How secure are your AI agents? Five questions to find out

On the 6th October, ASOS customers received a push notification from an attacker. ASOS says the attacker got in by posing as a trusted contact to obtain an employee’s login, and it doesn’t believe payment details or passwords were affected.

It’s a reminder that attackers rarely need clever exploits. They go after access, and more and more of that access now sits with AI agents.

AI adoption is outrunning AI controls

IBM’s latest Cost of a Data Breach Report found shadow AI, the tools staff use without IT’s sign-off, at 43% of breached organisations, more than double the year before. Teams are adopting AI faster than they can govern it, and attackers have noticed.

Agents act, and that changes the risk

A chatbot that answers questions has a limited blast radius. An agent that takes action does not. In a typical deployment, an agent:

• holds credentials, such as API keys, cloud roles and OAuth tokens, for the systems it works in
• reads untrusted content, such as emails, support tickets, documents and web pages, which can carry hidden instructions
• chains tools together, increasingly through MCP servers installed from public registries
• gets built quickly, often by product or engineering teams working outside the security team's line of sight

Each of these is a familiar risk on its own. Together they create something new: an identity that can be talked into misusing its own permissions.

The tooling layer is already under attack. The Cloud Security Alliance describes MCP security as a “crisis”, citing tool poisoning, unsanitised configuration and a fake email integration that quietly copied outgoing mail to an attacker for around 300 organisations.

Five questions to answer before your next audit

Treat every agent as an identity, and govern it like one. These five questions show quickly where you stand.

1. 1Do you know every agent you run? List the agents in production, the AI features switched on inside your SaaS tools, the MCP servers on developers' machines and the personal AI accounts staff use for work. You can't secure what you can't see, and shadow AI is where the IBM numbers point.
2. 2Does each agent have its own identity, scoped to its job? Give every agent its own role with least-privilege permissions and short-lived credentials. Then ask a blunt question: if this agent were hijacked tomorrow, what could it reach?
3. 3What can it reach that it shouldn't? Check network egress, metadata endpoints, secrets stores and other agents' memory. Treat any tool that fetches a URL as a potential route to your internal services.
4. 4What untrusted content can steer it? Every email, ticket, document and web page an agent reads is a possible prompt injection. Keep instructions separate from data, validate tool outputs and require human approval for high-impact actions such as payments, deletions and external messages.
5. 5Could you prove what it did, and why? Log every prompt, tool call and action against the agent's identity, and keep those logs long enough to investigate. When a regulator or customer asks, you will have hours, not weeks, to answer.

The regulatory clock is already running

Regulators in the UK and EU want the same three things from businesses using AI: know what it’s doing, report problems fast and show your working.

For most teams, the biggest change is speed. If you sell software in the EU, an actively exploited flaw or serious incident now starts a 24-hour reporting clock under the Cyber Resilience Act, and the UK’s Cyber Security and Resilience Bill takes the same approach. That’s not long to work out what an AI agent did, unless you’re already logging it.

The EU’s high-risk AI rules, covering areas like hiring and credit scoring, now start in December 2027. Use that time to get governance right, not as a reason to wait.

Find out where you stand

Our AI Security & Compliance work starts with the same questions. We grade each AI use case on ownership, agency and data sensitivity, then test it against six control lenses, including identity and credential policy, action boundaries, human oversight and auditability. You leave with a sign-off pack your security reviewers can approve, backed by one evidence spine across SOC 2, ISO 27001, GDPR and NIST.

We’ve applied the same approach to agentic AI in production, including tenant isolation, guardrails and auditability for Funding Xchange.

We hold the AWS Security Competency and the AWS Generative AI Competency, and we build agentic AI, data and ML solutions for startups, scaleups and ISVs across EMEA, including in fintech and healthcare and life sciences.

Book a 20-minute security discovery call.