What Happened
Microsoft Security reports that active agents in its Microsoft 365 ecosystem grew 15-fold year over year, and 18-fold in large enterprises. It frames the CISO’s task as both governing those agents and defending against AI-enabled attacks [2]. Separately, Unit 42 highlights ransomware and AI-enabled attacks among the threats retailers face during peak shopping season [1]. Neither report establishes a new, specific AI vulnerability; together, they point to a growing operational security problem.
Why It Matters to Businesses
An agent with access to business data and tools is another identity to govern. If its permissions are too broad, a compromised account or malicious instruction may reach systems the agent never needed. For retailers, disruption during peak demand can also affect operations and customer trust [1]. Businesses need to know which agents exist, who owns them, what they can access, and what actions they take [2].
Kimbodo Engineering Perspective
Treat agents as privileged software components, not trusted employees. Model safeguards can help, but they do not replace access controls. The practical trade-off is autonomy: allowing an agent to act without approval speeds routine work, while restricting sensitive actions limits the damage from mistakes or abuse. Set that boundary according to the consequence of each action, not the apparent confidence of the model.
How We Would Implement It
- Inventory agents, assign each an owner and governed identity, and review permissions regularly [2].
- Give agents short-lived credentials and the minimum data and tool access required. Keep payment, identity, and production-administration actions behind separate authorization checks.
- Validate tool inputs and outputs, and treat retrieved documents, emails, and web content as untrusted instructions. Require human approval for high-impact changes.
- Log prompts, tool calls, permissions, and outcomes with appropriate data minimization. Alert on unusual access or actions, and provide a way to disable an agent quickly.
- Test failure paths—including prompt injection and unauthorized data access—before deployment and after changes. Use OWASP AI guidance and MITRE ATLAS as checklists for threat modeling, not as substitutes for system-specific testing.
Risks, Costs and Security
Agent inventories, approval gates, and detailed monitoring add engineering work and can slow workflows. Logging can expose sensitive data if retention and access are poorly controlled. Prioritize the strongest controls where an agent can move money, change production systems, or access customer records; use lighter controls for read-only, low-impact tasks. Security teams should combine agent visibility with existing threat signals and analyst workflows rather than create an isolated AI dashboard [2].
Where Kimbodo Comes In
Kimbodo builds and operates this in production for businesses — see our AI Security & Guardrails practice, or Request a Security Review.
