What Happened
Unit 42 reports that ransomware operators, including Spikey Scorpius (Qilin) and Tarnished Scorpius (Inc), are actively exploiting PAN-OS CVE-2026-0257. Its updated threat brief establishes active exploitation, but the research notes do not specify the exploit mechanism or affected configurations [1].
Microsoft Security argues that AI agents create a different kind of exposure: they can act on company data and tools, and can cause harm through mistakes, manipulation or compromise. Its proposed controls include agent discovery and identity, task-specific Dynamic Permissions, risk-based access changes and human approval for higher-impact actions [2].
Why It Matters to Businesses
These threats meet at the same operational boundary. An agent with broad tool access can turn a manipulated instruction into an authorized API call; an exploited infrastructure component can undermine the environment in which agents and business applications run. Neither problem is solved by asking a model to police itself. Agent permissions need enforcement outside the model, while exposed infrastructure needs conventional vulnerability and incident response [1][2].
Kimbodo Engineering Perspective
Identity and authorization matter more than an agent’s stated intent. Model-level risk signals can help detect trouble, but the decisive control is whether an independently enforced policy permits a particular action on a particular resource. Discovery must precede that policy: teams cannot constrain agents they have not inventoried. Microsoft describes a unified registry and Entra Agent ID for accountability, alongside discovery across local agent types [2].
Controls should be proportional. Read-only retrieval may run automatically within a narrow scope; changes to production systems, financial records or external communications warrant tighter limits or approval. Those approvals add latency, so they should be reserved for consequential actions rather than applied to every tool call [2].
How We Would Implement It
- Inventory agents, their owners, identities, tools, data sources and MCP server connections. Remove unused access and assign each production agent a distinct identity [2].
- Place a policy-enforcing gateway between agents and tools. Issue task-specific, time-bound permissions; validate resource scope and arguments at execution time, not only when a task begins [2].
- Run agents in controlled environments with restricted network paths. Log tool requests, policy decisions, approvals and resulting actions so investigators can reconstruct an incident.
- Use activity and model-level signals to raise risk, then narrow permissions, require approval or stop execution. Keep people responsible for policy and consequential decisions [2].
- In parallel, identify PAN-OS exposure to CVE-2026-0257, follow vendor remediation guidance and investigate relevant signs of compromise. Do not treat agent controls as a substitute for responding to active ransomware exploitation [1].
Risks, Costs and Security
Fine-grained authorization requires reliable identity, resource classification and maintained tool policies. Risk-based controls can interrupt legitimate work, while approval queues can become bottlenecks. Pilot policies against real workflows, measure blocked and escalated actions, and provide a tested way to revoke agent access quickly. For CVE-2026-0257, prioritize verification and response against authoritative vendor guidance rather than assuming details not established by the cited threat brief [1][2].
Where Kimbodo Comes In
Kimbodo builds and operates this in production for businesses — see our AI Security & Guardrails practice, or Request a Security Review.
