What Happened
Recent security reporting highlights two connected problems for AI deployments. Unit 42 identified edge exploits, credential abuse and phishing among the leading initial-access vectors it observed in September 2026; the available summary does not name the remaining two vectors [1]. Separately, Microsoft and NVIDIA published enterprise guidance arguing that open-weight model risk depends on the model, use case, deployment and safeguards—not on whether the weights are open alone [2].
The guidance groups risks into cybersecurity, data protection, content, human–AI interaction and bias. It treats model evaluations as evidence for particular risks, not proof that an entire agent or application is safe [2].
Why It Matters to Businesses
An AI application can be compromised without an attacker defeating the model itself. A stolen credential or exposed edge service may provide access to prompts, retrieved data, tool connections or the infrastructure hosting an open-weight model [1]. Conversely, a model that performs well in evaluations can still cause harm if an application grants it excessive tool permissions or sends sensitive data to an unintended destination [2].
Kimbodo Engineering Perspective
Secure the system the model operates in, not just the model. The practical trade-off is between useful automation and authority: an agent that can read more data and execute more actions needs stronger identity, authorization, monitoring and recovery controls. Model choice and evaluations matter, but controls must also sit at the runtime, application and operational layers, then be revisited when the deployment changes [2].
How We Would Implement It
- Map each AI use case to its data, users, model, retrieval sources and tools. Record the specific risks an evaluation can test and the risks it cannot [2].
- Place tool calls behind server-side authorization. Give agents narrowly scoped credentials, require approval for consequential actions and log tool requests and outcomes.
- Harden internet-facing services, enforce multifactor authentication and monitor suspicious sign-ins and phishing-driven account misuse, reflecting the initial-access vectors Unit 42 observed [1].
- Test the complete workflow—including untrusted retrieved content, permission boundaries and failure handling—before release and after changes to models, tools or data access [2].
Risks, Costs and Security
Isolation, approval steps and detailed logging add engineering work, latency and operating cost; overly broad controls can also make an application unusable. Prioritize them by the sensitivity of the data and the consequences of each permitted action. The residual risk should be explicit: passing a model evaluation does not establish application safety, and a well-designed agent still depends on sound infrastructure and identity security [1][2].
Where Kimbodo Comes In
Kimbodo builds and operates this in production for businesses — see our AI Security & Guardrails practice, or Request a Security Review.
