AI agents

Token Security CEO Itamar Apelblat argues that agentic AI has an identity problem that attackers are beginning to exploit. He contends that AI agents act as digital actors that authenticate, receive permissions and call APIs across production systems, often using credentials that nobody has fully inventoried. The article frames the core security questions as who the agent is, what it may do, who is accountable, and whether its access can be revoked or constrained.

Google DeepMind researchers categorized malicious web and document content that manipulates AI agents into six types of "agent traps," including content injection, semantic manipulation and cognitive state traps. In NIST evaluations of agent hijacking, injected instructions succeeded on average 57% of the time across five tested injection tasks. Research presented at USENIX found that five crafted texts per target question caused a RAG system to give the attacker's chosen answer in about 90% of cases.

Google has made computer use a built-in tool in Gemini 3.5 Flash, moving it from the standalone Gemini 2.5 computer use model into the main Flash model. Developers can use it through the Gemini API and the Gemini Enterprise Agent Platform to build agents that see, reason and act across browser, mobile and desktop environments.

Emanuel Salmona, CEO of Nagomi Security, argues that an agentic AI system is only as good as the context it operates on. Without an accurate, correlated view of assets, controls, exposures and threats, the agent acts confidently and quickly but incorrectly, and automation without verified context scales those errors. The article also notes that the precise context must be defined by the agent's goal, and that too much context causes slower reasoning, goal drift and oscillation between incompatible actions.

The Hacker News argues that frontier agentic AI models, which emerged in early 2026, compress the time between vulnerability discovery and weaponization from days or weeks to machine speed. The article contends that attacks may become too fast and mutated to be cataloged, and that IT/OT convergence lets an AI agent move laterally from corporate networks into industrial systems using protocols such as Modbus, BACnet, and S7comm.

The article argues that AI agents acting for multiple users, spawning subagents, and running without human oversight create an identity problem the industry has not solved. Receiving systems cannot tell which actor and user principal stand behind an agent's request, which blocks fine-grained access control, audit trails and detection of out-of-scope behavior. It examines how OAuth access tokens, as specified in RFC 9068, lack claims for agent instance identity and the relationship between an agent and its user.

An opinion piece by a SANS Technology Institute author argues that agentic AI lets attackers act autonomously, moving beyond the drafting assistance of earlier chatbots. It claims this lowers the skill needed for attacks while speeding up experienced operators.

Speaker Kristen Thompson's article warns that attackers are bypassing AI security controls by reaching the legacy infrastructure AI agents depend on, rather than attacking the AI layer directly. The article cites that 70% of organizations grant AI systems more privileged access than a human in the same role, and reports a 76% incident rate for over-privileged AI versus 17% for those enforcing least privilege. It walks through a modeled attack path where an over-permissioned S3 bucket holding Salesforce exports and an unpatched perimeter server lead into an AI agent environment.

At Zenith Live 2026 in Vienna, Zscaler argued that zero trust should serve as the control plane for AI adoption in Southeast Asia, where AI agents are becoming digital workers and regulators are tightening data residency rules. The company is extending its Zero Trust Exchange and SASE platform to AI agents, unmanaged devices, multi-cloud workloads and B2B partners. The article also presents the author's own recommendations for Southeast Asian CISOs.

A 2026 CSA survey commissioned by Token Security reports that 82% of organizations found at least one AI agent created without the knowledge of security, IT, or governance teams in the past year. The article argues that AI agents are identities and that most enterprises lack governance models for them, with security teams needing to know what each agent can access. It also reports that 65% of organizations experienced a security incident involving an AI agent in the past year, with 61% reporting exposure or mishandling of sensitive data.

The article argues that enterprise security stacks fail because specialized tools (threat intelligence platforms, vulnerability scanners, BAS tools and SIEMs) generate data without closing the loop, leaving breach dwell times around 43 days. It contrasts assistive AI, which waits to be asked, with agentic AI, which autonomously correlates threat intelligence, validates controls and routes remediation to support Gartner's CTEM framework.

Qualcomm CEO Cristiano Amon describes a future where AI agents coordinate across apps and wearable devices, such as smart glasses, earbuds, pins and watches, replacing the need to open individual apps. Amon told CNBC that Qualcomm is working on more than 40 AI gadget designs and is most bullish on smart glasses. The article notes that privacy will be a key concern as agents become more pervasive.

Cisco announced an agreement to acquire identity lifecycle security company WideField Security to strengthen Splunk's Agentic SOC. No financial details have been publicly disclosed. WideField's platform discovers human and non-human identities, maps exposures across accounts and roles, and detects misconfigurations in authentication policies.