Authenticated Agent Doesn’t Mean It’s Aligned
Introductory blog about Agent what happens when software stops waiting for permission.
Over roughly 2.5 months spanning December 2025 to mid-February 2026, a single operator - one person, by the account of the firm that discovered the campaign, breached nine Mexican government agencies - the tax authority, the civil registry, the electoral institute. The individual walked away with roughly 195 million identity records across 150GB of data. That’s more records than Mexico has people, so overlapping and historical files rather than unique citizens, which makes it worse.
One attacker, working with two commercial AI tools, with an estimated three-quarters of the remote command execution generated by AI1. The impact of the breach executed by one person, at a national-scale with the help of AI-tooling, is the reason why this blog exists.
Enterprise Security Assumptions Have Expired
Thirty years of enterprise security was built for actors that no longer applies.
Enterprise security rests on a quiet assumption that has changed: the thing taking an action is either a human with an identity or a deterministic piece of software with a fixed scope. Everything - IAM, DLP, SIEM playbooks, audit trails, SOX attestations, inherits from that assumption.
AI agents are neither. An agent is a non-deterministic actor that holds real privileges; it reads your inbox, queries your CRM, calls your APIs, pushes to production, and it can be hijacked not by code an attacker writes, but by data it reads. A poisoned email. A document laced with malicious prompts. A tool description with malicious instructions buried inside. The agent doesn’t get compromised the way a server does. It gets persuaded.
I write this blog in partnership with security leaders, architects at ArmorIQ, working on actual mechanics of cyber-security impacts of agents in enterprise systems. Collectively, we will bring thought leadership articles about the state of Agent security and best-practices for our community.
What We’ve Learned So Far
Five findings survived our scrutiny. Read about the structural vulnerabilities for the state-of-play.
Months of digging through the standards work, the peer-reviewed literature, the incident reports, and the breach economics compress into five findings.
One: the vulnerability is architectural, and there is no patch.
An LLM processes instructions and data through the same channel - tokens, and cannot reliably tell them apart. That’s the root of prompt injection, and it’s why untrusted content can carry commands your agent obeys. OpenAI calls it a frontier security challenge with no clean solution; Meta, Google, and OWASP concur. In mid-2026, OWASP still reports prompt injection driving most agentic security failures in production. You cannot filter your way out, because the attacker moves second. The entire defensible strategy shifts from prevent the hijack to contain the blast radius. Every serious defense published to date is a containment architecture, not a cure.
Two: one mental model tells you when a hijack becomes a breach.
Simon Willison’s lethal trifecta: an agent is dangerous when it simultaneously has access to private data, exposure to untrusted content, and the ability to communicate externally. Any two are survivable. All three complete a data-theft path. EchoLeak, GTG-1002, and the Mexico breach each had the full trifecta.
Source: https://ai.meta.com/blog/practical-ai-agent-security/
Three: this stopped being hypothetical in 2025. The escalation runs in a clean line.
EchoLeak (CVE-2025-32711, CVSS 9.3): the first zero-click attack on an AI agent via a single email, ingested by Microsoft 365 Copilot during routine summarization, exfiltrated corporate data with no user click.
Salesloft Drift: stolen OAuth tokens from an AI chatbot integration became a pivot into 700+ Salesforce environments, including Cloudflare’s and Google’s.
GTG-1002: Anthropic’s report of a state-sponsored group running an espionage campaign through its own coding agent, with the AI executing 80–90% of tactical operations - a figure real researchers dispute, and we’ll cover the dispute honestly, but the disruption itself stands.
Then Mexico. Four incidents, four different failure modes: subverted agent, poisoned supply chain, weaponized capability, democratized capability.
Four: adoption has outrun control by an embarrassing margin.
The least-conflicted numbers come from IBM’s Cost of a Data Breach 2025: among organizations that suffered an AI-related breach, 97% lacked proper AI access controls, and 63% had no AI governance policy at all. Shadow-AI breaches cost $670K more than average. Deloitte finds only 21% of enterprises have a mature governance model for agents. The scary vendor stats I’ve seen - “88% already breached,” 80-to-1 machine identity ratio, come from companies selling the fix.
Five: the skeptics are partly right, and that matters.
McKinsey finds only about 10% of enterprise functions actually use agents in production. Gartner predicts 40%+ of agentic projects will be cancelled by the end of 2027, and estimates only ~130 of the thousands of self-described agentic vendors are real. Some headline incidents are old problems in new clothes - Drift was fundamentally OAuth token theft.
The honest synthesis: agentic security is a leading-indicator risk. It is not today’s biggest loss line. But capability, autonomy, privilege, and interconnection are all rising at once, the core vulnerability has no fix, and the controls are years behind the deployments. The enterprises that treat this as an architecture problem now, while their agent footprint is small, will contain it. The ones that wait will retrofit under fire.
Where This Series Goes
Eight investigations, each one testing whether the defense actually holds.
With this series, I will bring fact-based and ground-level findings to you - learnings from real enterprises partnering with ArmorIQ on establishing research based best-practices for enterprise security.
With ArmorIQ leaders, I will write the honest skeptic’s piece; here are topics you can expect:
How much of this is real risk and how much is agent-washing, argued properly from both sides.
We’ll dig into the identity crisis - what happens to access governance when machine identities outnumber your employees and your logs can’t tell an agent’s actions from a human’s.
We’ll go deep on containment architectures: Google DeepMind’s CaMeL, Meta’s Rule of Two, and why “you can’t patch this” changes what a good defense looks like.
We’ll examine the protocol trap - MCP and A2A wiring the agent ecosystem together faster than anyone is securing it, with one peer-reviewed threat model finding 57 threats across six MCP components.
