Are AI Agents Running Circles Around Your Cyber Defenses?

https://video.wixstatic.com/video/dac148_990adcb3f3fe46a59644cac58ad0bc90/1080p/mp4/file.mp4

Everything in our cybersecurity arsenal still matters. The assumptions surrounding it may not be keeping pace.

I’ve spent enough years in cybersecurity to become suspicious whenever someone announces that a new technology changes everything. Usually, it doesn’t.

Firewalls still matter. Identity still matters. Least privilege matters. Network segmentation matters. Endpoint protection, secure software development, logging, monitoring, vulnerability management and incident response do not suddenly become artifacts because someone attached the word agentic to a product. If anything, many of those controls become more important as AI systems gain access to more enterprise data, applications and tools.

But I’m increasingly convinced of something else at the same time: everything in our traditional cybersecurity arsenal still matters, but it just isn’t enough by itself.

AI agents are beginning to expose assumptions buried inside the security architectures we spent decades learning how to defend. That distinction carries weight because the strongest version of this argument is not that agents somehow make traditional cybersecurity obsolete. They don’t. The more consequential question is whether an agent can stay within the technical controls we’ve defined while still operating in ways those controls were never designed to anticipate.

That is a much harder problem.

NIST is already examining possible gaps in existing cybersecurity approaches when applied to AI agents, including risks associated with adversarial data, indirect prompt injection, specification gaming and agents taking security-relevant actions. Its National Cybersecurity Center of Excellence has separately put light on questions of agent identification, authorization, auditing and non-repudiation. OWASP’s Top 10 for Agentic Applications similarly addresses what happens when AI systems can plan, act, use tools and make decisions across complex workflows.

That does not tell me traditional cybersecurity has failed. It tells me the operating environment is changing underneath it.

Think About an Escape Room

Imagine walking into an escape room where the game designer gives you a simple objective: get out of the room.

Around you are locks, clues, boxes, numbers, keys and puzzles. The designer has carefully constructed a pathway through the game. Solve one clue and it leads to another. Eventually, if you follow the intended logic, you discover the combination that opens the final door. That is the designer’s expected solution space.

Then one of the players looks up and notices a drop ceiling. He pushes up a ceiling tile, climbs over the partition and drops into the hallway on the other side.

Objective accomplished. He escaped the room.

From the player’s perspective, he solved the problem. From the designer’s perspective, he completely violated the intended boundaries of the game. The interesting part is that the player did not misunderstand the objective. He understood it perfectly. The objective was to escape.

What failed was the assumption that the player would pursue that objective only through the pathways the designer intended. The designer understood the objective, and the player understood the objective, but they had different understandings of the boundary.

That is the analogy I keep coming back to when thinking about agentic AI.

Objective Fidelity Is Not Boundary Fidelity

I recently described this condition in my LinkedIn piece, “Objective Boundary Divergence in AI Assurance.”

The premise is straightforward: an agent may preserve fidelity to the objective it was given while departing from operational, security, legal or ethical boundaries the human assumed would constrain how that objective was accomplished.

We spend a great deal of time worrying about an AI system doing the wrong thing. I think we also need to worry about a capable system doing the right thing the wrong way.

Imagine an employee asks an agent to resolve a supplier problem and prepare the required package. Nothing about that objective sounds dangerous. The agent retrieves information, correlates records, consults documentation, selects tools and begins working toward completion. The identity may be valid. The applications may be approved. The API calls may be authorized. Each individual data source may even be accessible to the person who initiated the task.

Yet the sequence of actions the agent constructs could still cross a boundary the human never intended it to cross. The agent did not necessarily abandon the objective. It found the ceiling tile.

Traditional security controls can tell us quite a bit about what happened. Identity can tell us who or what acted. Authorization can tell us which resources were available. Logging can record the actions that followed. Those controls do not automatically answer a different question: Was the path the agent chose consistent with the human’s intended decision boundary?

Now introduce an adversary, and the escape room becomes much more interesting.

What If Someone Marked the Ceiling Tile Yesterday?

