Plus can inventory widely used AI agent tools installed on endpoints, with its coverage continuously expanding to keep pace with the rapidly evolving ecosystem. With this inventory, security teams can move from “I assume someone in the company is probably using AI” to “I know which departments and devices are using which agents, and how extensive their permissions are.” This visibility forms the foundation for every subsequent governance measure, including access control, compliance assessment, and risk classification. After: Identify Risk Before an Incident Occurs Once you know what is installed, the next question is how much risk it introduces. Consider the nine-second database deletion described earlier. The root problem was not simply that no one stopped the agent after it acted; it was that no one knew beforehand that the agent had enough privilege to delete the production database. By the time an organization reacts to the action itself, the damage may already be done. Effective risk management means reducing exposure before the agent acts. Endpoint-level risk assessment therefore needs to answer several concrete questions. Based on OWASP’s AI agent risk categories and the AIVSS scoring mechanism, ThreatSonar Plus evaluates AI agent risk across four dimensions: •       Permissions and Access Scope: Do the agent’s privileges and operating scope exceed what is actually required for its tasks? •       Sensitive Data Exposure: Where are API keys, credentials, and confidential data stored on the endpoint, and are they within the agent’s reach? •       Malicious Skill Detection: Do the third-party or open-source skills used by the agent contain backdoors or malicious code? •       Hidden Instruction Analysis: Do the agent’s tool descriptions or configuration files contain concealed or dangerous instructions? From determining “what is installed” to understanding “how much risk it creates,” these are the two steps AI agent governance must complete before an incident occurs. Conclusion 1.     AI has evolved from “generating conversations” to “taking autonomous action.” The risk has therefore escalated from hallucinated or incorrect outputs to potentially destructive system operations and privilege misuse, such as accidentally deleting a database. 2.     Effective governance begins with risk visibility. In response to OWASP guidance and AI governance frameworks worldwide, enterprises need controlled mechanisms for high-risk operations. But every governance measure starts with knowing which agents exist in the environment and how much authority each one has. 3.     You cannot defend against what you cannot see. The first step toward eliminating Shadow AI is comprehensive visibility into the distribution and permissions of AI agents across the environment. 4.     Identify risk before an attack occurs. Through ThreatSonar Plus assessments, organizations can proactively uncover sensitive data exposure, hidden instructions, and malicious skills, reducing risk before automated attacks or harmful actions can take place. AI agents will not stop advancing simply because enterprises are not ready. Adoption is becoming inevitable; adopting them securely starts with making the risks visible. Want to know which AI agents are running across your company’s endpoints? Contact TeamT5 to learn how ThreatSonar Plus can help establish AI agent visibility and a baseline for risk management. References [1] Yahoo! News [2] AOL [3] Gravitee

A recent incident in which an AI agent deleted an entire company database and its backups without human confirmation sparked broad discussion[1]. Although the company had set rules such as “Do not run destructive commands” and “Do not make irreversible decisions independently,” the AI agent still went out of control and caused serious consequences. As AI moves beyond responding to prompts and begins calling tools, accessing data, and executing system operations, organizations need to look beyond whether the AI itself is secure and examine what the AI can actually do on endpoints. AI agents have become a new attack surface AI agents differ from general AI tools in that they do not simply respond to instructions; they can also reason, plan, select tools, and execute tasks. When “language” becomes an interface for triggering tool use and system operations, risk no longer stays within the prompt itself. It may also emerge as the AI agent interprets tasks, selects tools, or processes data. In other words, the points where attackers can intervene have expanded from a single input to the entire workflow an AI agent follows to complete a task. Tool descriptions and outputs, external skills, plugins, and the broader AI ecosystem can all influence an AI agent’s judgment and behavior. The abuse of the OpenClaw ecosystem also shows that skill supply chains and tool ecosystems can become potential security gaps.[2] When malicious content is embedded in external skills or tools, a seemingly normal workflow may be redirected toward unexpected execution results. What makes this more challenging is that the execution process of an AI agent may not always be fully traceable. Once a task produces an unexpected outcome, accountability can also become difficult to determine. As AI agents begin executing tasks in real operating environments, their impact may extend to endpoint data, credentials, configurations, and permissions. If an agent is affected by hidden instructions or malicious skills while also gaining access to API keys, database credentials, or other sensitive information, originally controlled data access or system operations may turn into unpredictable behavior. To gain a complete view of endpoint and AI agent risks, organizations can use standardized assessment to examine their environments through four steps: Asset inventory : Identify endpoint devices, systems, and AI agent deployment and usage. Risk identification : Detect vulnerabilities, misconfigurations, and potential AI agent risks. Risk prioritization : Determine remediation priorities based on severity. Response decision : Use risk insights and remediation guidance to support follow-up actions. This process helps organizations assess endpoint risks in a consistent way and turn assessment results into a practical basis for vulnerability remediation, resource allocation, and management decisions. ThreatSonar Plus: Eliminating security blind spots through automated risk assessment ThreatSonar Plus is a comprehensive endpoint risk assessment platform that enables organizations to perform a one-time assessment to inventory assets, detect risks, and support risk evaluation. It helps organizations address emerging risks in endpoint environments as AI agents become part of daily operations. Its assessment scope includes: Comprehensive asset and AI agent inventory : Inventories endpoint devices, operating systems, applications, and AI agent deployment and usage, providing visibility into asset distribution and AI agent usage for subsequent risk analysis and management. AI agent risk assessment : Assesses AI agent risks related to sensitive data exposure, malicious skill detection, hidden command analysis, and least privilege control, including whether API keys, credentials, sensitive data, hidden commands, malicious actions, or excessive permissions are present. Vulnerability detection and risk assessment : Maps assets to CPEs and correlates them with CVE databases to provide vulnerability insights and risk references, helping organizations identify high-risk software, operating system versions, or endpoint devices. Security configuration and compliance assessment : Assesses system settings against CIS benchmarks to verify security baseline compliance, and supports SEMI E187 Compliance Assessment across operating systems, network security, endpoint protection, and security monitoring. Manage endpoint “claw” risks early AI agents are quickly becoming part of enterprise environments. While they bring convenience and efficiency, they also introduce new risks to endpoint security. With ThreatSonar Plus, organizations can gain clearer visibility into endpoint conditions, identify and manage potential risks earlier, and build a cyber defense approach that keeps pace with fast-changing technologies and operating environments. Source: [1] https://www.aol.com/entertainment/dangerous-ai-escapes-deletes-entire-131400323.html [2] https://www.ithome.com.tw/news/173735 ThreatSonar Plus - Extensive Endpoint Assessment Platform can help you! Built on asset inventory, risk detection, and AI agent identification, ThreatSonar Plus enables organizations to gain visibility into critical assets and AI agent deployments, uncover security gaps across endpoints, software, and AI agents, and prioritize remediation based on risk severity.