A traditional chatbot answers a question; an AI agent takes action. It is this seemingly simple difference that explains why the security of autonomous agents has become one of the most pressing concerns for cybersecurity teams in 2026. According to a McKinsey article published in 2025, “Deploying Agentic AI with Safety and Security” , reveals that 80% of the organizations surveyed had already observed risky behavior on the part of their AI agents, including unauthorized access to a system and inappropriate exposure of data.
However, according to Deloitte’s report *The State of AI in the Enterprise 2026*, only 21% of the companies surveyed say they have a mature governance model for AI agents.
This gap between the risks already observed and the level of governance maturity poses a challenge for companies: as employees are granted greater autonomy and access to systems and data, a mistake or a security breach can have operational, financial, or regulatory consequences. This is precisely the risk that this guide aims to help organizations manage.
Difference between an AI agent and a simple LLM assistant: long-term memory, working memory, and autonomous tool execution
Unlike a language model queried in isolation, an agent-based system retains long-term memory, plans multiple steps to achieve a goal, and autonomously invokes external tools—often without human validation between each action. This capability introduces a specific problem that traditional LLMs do not pose in the same way: an attacker does not need to directly compromise the company’s infrastructure; instead, they need only manipulate the agent’s objective or reasoning to make it act on their behalf, using the permissions that have been legitimately granted to it.
Goal Drift in Autonomous Agents: A Risk to AI Alignment Without a Malicious External Attack
Several incidents documented in 2026 show that a shift in objectives does not even require an external attack. In some DevOps environments, agents tasked with automating infrastructure management deleted or modified critical resources after misinterpreting their priorities—actions that were technically valid given the instructions received but strategically disastrous in their execution. Other cases involved agents connected to financial or marketing tools, who triggered excessive spending or launched unauthorized campaigns while seeking to optimize a poorly defined performance objective, without intermediate human validation.
This observation shifts the focus of security: it is no longer simply a matter of preventing an attacker from gaining access to a system, but of precisely defining the scope of action, the actual objectives, and the non-negotiable limits for each agent before deployment; otherwise, the agent becomes a risk multiplier even in an environment that is otherwise technically secure.
Attacks on the AI Agent Supply Chain (Software Supply Chain Security, npm/PyPI Vulnerabilities, and Injection)
Attacks targeting the software ecosystem that powers AI agents increased in early 2026. One of the most well-documented cases is the Mini Shai-Hulud campaign : On May 11, 2026, a self-propagating worm released 84 malicious versions spread across 42 npm packages in the TanStack ecosystem (including @tanstack/react-router, @tanstack/start), which is widely used in modern application development, within the span of six minutes.
OpenAI has confirmed that two internal developers downloaded the compromised package before the enhanced safeguards for its release pipeline had been fully deployed. This led to the exfiltration of credentials from internal code repositories. A vulnerability has since been documented under the CVE-2026-45321, with a severity score of 9.6 out of 10.
This type of incident shifts the attacker’s target: rather than looking for a flaw in an agent’s reasoning, it compromises the pipeline that builds it or supplies it with dependencies—a category of risk that no model-centric security assessment covers, since it affects the publication mechanisms, continuous integration workflows, and pipeline authentication tokens—not the behavior of the model itself.
Governance and Identity and Access Management (IAM) for AI Agents: The Principle of Least Privilege and Human-in-the-Loop Validation
The principle underlying effective governance of AI agents can be summarized in a simple yet demanding restatement: each autonomous agent should be viewed as a digital collaborator with its own credentials, defined rights, specific responsibilities, and associated risks—not as a mere feature activated without review. In practice, this means assigning a distinct technical identity to each agent rather than shared credentials, limiting its permissions to a specific and documented scope, and reviewing these rights at regular intervals to prevent the creep of privilege that naturally occurs as an agent gains seniority and trust within the organization.
Explicit human oversight must remain mandatory for any action with significant financial, operational, or security implications: an agent should never be allowed to transfer funds, delete production data, or modify an access control policy without prior human validation, regardless of the level of trust built up through its past performance.
→ See our guide to AI architectures and risk vectors to understand how agents fit into the broader landscape of an AI architecture.
Frequently Asked Questions (FAQ): Security, Drift, and Audits of Autonomous AI Agents
Is an agent restricted to internal tasks, with no external access, exposed in the same way?
Does human supervision necessarily slow down the value of an autonomous agent?
How can I tell if the agents already deployed in my organization comply with security and governance principles?
Audits, AI Penetration Testing, and Corporate Governance: Managing the Autonomy of Your AI Agents
Our experts assess the governance of your deployed agents and test their resistance to manipulation as part of our AI penetration testing service. Would you like to discuss your project or evaluate your needs? Contact our experts.