Most organizations have agents acting outside of intended scope

Like the cookie tin that now houses sewing supplies at Nana’s house, most enterprises are witnessing agents do things outside of their original purpose.

According to an August report from Enterprise Management Associates for Cequence Security, 65% of companies said they’ve had an AI agent perform actions outside of its intended scope. Of those companies, 29.2% said these occurrences had a measurable impact (e.g., data exposure, financial loss, etc.) on their business. The findings are based on a survey of 202 global IT and security leaders at organizations deploying or evaluating agentic AI.

The governance problem. Cequence CISO Randolph Barr told IT Brew the high rate of unintended-action performing agents are a byproduct of governance and technical failures within organizations.

“A lot of organizations adopt AI quickly. They sometimes don’t have the proper controls in place to detect what these agents are doing, and on top of that, [are] assigning general access to these agents, not going through a review process and making sure that what the intention of an agent is…doing what it’s supposed to do,” Barr said.

The report revealed several governance gaps at different stages of the agent life cycle. One is at the provisioning stage: While almost half (48.5%) of organizations said they felt very confident their agents don’t have more access than needed to perform their intended tasks, only 32.7% provision agents with least-privilege access.

Authorization was another problematic area for organizations. Only about a third (34.2%) of enterprises said they evaluate authorization the moment an agent tries to execute a specific action. The highest proportion of organizations surveyed (37.6%) evaluated authorization periodically through policy reviews, while 21.3% claim authorization is based on standing permissions assigned to agents.

“Over time, the gap between what an agent is technically authorized to do by its standing permissions and what it actually needs for any given task grows wider, and that widening gap is the direct mechanism through which overprovisioning becomes the 65% incident rate,” the report states.

What’s an IT pro to do? Based on the findings, the report suggests companies build out detection and containment capabilities prior to scaling agent deployment and govern “what agents do, not just what they are.”

“Defining what an agent is permitted to do—task by task, within enforced behavioral limits—is the single most consequential control available,” the report wrote. “Treating agent authorization as a provisioning event rather than a runtime discipline will continue to produce out-of-scope actions discovered only after the fact.”

Barr added organizations should identify all agents that exist in their ecosystem and have a central place where they can manage these agents.

“The inventory is one of the biggest concerns everybody has,” Barr said. “We don’t know what to protect what we don’t know exists.”