BLOG

Something changed in the last twelve months that most security teams have not fully absorbed yet. AI tools stopped being things employees use to write faster and became things that act autonomously on your behalf, accessing APIs, modifying records, sending emails, executing code, and making decisions without pausing for human review.

Gartner predicts that 40% of enterprise applications will feature task-specific AI agents by the end of 2026, up from under 5% in 2025. Only 14.4% of those agents went live with full security and IT approval. The rest were deployed by engineering teams, business units, and individual employees solving real problems with effective tools, creating a governance gap that most organizations have not yet identified, let alone addressed.

This article explains what agentic AI is, why it creates cybersecurity risks that traditional security tools were not designed to manage, and what a practical AI governance framework looks like for organizations that are already running, or will soon be running, autonomous AI in their environment. 

What is agentic AI and why does it create a new category of security risk?

Traditional AI tools are reactive. You provide an input, a prompt, a document, a query, and the tool returns an output. The human remains in the decision loop at every step.

Agentic AI is different. An AI agent is a system that perceives its environment, plans a course of action, executes that plan across multiple steps and tools, and adapts based on results, without requiring a human to approve each action. An agent might be instructed to ‘monitor my inbox, schedule meetings when a client requests one, and update the CRM accordingly.’ That agent will access your email, read messages, write calendar invites, and modify your CRM records, continuously, autonomously, using whatever permissions its OAuth token carries.

The security risk is not that AI agents do unexpected things. The risk is that they do exactly what they are designed to do, with access that was not properly scoped, in ways that security teams cannot see, at a speed no human reviewer could match. When an agent’s credentials are compromised or its instructions are manipulated, a technique called prompt injection, the result is not a login attempt that triggers an alert. It is a trusted system executing attacker instructions using authorized access.

How agentic AI differs from traditional software, from a security perspective

Security frameworks built around human actors and deterministic software have structural gaps when applied to agentic AI:

• Non-deterministic behaviour, the same input can produce different outputs depending on model state, context, and available tools. Traditional monitoring that looks for known-bad signatures is largely ineffective.
• Autonomous decision-making, agents make decisions at machine speed without a human review step. By the time an anomaly is flagged, the action may already be complete and its effects propagated across connected systems.
• Persistent access, agents often hold OAuth tokens or API keys that grant continuous access to multiple systems. Unlike a human session that ends when the user logs off, agent credentials persist and accumulate scope over time.
• Cross-system blast radius, a single compromised agent with access to email, CRM, file storage, and a communication platform can cause damage across all four simultaneously. Traditional perimeter-based security models do not account for this.
• No audit trail by default, most agentic AI deployments do not generate structured logs of agent actions in a format that security teams can query. Agents operate in a visibility gap.

1. Prompt injection attacks

Prompt injection occurs when malicious instructions embedded in external content, an email, a web page, a document, cause an AI agent to execute unintended actions. An agent monitoring email for scheduling requests can be instructed by a crafted email to forward all messages to an external address, create a new admin account, or exfiltrate calendar data. Because the agent is executing instructions through its own authorized channels, Traditional security tools may not flag the activity, making managed detection and response capabilities increasingly important for identifying suspicious AI-driven behavior across multiple systems. .

2. Over-permissioned credentials

AI agents are often provisioned with the broadest credentials available to make them maximally useful. The CSA-Oasis State of NHI and AI Security 2026 found that 51% of organizations cite over-permissioned access as a top pain point, and 78% have no documented policy for creating or removing AI identities. An agent that needs to read email should not also have write access to your file storage, admin rights on your CRM, and the ability to send external API requests, but that is precisely what most agent deployments look like.

3. Shadow AI agents

The agentic shadow AI problem is categorically different from the shadow IT problem. Traditional shadow IT involves an employee using an unsanctioned tool to store or process data, one interaction, containable. Agentic shadow AI involves an autonomous system with API access that chains actions across multiple services, runs continuously without human review, and persists in your environment with credentials that nobody provisioned through a formal process. The average enterprise already contains approximately 1,200 unofficial AI applications.

4. Memory and context accumulation

Agents that maintain conversation history or context across sessions accumulate sensitive information over time. Without explicit memory lifecycle management, an agent’s context window becomes a growing repository of customer data, internal decisions, and system credentials. This data lives in the agent’s operational environment, not in your data governance framework.

5. Multi-agent cascade failures

Enterprise AI deployments increasingly use multiple agents that communicate with each other, one agent orchestrating others to complete complex tasks. When one agent in a chain is compromised or behaves unexpectedly, the failure can cascade across all downstream agents before any human becomes aware. The OWASP Top 10 for Agentic Applications, released in December 2025, identifies this pattern, rogue agents that operate within their authorized scope while pursuing adversarial objectives, as one of the most difficult risks to detect and contain.

Shadow AI: when employees deploy agents without security approval

Microsoft Cyber Pulse 2026 found that 29% of employees use unsanctioned agents for work tasks. This is not deliberate circumvention, it is employees solving real problems with effective tools that IT has not yet sanctioned. The problem is structural: sanctioned enterprise AI tools succeed in production only 5% of the time, while consumer tools reach production 40% of the time. Employees are not waiting for IT.