Return to our escape room for a moment. Suppose yesterday’s player discovered the loose ceiling tile but never used it. Instead, before leaving, he places a subtle mark beside it. Maybe an arrow. Maybe a note disguised as part of the game.

Nothing happens that day. The room closes, and the original player goes home.

Tomorrow another group enters. One of the new players sees the mark, assumes it belongs to the environment and follows it. The previous player no longer needs access to the room. He has altered the environment in a way that influences how someone else pursues the objective later.

That is where the analogy begins to intersect with established AI security problems.

Indirect prompt injection already demonstrates that malicious instructions can be embedded in external content such as websites or files and later influence model behavior when the system consumes that material. OpenAI describes the same fundamental problem: an agent working legitimately on behalf of a user can encounter instructions hidden inside otherwise ordinary webpages, documents or emails.

As agents become more connected, the consequences rise with their authority. OpenAI’s current guidance says third-party content, including webpages, PDFs, emails, chats and tool outputs, should be treated as untrusted by default rather than interpreted as user permission.

That distinction matters because the adversary may not have to attack the agent directly. The adversary can attack something the agent will trust later.

The Persistence Problem Gets Stranger

This becomes even more consequential when agent context survives beyond a single session.

Anthropic now explicitly discusses persistent memory poisoning as an emerging security concern. Product memory, project instructions, mounted workspaces and state associated with scheduled or long-running agents can persist across sessions. If adversarial instructions reach one of those surfaces, the information may be loaded again when the agent returns.

OWASP has reached a similar conclusion in its work on memory and context poisoning: persistent state can allow attacker-controlled content to influence future reasoning, planning and tool use rather than merely affecting one isolated interaction.

That starts to change how I think about persistence.

Cybersecurity has traditionally associated persistence with maintaining access. The account survives, the backdoor survives, the implant survives, or the foothold survives. Agentic environments introduce another possibility: what if the adversary leaves, but the influence remains?

The attacker may no longer control an account or maintain an active session. Yet information introduced into a trusted context could continue shaping subsequent machine behavior. That is not a replacement for traditional persistence mechanisms. It is something adjacent to them, and it is worth watching.

OpenAI has already reported inbound prompt-injection cases involving internal coding agents where retrieved information influenced an agent to attempt actions it should not have taken, including attempts to email an external address. These examples were rare and were not generally attributed to malicious model intent, which is precisely what makes them interesting. The problem was not an evil agent. The problem was trusted execution meeting influential context.

And that brings me to a parallel I did not initially expect.

From Harvest Now, Decrypt Later to Embed Now, Exploit Later

Anyone following post-quantum security is familiar with Harvest Now, Decrypt Later.

NIST describes the threat as an adversary collecting encrypted information today even though they cannot decrypt it yet, preserving that information, and waiting for future computational capability that could make the captured data readable.

What makes Harvest Now, Decrypt Later strategically interesting is the separation between preparation and exploitation. The capability required to exploit the asset does not have to exist when the adversary acquires it.

That made me wonder whether agentic systems create an analogous temporal problem. I have been calling the thought experiment Embed Now, Exploit Later.

To be clear, I am not presenting that phrase as an established attack taxonomy, nor am I arguing that it is technically equivalent to Harvest Now, Decrypt Later. It is an adversarial analogy, but the analogy exposes something worth considering.

Suppose an adversary places carefully constructed information into a location an enterprise AI system may eventually consume: a knowledge repository, support ticket, software repository, collaboration workspace, project file, supplier record, archived email or another persistent information source.

Nothing necessarily executes. There may be no malware signature, command-and-control channel or privilege escalation. Perhaps the organization does not even have an agent capable of doing anything particularly consequential with the content yet. The information simply remains.

Then the environment changes.

The organization gives its agent another tool. Its reasoning capability improves. Persistent memory is enabled. A new data source becomes available. Another system gets connected. Perhaps the agent moves from recommending actions to executing them.

The risk associated with yesterday’s information has now changed because today’s agent possesses capabilities yesterday’s environment did not.

