Their main worry is agents being talked into "authorized-looking" actions. The framing that stood out: the main risk isn't the model making a mistake; it's an attacker instructing the agent to do something that looks authorized. Their approach is defense in depth: monitoring, auditing, guardrails, and a kill switch to shut down a misbehaving model.

Also in the piece: TII's CEO says an agent you can't monitor in real time "is malware that got access to your machine," and that non-human agents need clear identities. Kaspersky describes "living off local agents," where attackers use an agent already on the machine to find valuable data.

Source: www.khaleejtimes.com/business/tech/ai-agents-tricked-accessing-sensitive-government-data-cybersecurity

For those running agents in production: do your agents have their own identities and least-privilege scopes, or do they inherit a user's or service account's permissions? And who owns the kill switch?

Ran into this last week while updating a couple recipe posts. I fed a generator a prompt for a new herb mix and the output looked fine until I tried uploading the draft. The site blocked it with a modsecurity rule on one line. Switched models and the same thing happened with different text. The phrases don't look like attacks to me, but they match whatever word order the rules are set to catch. Manual cleanup didn't help since the next run just created new strings that tripped the same rules. Wondering how often this happens with normal writing and if anyone found a fast way to strip whatever the WAF is actually looking for.