AI agents

A compromised AI agent that already holds access, permissions and a routine need to move data across systems can skip the traditional kill chain entirely, since the agent itself becomes the attack path. The article cites the OpenClaw crisis as evidence, noting that roughly 12% of skills in its public marketplace were malicious, a critical RCE vulnerability allowed one-click compromise, and over 21,000 instances were publicly exposed. Because the attacker's activity mirrors the agent's normal workflow, standard detection tools that look for abnormal behavior may not flag it.

The article argues that agentic commerce, where AI agents discover, compare and execute purchases on a user's behalf, requires near-perfect data and trust at machine speed. It says master data management (MDM), which creates a single master record, must serve as the exchange layer that tracks who an agent represents, what it can do, and where responsibility lies.

CrowdStrike introduced Charlotte AI AgentWorks, a hub for building and scaling security agents on the Falcon platform, and Charlotte Agentic SOAR, an orchestration layer that coordinates CrowdStrike-native, AgentWorks-built, and third-party agents. The announcement cites eCrime breakout times as short as 27 seconds and a 89% year-over-year rise in attacks from AI-powered adversaries as reasons for an agentic SOC model.

Agentic AI platforms are shifting from passive recommendation tools to autonomous action-takers with real system access. The source text is a truncated excerpt from a SecurityWeek article titled "Why Agentic AI Systems Need Better Governance – Lessons from OpenClaw."

Microsoft researchers Fady Copty, Neta Haiby, and Idan Hen argue that trustworthy AI agents must align four layers of intent: user, developer, role-based, and organizational. The article explains that agents should satisfy the user's objective while staying within what the developer, deploying role, and organization intended. It illustrates this with an email-sorting agent that may classify messages but must not send replies or delete mail without explicit authorization.

Microsoft has proposed new identity and guardrail features for AI agents, which it presents as a starting point for companies facing growing threats from agentic AI. The source text gives no further detail on the features themselves.

Anthropic announced that Claude can now use a person's computer to complete tasks, such as opening apps, navigating a web browser and filling in spreadsheets, after a user sends a request from a phone. Anthropic said computer use is still early, that Claude can make mistakes, and that Claude will always request permission before accessing new apps.

CrowdStrike has announced agentic MDR, delivered by CrowdStrike Falcon Complete, and new SOC Transformation Services aimed at helping organizations move toward an agentic SOC. Agentic MDR combines deterministic automation within expert-defined guardrails, adaptive AI agents, and human analysts, and is now generally available, with a 1-minute median time to contain (MTTC) cited. The SOC Transformation Services focus on modernizing SIEM, data pipelines, workflows, and talent models.

Palo Alto Networks has announced an update to its Prisma AIRS security platform and enterprise browser that adds the ability to discover AI agents, models, and connections across an IT environment, scan agents for vulnerabilities, and let admins simulate red team tests for agents. The company also said that, assuming its planned acquisition of Koi Security completes, Prisma AIRS 3.0 will offer an AI Agent Gateway providing a central control plane for agent runtime and identity security.

Varonis announced general availability of Varonis Atlas, an AI security platform that discovers, posture-manages, tests and protects AI systems, including hosted AI platforms, custom LLMs, agentic frameworks, chatbots and embedded AI. Atlas is built on the Varonis Data Security Platform and offers AI inventory, AI-SPM, security testing, runtime guardrails and compliance reporting. The announcement is promotional, citing Gartner analysis that over 50% of organizations have begun or plan to deploy AI agents.

CrowdStrike announced new Falcon platform capabilities that extend AI detection and response (AIDR) to endpoints, SaaS and cloud environments. On endpoints, Falcon AIDR will extend runtime threat detection beyond the browser to desktop AI applications such as ChatGPT, Gemini, Claude, DeepSeek, Microsoft Copilot, GitHub Copilot and Cursor, and is currently in pre-beta with general availability planned for Q2.

Palo Alto Networks researchers describe how agentic AI could enable retail fraud, citing Google's Universal Commerce Protocol (UCP), announced at the January 2026 NRF Big Show, which provides tokenized payments and verifiable credentials for communication between agents and business backends. They cite Bain and Company's estimate that agentic AI could handle 15-25% of e-commerce volume by 2030, and an estimate that one in four data breaches could result from AI agent exploitation by 2028. The article also notes that Organized Retail Crime costs retailers on average $700,000 per $1 billion in sales, and that criminals already use AI-generated images to facilitate returns fraud.

Microsoft has open-sourced CTI-REALM, a benchmark that tests AI agents on end-to-end detection engineering, from reading threat intelligence reports to producing validated Sigma and KQL detection rules. The benchmark uses 37 CTI reports from Microsoft Security, Datadog Security Labs, Palo Alto Networks, and Splunk, spanning Linux endpoints, Azure Kubernetes Service, and Azure cloud infrastructure. It scores intermediate steps such as report selection, MITRE technique mapping, and query refinement, not only the final rule.

Microsoft's RSAC 2026 announcement presents security as the core primitive of the AI stack for agentic AI. It introduces Agent 365, the control plane for agents, which becomes generally available on May 1, and new capabilities for visibility, identity, data protection and threat defense across AI workflows.