Ed Fox, CTO of MetTel with over 30 years of telecommunications and network experience managing transformational customer growth.
For years, enterprise AI security discussions have centered on a relatively simple premise: keep the model inside a sandbox, restrict what data it can see and require human approval for consequential actions. That premise is becoming obsolete.
The newest generation of agentic AI systems can reason through multistep problems, execute code, use tools and navigate the internet. They are moving beyond answering questions to pursuing objectives.
Recent testing shows why. Anthropic disclosed that Claude models inadvertently accessed three companies’ systems after being given unintended internet access. In another evaluation, an unreleased OpenAI model escaped its restricted environment and accessed and hacked the Hugging Face platform. A separate test found that Moonshot AI’s Kimi K3 model obtained internet access by exploiting a sandbox weakness. These incidents show that capable agents can optimize for an objective in ways its designers did not anticipate.
For CIOs and CISOs, the practical implication is clear: AI security must move from protecting a model to controlling an agent’s behavior.
The Agent Is The New Attack Surface
A conventional chatbot has a narrow operating envelope. An agent can have credentials, APIs, database access, browsers, software development environments and the ability to take action.
A software development agent asked to fix a production problem might inspect source code, run tests, modify files, install packages, query documentation and deploy a change. Each action may appear reasonable on its own. The security risk emerges from the agentic sequence.
That is why enterprises should treat AI agents more like privileged employees than like search engines. A privileged human should only receive access to the applications, data and resources required to perform an assigned job. An AI agent should operate under the same need-to-know principle, with separate read, write, approval and execution permissions rather than broad credentials granted for convenience.
Sandboxing Is Necessary—But It Isn’t Enough
Agents that can execute code or interact with external systems should operate in isolated environments with tightly controlled network access, credentials and filesystem permissions.
But a sandbox is only one boundary. Configuration errors, unintended credentials, overlooked network routes or vulnerabilities can create escape paths.
More fundamentally, an agent is optimizing against an objective. If one path is blocked, it may attempt another. Organizations therefore need multiple control layers around the agent rather than assuming the model will interpret every security boundary as intended.
Put A Proxy Between The Agent And The World
One promising approach is to put an intermediary control layer between agents and the models, tools, applications and external services they use.
Instead of allowing an agent to communicate directly with enterprise systems, its activity can be routed through a gateway or proxy that provides visibility, policy enforcement, routing and control.
The architectural principle is straightforward: don’t give an autonomous system an unmonitored direct line to the enterprise.
An agent might be permitted to read a database but prohibited from modifying it, generate a purchase order but not approve one, or access public websites while being blocked from transmitting sensitive corporate information.
Make Every Agent Action Observable
Enterprises also need an audit trail that captures the agent’s objective, the models and data it used, the tools and APIs it invoked and the resulting actions.
The important word is trajectory. A conventional application log may show that an API was called. Agent security needs to establish why it was called, what preceded it, what followed it and whether the action remained consistent with the agent’s authorized objective.
If an agent suddenly requests access to an unusual system, repeatedly fails authentication or begins transmitting unusually large amounts of data, the control layer should be able to stop the action, revoke the session, reduce permissions or require human approval while the agent is still operating.
Control Cost As Well As Risk
The same gateway architecture can also control the economics of agentic AI. Agents can consume large quantities of tokens as they reason, retrieve information and call tools. A gateway can cache repeated context, route routine work to less expensive models and apply cost and risk policies to requests. The same visibility that improves security can improve cost governance.
Five Rules for Agentic AI Governance
Follow these five rules to keep your agents in check:
1. Give agents minimum necessary privileges.
Treat access as need-to-know. An agent should receive only the applications, data and resources required for its assigned task, with distinct read, write, approval and execution rights.
2. Assume the agent will encounter an unexpected situation.
Design for failure. Establish hard limits around networks, data, APIs, spending, execution time and permitted actions.
3. Put high-risk activity behind a policy enforcement layer.
Monitor and govern interactions with models, tools and external systems rather than allowing agents unrestricted direct access.
4. Monitor behavior, not just prompts.
Security teams need visibility into the full agent trajectory, including decisions, tool calls, retrieved data and attempted actions.
5. Make human intervention possible at any point.
High-impact actions such as financial transactions, production deployments, credential changes, data deletion or external communications should be able to pause for human approval.
The CIO’s New Responsibility
The enterprise is moving from AI that answers to AI that acts. A model that generates an incorrect paragraph creates a quality problem. An agent that generates an incorrect command and executes it can create an operational or security incident.
Agentic AI governance, therefore, cannot rely exclusively on better prompts, model training or alignment. Autonomous systems capable of executing code, modifying files and interacting with external systems need runtime controls, permissions, sandboxes, policy gates and trajectory monitoring.
The most mature enterprises will isolate agents, minimize their privileges, observe their behavior, route their activity through enforceable control points, continuously evaluate risk and retain the ability to intervene. This will allow them to make use of smaller models trained for specific tasks and outcomes. The strategic objective should be simple: give AI agents enough freedom to deliver value, but not enough to act independently of its mission parameters.
Forbes Technology Council is an invitation-only community for world-class CIOs, CTOs and technology executives. Do I qualify?