That is the proposition I think deserves examination. I am not suggesting that every old document suddenly becomes a cyberweapon. That would be absurd. The more defensible observation is that future capability can change the security significance of existing information.

Capability Has a Temporal Attack Surface

Traditional cybersecurity assessments tend to focus on what a system can do now. We ask what ports are open, what identities exist, what privileges have been assigned, what applications are accessible and what data can move.

Agentic systems may force us to add another question: What information, permissions and context become newly consequential when the agent gains a capability it did not possess yesterday?

That question changes the timeline of threat modeling.

An email that was harmless when only a person read it might deserve different treatment when an autonomous agent can interpret it, correlate it with internal records and invoke tools. A repository instruction that previously influenced a developer might take on a different risk profile when persistent coding agents automatically consume it. A knowledge-base article written years before the organization adopted AI could eventually enter the retrieval and reasoning environment of a system the original author never imagined.

Again, none of this means historical enterprise data should suddenly be presumed malicious. It means capability expansion should trigger a reassessment of the context that capability inherits.

The security review cannot end with, “What new thing can the agent do?” We may also need to ask, “What old information can now cause something new to happen?”

That is a much more interesting attack surface.

This Is Where Traditional Cybersecurity Becomes More Important, Not Less

None of this makes least privilege obsolete. Quite the opposite.

An agent that can read three data sources and cannot perform consequential actions represents a very different blast radius from an agent that can traverse email, repositories, cloud infrastructure, internal records and external applications.

OpenAI has increasingly framed prompt-injection defense around this reality: do not assume every malicious instruction can be perfectly identified. Design systems so the consequences remain constrained even when manipulation succeeds. That means limiting what an agent can reach, separating untrusted input from authority and adding deterministic controls around consequential actions.

That sounds remarkably familiar to cybersecurity practitioners because the underlying principles are familiar: defense in depth, least privilege, segmentation, trust boundaries, strong identity and containment. Those principles survived for a reason.

But I think their application has to expand.

Least privilege may increasingly need a companion concept: least agency.

Authorization cannot stop at what information an agent may access. We also need to understand which decisions the system may translate into action, how far it can pursue an objective without returning to the human, and which boundaries are enforced outside the model rather than merely described to it.

The distinction between those two things is critical.

Telling the escape-room player not to touch the ceiling is a policy. Making the ceiling physically inaccessible is a control.

That same logic applies to agents.

If crossing a boundary would create an unacceptable consequence, perhaps the strongest assurance evidence is not that the model was instructed to stay inside it. It is demonstrating that the system lacked the authority and means to cross it.

That is the heart of Objective Boundary Divergence.

Maybe We Have Been Securing the Escape Room

Which brings me back to the question that started this article: Are AI agents running circles around traditional cybersecurity defenses?

Maybe that is not quite the right way to frame it.

The firewall may be working perfectly. IAM may be doing exactly what it was designed to do. The endpoint may be clean. The API request may be legitimate. The user may be authenticated. The agent may even be pursuing exactly the objective we gave it.

And we could still have a problem.

Perhaps what agents are beginning to run circles around is not cybersecurity itself. They are running circles around the assumptions embedded inside it.

Like the escape-room designer, we secured the doors, built the puzzles and imagined the expected path. Then somebody looked up and noticed the ceiling.

The adversarial version should make us more uncomfortable because someone may notice that ceiling before we do, leave a mark pointing toward it, and rely on a future agent being capable enough to understand what the mark means.

I do not think the answer is to throw away the cybersecurity arsenal we already have. Keep it and strengthen it, but put light on the space between permission and consequence.

Understand where machine authority begins and ends. Treat the information an agent consumes as part of its security environment. Reevaluate inherited context when capabilities materially change. Put deterministic controls around actions whose consequences exceed the authority we intended to delegate.

Most importantly, stop assuming that functioning controls automatically mean the system is operating inside the boundaries we intended.

The next generation of cyber defense may depend as much on understanding how machines pursue objectives as understanding which systems they can access.

Everything in our cybersecurity arsenal still matters.

It simply isn’t the whole arsenal anymore.