AI agents that break security rules: lessons for SMEs

When AI acts on your behalf: the risk of agents that ignore the rules

AI agent security has become a hot topic. A recent article from The Hacker News recounts how a team built an agent that, by default, violated three basic principles they themselves recommended to their clients: its own identity, access tailored to the task, and traceability separate from that of any human. The experience, far from being a failure, helped them rethink how to defend this type of tool.

The case is especially relevant for SMEs, which are increasingly adopting assistants and intelligent agents without the resources of a large cybersecurity department. Ease of integration and the promise of automating tasks are a magnet, but they also open a door that many were not watching.

The three pillars an agent can blow up

The original article describes how the agent, operating within an authenticated user session, ended up acting with that person's privileges and without leaving a clear trace of its actions. This breaks three fundamental controls:

• Its own identity: agents must have unique credentials, not reuse an employee's. This prevents anomalous behavior from being confused with a legitimate user action.
• Least access: the agent should have only the permissions necessary for the task assigned. A browser agent that inherits all of the user's permissions can read emails, modify files, or make purchases without control.
• Independent traceability: the agent's activity logs must be separate from the human's. Otherwise, in the event of an incident, it will be impossible to distinguish whether the action was the user's or the agent's.

The Token team found that, by default, their agent failed on all three fronts. This is not an isolated case: many generative AI tools and autonomous agents prioritize ease of use over security, and integrators often do not configure these aspects.

What does this mean for an SME?

For a small or medium-sized company, adopting AI agents can mean a qualitative leap in productivity, but also a risk if controls are not established. Imagine an agent that manages email and automatically responds to customers. If it inherits the identity of the sales director, it could send confidential information to the wrong recipient or fall for a phishing scam without anyone detecting it until it is too late.

Furthermore, the lack of traceability complicates regulatory compliance. Regulations such as the GDPR require being able to audit who accesses what data. If an agent acts with an employee's identity, auditing becomes blurry.

The good news is that these risks are manageable. The original article suggests that, after the incident, the team was able to implement safeguards. At ForgeNEX we believe that SMEs can apply similar measures without major investments.

Practical recommendations for IT teams

Based on the lessons from the article and our experience, we propose a simple roadmap:

1. Review your agents' identity: make sure each agent has its own service account, with rotating credentials and no access to data it does not need. Do not allow it to use an employee's account.
2. Apply the principle of least privilege: configure granular permissions. For example, if an agent should only read emails from a specific mailbox, do not give it access to the entire account.
3. Enable separate logs: activate auditing specifically for agents. Many platforms allow actions performed by bots to be tagged. If this is not possible, at least periodically review the logs for anomalous patterns.
4. Set limits on actions: define what the agent can and cannot do. For example, that it cannot send emails without human oversight or that it cannot access financial data.
5. Test and monitor: before putting an agent into production, carry out controlled tests to verify that it respects the rules. Afterwards, monitor its behavior with alerts for deviations.

These measures do not require a dedicated team, but they do require some planning. In many cases, it will be enough to review the configuration of the tools you already use.

A change of mindset

The Token case reminds us that AI security is not just a problem for large companies. Autonomous agents are reaching SMEs through productivity assistants, chatbots, and automation tools. If we do not treat them as independent identities, give them a master key, and stop watching them, we will be creating a blind spot in our security.

As we have seen in other recent incidents, such as the theft of AI keys at Railway or CrowdStrike's acquisition of Fiddler and Dreadnode, the sector is moving toward greater awareness. SMEs must get on that train with proportionate but firm measures.

At ForgeNEX we recommend starting with an inventory of the agents and assistants in use, reviewing their permissions, and establishing a monitoring plan. Security is not an obstacle to innovation, but the foundation for making it sustainable.

The next time you integrate an AI agent, ask yourself: does it have its own identity? Does it access only what is necessary? Can I track what it does? If the answer is no, you are facing an avoidable risk.

Source: The Hacker News. Analysis and adaptation: ForgeNEX.