Three things happened in the past two weeks that are worth reading together. Chainalysis, a company that should be among the world's most secure, admitted it was breached by an attacker using 'offensive agentic techniques', exposing password hashes and live tokens for all its users. OpenAI published research in which AI agents found 948 flaws in the Linux kernel and built a working exploit for each. And Anthropic launched a tool letting Claude read every transaction in your bank account.
Each is presented separately, rightly, as an achievement or an isolated incident. Together they paint a troubling picture: AI agents' ability to act in the world, to scan, search, exploit and execute, is growing very fast, and attackers know how to use it too. Meanwhile organizations are rushing to connect agents to everything they have: email, files, finance systems, code.
The core problem is permissions. For an agent to be useful you have to give it access, and to be very useful you give it broad access. That creates a situation in which one piece of software, whose every action no human checks, holds keys once spread across dozens of employees. If the agent errs, the error happens fast and at scale. If an attacker manages to 'persuade' it, for example with instructions hidden in a document or email, they get all the keys at once.
That is exactly why Israeli data security companies, Cyera, Sentra and others, are now worth billions. They sell the answer to a question organizations forgot to ask before connecting agents: what exactly does this agent see, and what can it do? The fact that the question comes only after connecting, not before, is the whole story.
What should be done? Treat an AI agent like a new employee on probation, not like a software tool. Give it only the permissions it must have, start with tasks where mistakes are cheap, log every action, and require human approval for anything irreversible, such as moving money or deleting data. Organizations that skip these steps under pressure 'not to miss the AI revolution' may discover they have opened the widest door they ever gave attackers.
