What Happened
Unit 42 reports active ransomware exploitation of PAN-OS CVE-2026-0257, including activity attributed to Spikey Scorpius (Qilin) and Tarnished Scorpius (Inc). Its threat brief was updated on October 19 [1].
Microsoft describes AI agents as a new insider-risk category: agents can act across business systems at machine speed, whether their actions result from mistakes, manipulation or compromise. Its proposed controls include agent discovery and identity, constrained runtimes, task-scoped permissions, risk assessment, and conditional restrictions on agent actions [2].
Why It Matters to Businesses
These are different security problems that can compound. An exploited network device can threaten the environment in which AI applications operate; an overprivileged agent can then make a mistake or be induced to use legitimate access in harmful ways. Neither a model’s instructions nor a firewall rule alone establishes safe authority for an agent. Access and action limits need enforcement outside the model [1][2].
Kimbodo Engineering Perspective
We would prioritize confirmed exposure to active exploitation while designing agent controls around least privilege and bounded execution. Agent discovery and a registry improve accountability, but identity alone does not make an action safe. A policy decision must account for the requested tool, data, operation and current risk before execution. Human approval is most useful for consequential writes, not every routine read [2].
How We Would Implement It
- Inventory PAN-OS assets, determine exposure to CVE-2026-0257, follow current vendor remediation guidance, and investigate relevant device and network activity for signs of compromise [1].
- Register each production agent with an accountable identity. Keep its credentials separate from user and service credentials, and grant only the tools, data and execution time required for its task [2].
- Route tool calls through an external policy gateway that checks identity, task scope and operation type. Require approval for high-impact writes; deny or suspend actions when risk signals warrant it [2].
- Record agent tool requests, policy decisions, approvals and outcomes so responders can reconstruct actions and revoke access quickly. Test the gateway against manipulated inputs and attempts to exceed task scope.
Risks, Costs and Security
Policy gateways, approvals and audit trails add latency and operational work. Overly broad permissions leave agents dangerous; overly strict rules make them ineffective. Risk-based restrictions also depend on timely, reliable signals and a clear owner for exceptions. Treat the PAN-OS exploitation report as an immediate exposure and incident-response priority, while treating agent governance as an architectural control that must be tested continuously [1][2].
Where Kimbodo Comes In
Kimbodo builds and operates this in production for businesses — see our AI Security & Guardrails practice, or Request a Security Review.
