Key Takeaways

  • Autonomous agents hold legitimate credentials: AI workers operate with valid permissions, meaning malicious activity looks identical to authorized work.
  • Speed destroys reaction windows: Gonen Stein warns that while human ransomware previously exposed 60% of an unmapped environment, an agent can drop a production table instantly.
  • Rogue agent sprawl is accelerating: Ofir Ehrlich observes citizen developers building autonomous workflows outside IT oversight, creating unmonitored identities with direct access to sensitive data.
  • Perimeter defenses are obsolete: Because internal non-human actors already have keys to the building, security teams must adopt an assume-breach architecture centered on rapid recovery.

The Threat Inside the Perimeter

For two decades, enterprise security focused on keeping unauthorized humans out. You built firewalls, required multi-factor authentication, and watched for strange IP addresses. If an attacker got in, you searched for abnormal credentials.

Autonomous AI agents make that entire playbook useless.

“Up until now, the concerns came from human threats,” Stein explains. “What we're seeing now on steroids is that the same type of threat is coming from non-human actors, agents that essentially have legitimate access to the environment with legitimate permissions.”

When an AI agent connects to your database, it does not pick the lock. You gave it the keys. It holds valid API tokens, approved service accounts, and write permissions. If that agent malfunctions, hallucinates, or gets manipulated, security monitoring sees normal traffic right up until the damage occurs.

Stein points to disaster recovery history to illustrate the stakes. In earlier cloud migrations, unmapped assets routinely left companies vulnerable, and in many incidents, “60% of the environment was exposed by ransomware.” Now, autonomous agents compress that failure timeline from days into milliseconds. As Stein puts it, with agents holding legitimate database permissions, “all of a sudden, and this now happens very rapidly, a table is all of a sudden dropped.”

Shadow AI and the Rise of Ghost Actors

The issue grows worse because software engineers are no longer the only people deploying code. Business teams now spin up automated workflows with no-code tools and lightweight LLM wrappers.

Ehrlich calls out this internal spread: “It creates a complete set of actors inside an organization not bound by the rules of the organization and not necessarily running within the premises of the organization but handling sensitive data.”

When a marketing manager builds an agent to sync customer data, that agent becomes a persistent non-human identity. It rarely gets audited. It almost never gets revoked when the project ends. It sits in your infrastructure with live read-write tokens, waiting for a prompt injection or a bad script to trigger an unintended purge.

Because you cannot reliably prevent an authorized identity from taking a destructive action, prevention alone is a failing strategy. “We need to assume breach whether it's malicious or not,” Ehrlich says, “and need to be able to handle it and act accordingly.”

What to Do With This

Audit your service accounts tomorrow morning. Pull a list of every active API key, webhook, and automated agent with write access to your production databases, then revoke any token that has not executed a verified task in the last fourteen days. Reconfigure remaining agent permissions to append-only mode so no automated identity has direct drop or delete rights without human approval.