And we’ll follow the money: the funding wave, the guardian-agent concept, the regulation arriving from the EU AI Act and the SEC, and where this lands by 2028.
Lastly, strategies and best practices for hardening enterprise systems, in other words - but derived from first principles and named incidents, not from a checklist someone laminated.
The Gap Nobody’s Tool Was Built For
Every existing control answers a question. None of them answer the right one.
Map the existing stack against an agent and you find each control answering yesterday’s question.
IAM and RBAC answer who is allowed in - but the incidents above were committed by actors with valid credentials.
Guardrails answer is this output safe - after generation, about text, not actions.
Sandboxes answer is it contained - until the agent’s legitimate tool access is the exfiltration path.
Observability answers what happened - past tense, when the data is already gone.
The unanswered question sits in the middle: is this action what the agent was actually asked to do?
For example, a user asks an agent to summarize an email. The agent - hijacked, poisoned, or just drifting - starts reading billing records and posting to an external endpoint. Every credential checks out. Every log entry looks routine. Nothing in the stack asks whether the behavior matches the intent.
Closing that gap takes a new category of control: runtime enforcement that captures what an agent intends to do before it acts, verifies each action against that declared scope, blocks what falls outside it, and seals the decision in an audit trail a regulator can trust.
Think of it as the difference between checking a badge at the door and reading the work order. This is the layer the identity vendors are now racing toward and the standards bodies are drafting for.
ArmorIQ , where I advise, is one of the companies building this architecture and framework. But the argument stands independent of any vendor, mine included: authentication tells you who the agent is. It tells you nothing about whether the agent is still doing its job.
That question - is the agent still doing its job? - is the one this publication keeps asking.
[ Note - written July 2026. Every figure above is sourced and tiered; vendor-derived numbers are flagged as such. Not a substitute for your own threat model. Do your reading. ]
Sources
Primary incident reports
Anthropic, Disrupting the first AI-orchestrated cyber espionage campaign (GTG-1002) — https://www.anthropic.com/news/disrupting-AI-espionage
BleepingComputer, GTG-1002 skepticism (”marketing guff”) — https://www.bleepingcomputer.com/news/security/anthropic-claims-of-claude-ai-automated-cyberattacks-met-with-doubt/
EchoLeak / CVE-2025-32711 (SOC Prime) — https://socprime.com/blog/cve-2025-32711-zero-click-ai-vulnerability/
EchoLeak academic write-up — https://arxiv.org/abs/2509.10540
Salesloft Drift breach: Cloudflare response — https://blog.cloudflare.com/response-to-salesloft-drift-incident/ · The Hacker News — https://thehackernews.com/2025/09/salesloft-takes-drift-offline-after.html
Mexico government breach: Live Science — https://www.livescience.com/technology/artificial-intelligence/hackers-used-ai-to-steal-hundreds-of-millions-of-mexican-government-and-private-citizen-records-in-one-of-the-largest-cybersecurity-breaches-ever · UpGuard — https://www.upguard.com/news/sat-data-breach-2026-03-02
Analyst & survey data (Tier 1–2)
IBM Cost of a Data Breach 2025 — https://www.ibm.com/reports/data-breach · https://newsroom.ibm.com/2025-07-30-ibm-report-13-of-organizations-reported-breaches-of-ai-models-or-applications,-97-of-which-reported-lacking-proper-ai-access-controls
Deloitte, State of AI in the Enterprise 2026 — https://www.deloitte.com/us/en/what-we-do/capabilities/applied-artificial-intelligence/content/state-of-ai-in-the-enterprise.html
McKinsey via Forbes (10% of enterprise functions use agents) — https://www.forbes.com/sites/josipamajic/2026/03/22/10-of-enterprise-functions-use-ai-agents-mckinsey-finds/
Gartner, 40%+ of agentic AI projects cancelled by end of 2027 — https://www.gartner.com/en/newsroom/press-releases/2025-06-25-gartner-predicts-over-40-percent-of-agentic-ai-projects-will-be-canceled-by-end-of-2027
Gartner, Hype Cycle for Agentic AI (agent-washing, ~130 real vendors) — https://www.gartner.com/en/articles/hype-cycle-for-agentic-ai
Standards & frameworks
OWASP Top 10 for Agentic Applications 2026 — https://genai.owasp.org/resource/owasp-top-10-for-agentic-applications-for-2026/
OWASP via Help Net Security, prompt injection still drives most agentic failures (June 2026) — https://www.helpnetsecurity.com/2026/06/11/owasp-prompt-injection-ai-security-failures/
MCP threat model, 57 threats across 6 components (J. Cybersecurity & Privacy) — https://arxiv.org/abs/2603.22489 · https://doi.org/10.3390/jcp6030084
Defenses & mental models
Simon Willison, The Lethal Trifecta — https://simonwillison.net/2025/Jun/16/the-lethal-trifecta/
Simon Willison, Agents Rule of Two & The Attacker Moves Second — https://simonwillison.net/2025/Nov/2/new-prompt-injection-papers/
Meta, Agents Rule of Two — https://ai.meta.com/blog/practical-ai-agent-security/
Google DeepMind, CaMeL: Defeating Prompt Injections by Design — https://arxiv.org/pdf/2503.18813
Regulation & market
EU AI Act Service Desk, how AI agents are addressed — https://ai-act-service-desk.ec.europa.eu/en/ai-act/faq/how-are-ai-agents-addressed-within-ai-act-0
Forbes, employee AI shortcut triggers SEC 8-K — https://www.forbes.com/sites/noahbarsky/2026/05/18/employees-ai-shortcut-triggers-sec-filing---boards-take-note/
SailPoint extends identity governance to AI agents — https://techinformed.com/sailpoint-extends-identity-governance-to-ai-agents/