The exposure chain created by shadow AI agents includes:

• Copy-paste of sensitive internal documents into personal ChatGPT or other free-tier AI accounts, invisible to IT
• Browser extensions with AI capabilities that intercept page content, including internal systems
• OAuth tokens granted to AI tools that persist long after the employee stops using the tool, or leaves the organization
• API integrations between SaaS tools and AI services that employees configure without security review

Harmonic Security found that 16.9% of sensitive data exposures, over 98,000 instances in their research dataset, occurred on personal free-tier accounts completely invisible to enterprise IT. That data includes customer information, financial records, legal documents, and internal strategy materials.

What an AI governance framework looks like in practice

Effective governance of agentic AI requires five capabilities operating simultaneously:

1. Inventory, a continuously updated catalogue of every AI agent and AI tool operating in your environment, including sanctioned enterprise deployments, departmental tools, and individually provisioned applications. You cannot govern what you cannot see.
2. Identity management, AI agents should have their own distinct digital identities with managed credentials, not share human user accounts or service accounts provisioned for other purposes. NIST launched its AI Agent Standards Initiative in January 2026, signalling that federal governance frameworks for non-human identity are imminent.
3. Least privilege, AI agents should be granted the minimum permissions necessary to perform their function, with time-bound credentials and automatic revocation when the task is complete. An agent that needs to read email to schedule meetings does not need write access to your file storage.
4. Observability, structured logging of agent actions in a format that security teams can query. Every action an agent takes, every API call, every data access, every external communication, should generate a log entry that can be reviewed, correlated, and alerted on.
5. Continuous compliance, periodic review of agent permissions, access logs, and behaviour to identify drift, over-permission, and unexpected activity. Enterprises with mature AI governance programs report 45% fewer security incidents and resolve breaches significantly faster. Organizations implementing these controls often benefit from experienced cybersecurity consulting services to establish governance, policies, and technical safeguards. 

Agentic AI security checklist: 10 controls to implement now

1. Conduct a shadow AI audit, survey employees, review OAuth grants, and scan your environment for AI tools operating without IT knowledge
2. Catalogue all active AI agents with their credentials, permissions, and data access scope
3. Implement a distinct identity and access management policy for non-human identities, including AI agents
4. Apply least-privilege principles to all existing agent credentials, revoke any permissions not demonstrably required for the agent’s function
5. Establish a mandatory security review process for any new AI tool or agent before deployment
6. Enable structured logging for all agent activity and route those logs to your centralized monitoring environment
7. Define alert thresholds for anomalous agent behaviour, unusual API call volumes, data access outside normal patterns, unexpected external communications
8. Implement memory lifecycle management for agents that maintain context, define maximum context windows and automatic clearing schedules
9. Build an AI acceptable use policy that defines what employees may and may not do with AI tools, and publish it alongside guidance on how to request sanctioning of new tools
10. Conduct a tabletop exercise specifically for an AI-related incident, prompt injection, compromised agent credentials, or shadow AI data exfiltration

What is the difference between shadow AI and approved AI tools?

Approved AI tools have been reviewed by IT and security before deployment, their permissions are scoped, their data access is understood, and they are included in your monitoring environment. Shadow AI refers to any AI tool or agent operating in your environment without that review process: personal ChatGPT accounts, browser extensions with AI capabilities, AI features embedded in SaaS tools, and individually deployed agents. The distinction matters because shadow AI creates data exposure and access risks that your security team cannot see and therefore cannot manage.

How do I know if my organization has agentic AI running without my knowledge?

Start with three data sources: your OAuth authorization logs (every AI tool that has been granted access to your systems will appear here), your network traffic logs (unusual API calls to AI service endpoints are often visible at the network level), and a direct employee survey. The survey is often the most revealing, employees who are using effective tools will tell you about them if you frame the question as inventory rather than policy enforcement. Expect to find significantly more than you anticipate.

Do AI agents need their own identity and access management policies?

Yes. Existing IAM frameworks were designed for human users and static software systems. AI agents, particularly agentic systems that take autonomous actions across multiple services, require distinct identity constructs, time-bound credentials, and access policies that account for their non-deterministic behaviour. NIST’s AI Agent Standards Initiative, launched in January 2026, is developing the framework for this. In the interim, organizations should at minimum ensure that AI agents do not share credentials with human accounts, that their permissions are documented and minimized, and that their access is revocable on short notice.

What frameworks cover agentic AI security governance?

The most relevant current frameworks are: NIST AI Risk Management Framework (AI RMF), which provides organizational structure for AI risk across an enterprise; OWASP Top 10 for Agentic Applications (released December 2025), which addresses specific technical risks in agentic deployments; ISO/IEC 42001, the international standard for AI management systems; and the EU AI Act, which entered enforcement in August 2026 for high-risk AI systems. For Canadian organizations, NIST AI RMF alignment is the most practical starting point given its alignment with NIST CSF, which most Canadian compliance frameworks reference.