AI agents are the newest privileged users in the enterprise, and your stack was built to watch humans.
In a year of these posts I have made the same argument in three different ways. In No King, No Kingdom, I said the Agentic SOC would live or die on data. In Machine Speed Won, I said the real fight was closing the runtime gap between the controls you already own before an attacker crosses it at machine speed. In No Context, No Crown, I said the data alone was never going to save you, that engineering it into investigation-grade context is what makes it usable.
All three assumed a defender who's already watching. None of them mentioned that your stack was built to watch humans and endpoints – a person at a keyboard or a device on a network doing something a rule could recognize as normal or not. An agent does neither, and it's already one of the most privileged users in your enterprise. Securing it means seeing every agent, governing what it can reach, and stopping and containing it when it turns, all in runtime.
The newest privileged user doesn't look like one
Ask a security leader what changed with AI agents, and many reach for the model. Better reasoning, longer context windows, and more autonomy. It's a layer to watch, and it may also be the wrong one to prioritize.
Agents now act on their own. They read data, call APIs, change records, and trigger other agents. Every one of those actions runs through a borrowed identity: a service account, an OAuth grant, an API token, a workload identity, or a delegated session. None of those look like a person. The audit trail records the credential, which makes it hard to trace whose decision produced the action. The agent has full, legitimate access the moment it acts, whether you built it, bought it, or an employee connected it without asking anyone.
CrowdStrike's CEO made a similar point recently from the Fal.Con Europe 2026 stage that every AI agent is a privileged identity, and it should be secured like the most privileged insider in the company. Securing such a privileged insider starts with understanding what it does.
Attackers have noticed. Prompt injection and tool poisoning target the agent directly, hijacking an instruction or a connected tool so that a trusted agent does the work with credentials it already has. The attack arrives as text and leaves as a legitimate API call, which gives your existing controls nothing to flag.
Agent behavior also shifts from task to task, so the anomaly detection built for people and fixed service accounts struggles to find a stable baseline. The reach doesn't change, though. An agent's role allows a fixed set of systems, scopes, and identities. Behavior measured against that reach is the signal, and effective AI Agent Security has to move at the speed the agent does.
How would you know if one of your AI agents were compromised right now? In principle, you wouldn't. Most security and SOC leaders I talk to answer that question with a pause. The agent hasn't broken anything. It's just acting, without a human watching each step, through a credential that already had the access it needed. The only signal left to tell you something is wrong is behavior: what the agent touched, when, on whose authority, and what changed as a result.
Over the past few months, an AI agent reached non-public files inside Australia's Medicare statistics portal, and agents pulled U.S. Census Bureau data using credentials they found sitting in the open. Rogue agents scraped SEC filings in a way OpenAI itself later called inappropriate. One tried to break into the U.S. Department of Education's Office for Civil Rights site, and a swarm of agents sent more than 16,000 requests at a UN data service, disguising the traffic to get past the limits built to stop it. Another found a DNS loophole and used it to reach the open internet from inside a training sandbox that was supposed to contain it.
Harm does not require a compromise. An agent can follow its instructions and still expose confidential information or make a commitment nobody authorized. CrowdStrike's CEO recently called AI safety “how you get the full benefit of AI” and described security as “simultaneously the accelerant and the safety net for technology adoption.” The safety work will ultimately land on the security team. Whoever writes the policy or runs the deployment, security investigates agent behavior and stops and contains the agent when it goes rogue.
Three agents, one blind spot
All of this is more challenging than a single new attack surface you must defend, because you're never running just one kind of agent. You're running three at once, and most security teams can only see one of them.
Engineering builds homegrown agents on Bedrock, Azure AI Foundry, or a custom stack. Each inherits whatever role an engineer assigned it, then moves beyond it. Business units bring in vendor agents such as ChatGPT, Anthropic, and Salesforce Agentforce, plus sanctioned platform automations, all connected through an OAuth grant that nobody watches after the approval meeting. And employees connect their own, including coding agents, personal AI tools using work identities, and skills installed without review by anyone.
Ownership alone doesn't control them. If they can act in your environment on your credentials, they're privileged users your stack has never been asked to watch. Most teams cannot say which agents can reach critical data today, let alone what those agents did last week. Ask three different enterprise security teams who owns agent risk and safety, and you'll get three different answers, and none of them would be wrong. The failure is visibility, and no org chart fixes that.
The economics of not knowing
I spent a good part of Machine Speed Won on the economics of runtime security to demonstrate that a control that reduces one risk but makes your operating model worse elsewhere isn't progress. The identity version of that math is uglier than most people budget for.
An unreviewed OAuth grant costs you later, on the day someone has to answer for what it did during the months nobody was looking. And that reconstruction often happens against a clock, with legal on the call. Forensic reconstruction after the fact is expensive, while runtime detection is cheap. You're paying analysts to manually stitch together fragments across an identity provider, a cloud console, and three SaaS admin panels on a deadline, instead of paying a system to have them already stitched together for you as they happened. The bill arrives later, at a worse time, and in a bigger number, whether you budgeted for it or not.
Anthropic made the same point directly when it launched its Cyber Mission: "Highly cyber-capable AI models are widely available to attackers now." Their own forecast puts the defender's advantage two years out, and the bottleneck they describe is remediation. Finding a vulnerability has gotten easy, and months still pass before it gets fixed. Regardless of what the industry gets right over the next two years, the agents working against you have the advantage. Seeing, governing, stopping, and containing agent behavior at runtime is the compensating control until that window closes.
