What Happened
Microsoft’s 2026 Digital Defense Report describes attacks spanning identities, applications, cloud systems, infrastructure and software supply chains. Its findings indicate that attackers are using AI to accelerate and tailor established techniques, while both attackers and defenders use AI to find software vulnerabilities. [2]
In Microsoft’s observations, government agencies and services accounted for 27% of cyber activity, up from 17% the previous year. Phishing rose from 7% to 23% of observed intrusions; attackers also remained undetected longer. Vulnerabilities can be weaponized in under 24 hours, and 52.2% of intrusions involving valid accounts led to further credential theft. These figures describe Microsoft’s observed activity, not a universal attack rate. [1]
Why It Matters to Businesses
An AI agent with access to email, documents, code repositories or cloud tools can turn a compromised account or unsafe instruction into actions across several systems. The business risk is not limited to a bad model response: it includes unauthorized data access, credential exposure and changes made through legitimate integrations. Faster vulnerability exploitation also reduces the time available to assess and patch exposed services. [1][2]
Kimbodo Engineering Perspective
Treat an agent as a privileged application, not a trusted employee. Its model output should never be sufficient authorization for a sensitive action. Prompt-injection tests matter, but they do not replace identity controls, least privilege, secure development and monitoring—the controls Microsoft recommends as agents gain enterprise access. Human review remains important for consequential decisions and investigations. [2]
OWASP AI guidance and MITRE ATLAS can help organize threat modeling and test cases. They should be used alongside, rather than instead of, an inventory of the actual data, identities and tools an application can reach.
How We Would Implement It
- Inventory agent tools, data stores, service accounts and downstream dependencies; assign an owner and a permitted action set to each integration.
- Give each agent a distinct identity, short-lived credentials and narrowly scoped access. Enforce authorization in the tool or API, outside the model’s prompt.
- Separate untrusted retrieved content from instructions. Validate tool arguments and outputs, and require approval for high-impact actions such as sending external messages or changing production systems.
- Log prompts, retrieval references, tool calls and authorization decisions with appropriate data minimization. Alert on unusual access and credential use; rehearse containment and credential rotation.
- Prioritize patching by exposure and business impact, and test agent workflows against prompt injection, data exfiltration and compromised-tool scenarios.
Risks, Costs and Security
Approval gates and narrow permissions add latency and can limit automation; comprehensive logs create storage, privacy and access-control obligations. Conversely, broad service accounts and opaque tool execution make incidents harder to contain or investigate. Budget for continuous access reviews, dependency monitoring, adversarial testing and incident exercises—not just initial model evaluation. For organizations sharing threat information, common anonymization rules and clear escalation paths can make that information safer and more actionable. [1]
Where Kimbodo Comes In
Kimbodo builds and operates this in production for businesses — see our AI Security & Guardrails practice, or Request a Security Review.
