AI agent security when you are the security team

The agents arrived one at a time, and none of them arrived as a security decision. Something that reads the shared inbox and drafts replies. A coding assistant that runs commands in your project folder. A browser that books the thing you asked it to book. Each got the access it needed on the day you set it up, and each now runs while you are doing something else. Around that, a market has formed. In July 2026 Neo, founded by the SentinelOne veterans Nick Warner, Shlomi Salem and Eran Shirazi, announced 100 million USD in funding, a 75 million USD Series A on top of a 25 million USD seed from 2025, for a platform that maps the AI agents and AI-powered applications running inside companies, monitors them in real time and enforces policy against them [8]. OWASP published a Top 10 for Agentic Applications in December 2025, assembled with more than 100 contributors [6]. Anthropic’s deputy CISO, Jason Clinton, published a framework for assessing agent risk in July 2026 [2].

None of the products in that market are priced for you, and buying one was never the part that mattered most. The controls that decide how bad your worst day is are configuration choices made before an agent runs, and they are already sitting in the tools you pay for. This guide is about which ones, and in what order. It is written for someone who is the entire security function of a business and also sends the invoices. If you have an identity provider, a log pipeline and a colleague whose job is access review, the controls below are ones you already own, and you want the enterprise version of this document instead.

An agent is software that takes instructions from strangers

The reason existing security tooling struggles here is not sophistication. It is that an agent does not look like anything the tooling was built to watch. It is not a person, so controls built around human login patterns do not fit it. It is not fixed software either, because what it does next depends on a goal, a set of tools and whatever text it just read. Neo’s pitch names the specific gap: “The challenge with AI agents is that they operate with legitimate user permissions” [8]. Your agent is not breaking in. It signed in as you, with your token, and every action it takes is authorised.

OWASP puts the same shift in different words. Announcing the agentic list, Rock Lambrose of RockCyber described it as a change of subject: “LLM security focused on single model interactions. Agentic security addresses what happens when those models can plan, persist, and delegate across tools and systems” [6]. The threats highlighted in that release are agent behaviour hijacking, tool misuse and exploitation, and identity and privilege abuse [6]. Read those three as one sentence: someone else’s text changes what your agent decides to do, and your agent has the permissions to do it.

That is the whole category, and it scales down to a business of one without losing anything. You do not need a fleet to have the problem. One agent with your credentials, reading text you did not write, is enough.

Three ingredients, and you only have to remove one

The most useful framing available is also the shortest. Simon Willison’s lethal trifecta names three properties that are individually ordinary and dangerous only together: “Access to your private data”, “Exposure to untrusted content — any mechanism by which text (or images) controlled by a malicious attacker could become available to your LLM”, and “The ability to externally communicate” in a way that could be used to steal your data [7]. His advice to people who assemble their own tools is to “avoid that lethal trifecta combination entirely”, because when you mix the three ingredients yourself, in his words, “there’s nothing those vendors can do to protect you” [7].

Apply it per task rather than per tool, because the same tool is safe in one job and not in the next. An assistant that summarises your own notes has private data and no untrusted content. A browsing agent reading public pages while logged out has untrusted content and no private data. The agent that reads a shared inbox, has your Drive connected and can send mail has all three, and so does the coding assistant that reads a repository somebody sent you and is allowed to run curl. Nothing has gone wrong yet in either case. The arrangement is simply one hostile paragraph away from going wrong.

The vendors give the same advice from their own side. OpenAI tells users to “limit an agent’s access to only the sensitive data or credentials it needs to complete the task” [4], and continues to “recommend that users take advantage of logged-out mode whenever access to websites you’re logged in to isn’t necessary for the task at hand” [5]. That is the trifecta rule with a product name attached. Decide which leg to break before you start, and prefer the cheap one: reading the open web logged out, or running with no credentials, usually costs you less than giving up the task.

Four questions, asked before the agent runs

Clinton’s framework scales down better than most. It is four questions asked of each deployment: “What untrusted content does it ingest?”, “What actions can it take, and on whose behalf?”, “What is the blast radius if it is misaligned?”, and “What observability do I have?” [2]. The guide defines untrusted broadly, as “anything an attacker could plausibly write or alter, including outside email, the open web, third-party documents, or public repositories” [2], and reduces the third question to arithmetic: “Scope X severity is the quick calculation: did the bad actor or alignment incident have access to one file or the whole org?” [2].

Translate each one into your terms. Untrusted content is any inbox that accepts mail from outside, any web page, any document a client sent, any repository you did not write. On whose behalf is the account the agent authenticates as, which in most small businesses is the owner’s account, which is the largest one available. Blast radius is what that account can reach when nobody is looking, and the honest answer for a sole operator is usually everything, because the same login holds the client files, the billing inbox and the domain records. Observability is the question that stings. The guide asks it in enterprise terms, “Can you tell agent actions from user actions? Does it land in your SIEM?” [2], and at your scale there is no separate answer. Agent actions land in the same logs as yours, under the same name, and nobody reads those logs.

The framing that makes this workable is in the same guide: “A CISO’s responsibility in the age of agentic AI is not to achieve zero risk” [2]. The job instead is to “make agentic risk legible and bounded” [2]. Legible means you can say what each agent touches. Bounded means the answer is smaller than “everything”. Both are writing exercises before they are technical ones.

