Vasanth Mudavatu, Senior Principal Software Engineer at a Fortune 50 company, dedicated to the security of generative AI and ML systems.
Enterprise AI security is no longer just about preventing inaccurate answers. It’s about preventing an automated system from using legitimate access to expose confidential information or execute unauthorized actions.
EchoLeak, which was disclosed in June 2025, was a Microsoft 365 Copilot vulnerability that allowed a crafted email to trigger data exfiltration without requiring the victim to click a malicious link. Microsoft assigned it a CVSS severity score of 9.3, while NIST separately rated it 7.5.
Microsoft patched the vulnerability, and no evidence of exploitation in the wild was reported. This was a demonstrated vulnerability rather than a confirmed breach, but it exposed a consequential failure: External content could influence a system operating with access to internal information.
If an AI agent put customer data, revenue or reputation at risk today, could your organization explain what happened and stop it before the damage spread? The answer depends less on reassuring model behavior than on enforceable boundaries.
The framework below connects four activities: assessing six security blind spots, prioritizing findings, implementing controls in phases and verifying that those controls work.
Six Security Blind Spots
Attackers can automate reconnaissance, credential harvesting and data extraction. Enterprises need to examine both how AI can be attacked and how it can accelerate attacks.
Being aware of the following six blind spots turn that concern into an actionable security assessment:
1. Model Integrity: Authentic Doesn’t Mean Safe
A downloaded model shouldn’t become a trusted production asset simply because it comes from a familiar repository. Modified weights, backdoor triggers and unsafe model-file deserialization are areas requiring scrutiny.
Recommended controls include verifying artifact signatures and hashes, documenting provenance, scanning inbound files and testing model behavior before deployment. Integrity verification establishes whether an artifact matches an approved baseline; behavioral testing examines whether it performs as expected. Neither replaces the other.
2. Agent Permissions: Enforcing Limits Outside The Model
Disabling an agent isn’t necessarily the same as removing its access. Credentials, active tokens and downstream permissions may remain usable.
Agents need distinct identities, least-privilege access and short-lived credentials, and revocation workflows should be tested. Assessment should also consider combined permissions across tools, as individually acceptable capabilities may collectively create an unacceptable access path.
A useful operational test is straightforward: Disable an agent and verify that its downstream actions actually stop.
3. Runtime Data Exfiltration
Inspecting the final response covers only one potential exit point. Sensitive information may also appear in tool-call arguments, logs, traces or data written to vector stores.
Monitor these boundaries, restrict outbound destinations and correlate activity across requests. That correlation matters because information can leave in small fragments rather than one easily detected transfer.
The assessment should follow the complete data journey, not just the conversation visible to the user.
4. Supply Chain: Securing The Path Into Production
The security boundary includes more than the model. Build workflows, libraries, containers and deployment dependencies also require review.
Scan inbound model artifacts, pin third-party GitHub Actions to specific commit hashes and maintain an AI-specific inventory of model and software dependencies. These measures help teams identify what they deployed and investigate compromised components.
The objective is traceability, knowing which artifacts and dependencies support each production capability.
5. Multi-Agent Lateral Movement
A compromised agent may use legitimate tools and credentials to interact with connected systems. Shared memory and agent-to-agent communication introduce additional paths through which malicious instructions can propagate.
Organizations should authenticate communication, verify message integrity, inspect memory and implement per-agent quarantine. Additionally, review Model Context Protocol tool metadata for adversarial instructions or unapproved changes.
Trust should be established at each boundary rather than inherited automatically from another agent.
6. Agent Identity And Lifecycle Governance
An agent inventory must capture more than a name. Security teams need ownership, approved capabilities, authorization context and a defined retirement process.
Automate discovery, log audits at the action level and decommission workflows that revoke credentials, address retained memory and preserve required audit records. These controls connect governance decisions to what agents do.
Turning Findings Into Decisions
A gap analysis becomes useful when it drives priorities. Evaluate risks using likelihood, impact, difficulty of detection and an exposure multiplier for multi-agent environments.
Treat the resulting score as a prioritization aid, not an objective prediction. Organizations should document their assumptions and calibrate escalation thresholds to their own systems and business consequences.
For each finding, record:
• The affected agent, model or workflow.
• The missing control and supporting evidence.
• The accountable owner.
• The remediation deadline.
• The test that will demonstrate closure.
Don’t consider a control complete merely because a policy or configuration exists. Closure should require evidence that it works.
Implementing In Phases
The roadmap begins with agent discovery, model integrity checks, outbound monitoring, pipeline hardening and kill-switch implementation. Subsequent phases introduce managed identities, behavioral testing, inter-agent authentication, memory inspection and automated response workflows.
This sequencing provides a practical starting point—establish visibility and containment first and then deepen prevention and detection.
The strongest contribution of this framework is its operational focus. It asks teams to connect model provenance, agent permissions, runtime activity and incident response rather than assess each in isolation.
Measuring What Works
Leadership reporting should emphasize measurable coverage and tested effectiveness. Useful measures include the proportion of agents under governance, model integrity verification coverage, supply chain scanning coverage and decommissioning compliance.
These measures should be considered alongside the evidence used to close individual findings, connecting implementation progress to demonstrated control effectiveness.
Making Security Operational
For enterprise leaders, the goal isn’t to eliminate every uncertainty before deploying AI. It’s to make that uncertainty manageable with accountable ownership, observable actions and tested intervention paths. Governance sets expectations; operational evidence shows whether the organization can enforce them.
Forbes Technology Council is an invitation-only community for world-class CIOs, CTOs and technology executives. Do I qualify?