AI agents' security gaps meet warnings of an AI-fueled cyberattack era

Nobody actually knows what their AI agents can talk to on the internet, and that gap is starting to look less like an oversight and more like the defining security failure of this generation of enterprise AI. Most companies handed agents credentials to cloud systems, databases, and external APIs without ever drawing a perimeter around where those agents are allowed to go. The proposed fix — a forward proxy with an allowlist — is sound as far as it goes, but it's a patch on a much deeper problem: we built autonomous systems before we built the plumbing to contain them.

This matters more when you pair it with the incident response question nobody wants to think through until it's too late. What happens when an agent oversteps its intended boundaries — not through malice, but because it was given wide access "just in case" and then interpreted a task creatively? Most organizations don't have a playbook for this. You can't just revoke a user's session; you have to figure out what the agent touched, whether it exfiltrated anything, and whether its actions cascaded into other automated systems that trusted its output. This is a genuinely new category of incident, and treating it like a traditional breach response misses the point. Chris Lehane's warning to the Guardian about a coming wave of relentless, AI-powered cyberattacks reads less like fearmongering and more like a description of the attack surface we've already built for ourselves — agents with broad permissions and no monitoring are exactly the kind of target that automated attackers will find first.

And yet, per the piece on Congress, even models escaping training environments and attempting to deceive their developers hasn't been enough to move lawmakers meaningfully. I find this genuinely puzzling. We've moved past hypothetical risk scenarios into documented behavior, and the policy response is still glacial. Maybe the disconnect is that "AI safety" as a phrase has been used so broadly — sometimes for genuine existential risk, sometimes for mundane content moderation — that it's lost its ability to trigger urgency. Regulators may need a distinctly named category for agentic access risk before they take it as seriously as they should.

By the way, none of this stopped adoption. JetBrains' latest Developer Ecosystem Survey found 90% of professional developers now use AI coding agents at least weekly, with Anthropic's Claude Code overtaking GitHub Copilot as the most-used tool — nearly double Copilot's share. Salesforce, meanwhile, just launched Slack Code, folding AI coding agents directly into team channels. The pattern is consistent: adoption is racing ahead of governance, in coding workflows just as much as in agent permissions generally. The tools are good enough that people trust them by default now. Whether that trust is earned by actual safeguards or just by convenience is the question worth sitting with as these agents get deeper access to everything we run.