The controls you need already ship in the tools you pay for

Claude Code’s Manual mode is a working model of what bounded looks like, and most of it is switches rather than architecture. In that mode it “starts with read-only permissions” and asks before running Bash commands that can modify your system [1]. It writes only inside the folder it was started in: it “can only write to the folder where it was started and its subfolders, and can’t modify files in parent directories without explicit permission” [1]. Commands that pull from the internet are held back, since “Commands that fetch content from the web such as curl and wget are not auto-approved by default” [1]. Web fetching is isolated, because “Web fetch uses a separate context window to avoid injecting potentially malicious prompts” [1]. First runs in a new codebase, and new MCP servers, require trust verification [1]. The /sandbox command adds filesystem and network isolation for Bash commands [1]. Anthropic’s own summary of the boundary is one line worth keeping: “Claude Code only has the permissions you grant it. You’re responsible for reviewing proposed code and commands for safety before approval” [1].

Check which mode you are in before you rely on any of that. Which mode a session starts in depends on your plan, the surface you start it from, and your settings and your organisation’s [1], and the alternative is a different arrangement rather than a stricter one: in auto mode “a separate classifier model reviews actions instead of you and blocks the ones it judges unsafe” [1]. That is a reasonable trade for routine work and a bad one for a session holding live credentials.

The browsing side has its own set. ChatGPT agent ships “multiple safeguards, including user confirmations for high-impact actions” and a watch mode that requires user supervision on certain sites [3]. When a login is needed it will “pause and prompt you to take control of the virtual browser” [3]. Takeover mode is where credentials belong: while you control the browser, “screenshots are not captured, which helps protect passwords and other sensitive data you enter”, and the instruction is to “use takeover mode for sensitive inputs” rather than typing passwords into the chat [3]. OpenAI also tells users to “Consider disabling unnecessary apps, avoiding sensitive logins, or logging out when done” [3], and, when an agent asks for confirmation, to “carefully check that the action looks right and that any information being shared is appropriate to share in that context” [4].

One control deserves promoting above the rest, and it is the one small operators skip. Clinton’s guide calls egress the strongest lever available: “Egress allowlisting is your strongest control against prompt injection: all traffic leaving the agent’s execution environment should pass through a proxy that environment cannot reconfigure or bypass, and only destinations you chose should be reachable” [2]. You are not going to run a proxy. The version you can run is blunter and works: give the agent no network access for tasks that do not need it, keep the web-fetching commands off the allow list, and run anything that touches external services on a machine that holds no production credentials. Anthropic’s own best-practice list says the same thing in plainer form, advising you to avoid piping untrusted content directly to Claude and to “Use virtual machines (VMs) to run scripts and make tool calls, especially when interacting with external web services” [1].

What a product would do that you cannot, and when that matters

It is worth being precise about what the emerging category actually sells, because two thirds of it is free. Neo’s platform automatically maps AI agents, AI-powered applications, browser extensions, plug-ins and MCP servers, monitors them continuously in real time, and enforces policy in the software layer to block risky activity and prompts that exceed predefined boundaries [8]. The map is a spreadsheet you can write this afternoon: one row per agent, with the account it runs as, what it reads, what it can send, and who would notice if it changed. Policy is the set of approval prompts and allow rules you already configure. The third piece, continuous behavioural monitoring, is the part you genuinely cannot reproduce, and it maps exactly onto the question you could not answer above: what observability do you have [2].

So the trigger for buying is not the number of agents. It is the moment you stop being the person who configured them. Other people running agents against your data, agents that came bundled inside software you bought, or a client contract that requires you to demonstrate control rather than assert it. Until one of those is true, the honest position is that your monitoring is your own attention, and your defence is that the blast radius is small because you kept it small.

Meanwhile the free half of what the industry produced is the vocabulary. The OWASP list gives you named failure modes to check a vendor against rather than adjectives to be impressed by [6], and the four questions give you a shape for a security answer you might have to write for a client one day [2]. Use them as a shopping list. A vendor who cannot say which of the ten risks their product addresses, or what your blast radius is after installing it, is selling you the inventory you already made.

What still goes wrong

The underlying vulnerability is not scheduled to be fixed, and the vendors say so themselves. OpenAI describes “robustness to adversarial attacks” as “a long-standing challenge for machine learning and AI, making this a hard, open problem” [4], and is blunter still about the browser case: “Prompt injection, much like scams and social engineering on the web, is unlikely to ever be fully ‘solved’” [5]. Anthropic’s security page ends its list of protections with the same admission: “While these protections significantly reduce risk, no system is completely immune to all attacks” [1]. OpenAI’s help documentation says its measures “don’t eliminate all risks” and that “It remains important to monitor ChatGPT agent and exercise care when using it” [3]. Plan on the basis that a well-placed instruction will eventually get through, and that the only thing you control is what it can reach when it does.

The second failure is you, on a Tuesday. Every control above is a prompt you can dismiss, and dismissing them is the documented pressure: Claude Code lists prompt fatigue mitigation as a feature, with “allowlisting frequently used safe commands per-user, per-codebase, or per-organization” [1]. Those allowlists are permanent decisions made in a hurry, and they are invisible afterwards. The same page notes that trust verification is disabled when Claude Code runs non-interactively with the -p flag [1], which is the correct behaviour and also means the runs with no human present are the ones with the fewest checks. Scheduled and automated work deserves narrower permissions than interactive work, not the same ones.

The third is that none of this tells you what happened. You have no detection layer, so your incident response is noticing a consequence, which usually means an email somebody else received or a file that changed. That is a real limit and not one a smaller version of an enterprise product fixes. Finally, this is a guide for a small business making its own decisions. If you handle regulated data, hold client systems under contract, or would have to show an auditor how agent actions are controlled and reviewed, the questions above are where that work starts, not a substitute for it.