What we found when we watched for behavior
I never like to make arguments like this in the abstract, so we decided to test it against ourselves. In July 2026, an autonomous agent infiltrated Hugging Face's own infrastructure and ran an intrusion end-to-end with no human directing it: about four and a half days total, roughly 17,600 recovered actions, 11 nodes rooted, and 136 keys exposed. Hugging Face caught it and published the timeline, which is rarer and more useful than the intrusion itself.
We rebuilt that attack, using the same class and control planes, and ran it against our own platform to see what a defender would need to interrupt it. The chain lived almost entirely between Kubernetes, AWS, the corporate network, and source control. There was no malware, no human login, and nothing an identity provider would flag on its own. What crossed those boundaries was a service account and the credentials it could reach. Four separate log sources each held a few ordinary-looking lines.
One finding from that exercise is the identity problem at a smaller scale. A decade of detection engineering was built around people. It looks for impossible travel, a new device, sign-in risk, and privilege escalation on a named user. Almost none of that logic fires on a data-processing service account doing something it has never done before. To keep the noise down, most teams write these rules to skip system principals, service accounts, and workload identities. That exclusion worked right up until the attack came from one of the identities it was built to ignore. That identity had full access the entire time. Nothing was watching for a privileged user who wasn't a person.
Pulling those planes into one place, in runtime, so the chain shows up as a single thing instead of four unrelated ones, is what we call Panoramic Awareness. And deciding that the resulting picture was urgent enough to act on quickly is what we call Attack Decoding and Attack Containment for agents. Take any one away, and the agent behavior that raised the alarm stays invisible until the postmortem.
Guardrails see the prompt. We see the entire attack in runtime.
The market has spent the last two years building guardrails, and it needed to. Inline guardrail platforms shape what an agent is allowed to say or request in the moment. Posture tools map what an agent could theoretically reach. Both belong in the stack. Neither answers the question a security leader asks the morning after an agent misbehaves. What did it do, across which systems, and what do I do about it right now?
Posture tells you what an agent could do. Mitiga watches what it does across your entire ecosystem.
No single control at the front end closes that gap. A stolen agent token, a vendor's OAuth grant, or a shadow agent that nobody registered. None of it passes through a gateway that was never wired to it or a sensor that was never deployed. Whoever wired the guardrail can't answer what happened after the fact, because the agent never touched it. The SOC is still the one left to reconstruct what happened across the modern infrastructure and stop it in runtime. That machine-speed reconstruction, detection, and containment, with real-time control over drift and privilege escalation for every agent, is what we mean by AI Agent Security.
What AI Agent Security gets you
Every agent comes into view first, including the ones nobody registered. A third-party connected agent and shadow agent riding an employee's token both still leave logs even though existing tools can’t see them. Mitiga reads those logs across cloud, SaaS, and identity activity and follows each agent from trigger to tool call to impact as one chain. Mitiga ties the prompt, the model invocation, and the MCP call to the outcome in the system it touched. Because the evidence is the logs you were already collecting, you can answer "what did our agents do in the last 30 days" on day one.
Stopping the attack comes next. Detection built for agent behavior catches the moment legitimate activity turns malicious and correlates cloud, SaaS, and identity activity into a single attack story instead of five alerts no one connects. AI Triage clears the false positives before they reach your SOC and pushes a recommended containment straight into your SOAR, at machine speed.
Containment stays surgical. Mitiga revokes the grant, quarantines the identity, or reverses the change, and each action is non-destructive and reversible, with the smallest possible blast radius. Zero-Impact Breach Prevention, applied to agents. CrowdStrike is right that runtime is the control point and right that a kill switch is the ultimate brake. Brakes let your agents run faster. The decision to pull the kill switch still comes from runtime visibility and detection.
Control also runs in runtime. A static scan only reflects your last snapshot, while agents continually evolve, such as a homegrown agent outgrowing its role, a vendor agent taking on new responsibilities, and unresolved grants. Mitiga cross-references live runtime activity with static configuration and applies policy to both, so it catches drift and privilege escalation the moment they happen.
All four rest on the same foundation. Mitiga's Cloud Security Data Lake normalizes cloud, SaaS, identity, and AI telemetry in one place, retained for 1,000+ days. And Context Engineering turns that raw telemetry into deterministic, investigation-grade context before detection ever runs. I made the case in No Context, No Crown that context is the bottleneck for every AI SOC, whatever model runs on top. Agents raise the stakes on that argument because everything an agent does crosses cloud, SaaS, and identity at machine speed.
The question to ask every vendor now
In No King, No Kingdom, I gave you a set of tough questions to ask before you "go agentic." Most vendor conversations skip the question underneath all of them. After your agent authenticates, who's watching what it does with that identity, and for how long?
If the answer is "the guardrail platform," you've learned what the agent was allowed to request, not what it did. If the answer is "the kill switch," you've learned how to stop an agent without knowing which one to stop, when, and what it did. If the answer involves a system that can reconstruct behavior in runtime across cloud, SaaS, identity, and AI activity after the credential is already in use, control what that identity can reach, and stop and contain the damage without waiting on someone to notice, you're looking at something built for the shape of this problem.
The chapter I skipped
Data was King. Speed was the fight. Context was what made the data usable. But none of that matters if the thing acting in your environment doesn't look like anything your stack was ever built to watch or see. I hadn't added that chapter until now. AI agents are the newest privileged users in the enterprise, with no keyboard, badge, or device—just a credential doing exactly what it was authorized to do, until denied. Your stack was built to watch humans, and AI Agent Security extends that watch to every agent, in runtime.
Zero-Impact Breach Prevention, for agents. Let them run.
Guardrails protect the prompt. Mitiga protects everything after it.
Get a demo to learn more
