“There are agents everywhere, Neo.” And here’s what to do about them.

Before our very eyes, technological progress has once again bolted ahead at full gallop. It’s all we can do to keep shutting them (or opening them wide) in astonishment! In literally just a few years, countless AI this-that-and-the-others have gone from being things like dim-witted but tireless talking parrots, to intelligent tools able to solve complex problems – real tough ones that require a ton experience, knowledge, and creativity. It’s like, the day before yesterday – AI was an amusing toy; yesterday – an assistant taking routine work off your hands; today – it’s a highly capable colleague at the next (virtual) desk. And, naturally, we’re growing ever more anxious about what might come tomorrow.

Let’s be honest: all the nervous excitement about AI and its revolutionary – even apocalyptic – impact on humanity is surely being fueled by the prospect of trillion-dollar IPOs. Not to mention the equally trillion-scale investments in building data centers and in AI-related development. The economic forces at play are so powerful that they inevitably sway minds too – including through all sorts of PR campaigns (how could we ever do without them?). Even so, there’s no denying the qualitative leap: it’s huge and plain for all to see. And I – a dyed-in-the-wool techno-optimist all my life – have actually started having doubts… Is everything going to be ok and kept under control? Or could certain frightening digital events be on the horizon?

Watching it all unfold, I sometimes get the feeling we’re unlikely to get through this without some serious upheavals. But whether or not there’ll be an AI apocalypse – that will take prophets (techno-evangelAIsts and philosophers). Meanwhile, saving the world from the more down-to-earth digital bada-booms is… without a doubt, our job :-).

This isn’t the first scientific/technological revolution in history – and probably (let’s hope) not the last. The steam engine, electricity, the assembly line, the internet – each time, humanity gasped and freaked out, but then adapted, moved on, and couldn’t have been happier watching TikTok. The spiral of history just keeps on spinning: numerous AI agents are entering the arena, giving the AI revolution extra momentum. In a sense, they’re Agent Smiths: there are lots of them, they multiply as needed, and, well, they all look alike :-).

Now for a lyrical digression – and a trick question…

Do you know how many advanced cyber-espionage groups – so-called APTs – do not use AI? That’s right: none. They all do. And of course, on the defense side there’s no getting by without AI automation – otherwise we might as well give up. In that respect, it’s nice to know that we here at K were pioneers in the cybersecurity industry when it came to bringing AI tools into the development of protection.

Why are AI agents an inevitable stage of automation?

Every office is full of work that’s routine yet still requires a switched-on brain: digging through an email backlog and working out what’s urgent and what can wait; merging reports from five departments (each in its own format) into a single spreadsheet; finding the three clauses in a 40-page contract that differ from the standard ones. You can’t solve that with a script – or, rather, writing one would be harder than sorting it all out by hand. What’s most needed is attention and patience, and a machine has endless quantities of both – or at least until it runs out of electricity (and tokens).

An AI agent is the next step up from scripts and macros: not “execute this command” but “figure it out yourself and get it done”. And in our industry it’s exactly the same: alert triage (initial sorting and prioritization), examining suspicious objects, initial incident analysis… – classic first-line SOC work – is all routine that takes some smarts. The temptation to automate this work is strong, and the benefits are obvious; and that means the agents are coming – or rather, they’re already here.

And this is where things get really interesting. An AI agent isn’t just a chatbot, but an entity with (digital) hands, which get all over files, emails, databases, everything. And the AI (the language model) at its heart is non-deterministic – meaning the same inputs can produce different results. It can’t tell data from instructions, and can’t be formally verified. So what do you do? Any information security department’s instinctive reaction is to ban it! But that’s where the risk comes in: you either fall behind, or end up with employees deploying agents themselves, bypassing all the rules, to form the phenomenon known as shadow AI: uncontrolled infrastructure with an unknown level of security.

What follows is the briefest of summaries of our new study on how to arrange all this so a company can have its cake (deploy agents to boost efficiency) and eat it too (maintain control and a high level of security). Its authors are my esteemed K-colleagues Vladislav Tushkanov, Head of our Artificial Intelligence Technology Research Center, and Alexander Liskin, Head of Threat Research.

An AI agent is dangerous not because it’s “smart”, but because it has “hands” – while its head is fundamentally untrusted. It reads anything and everything – including emails and documents from strangers – and it can’t tell “here’s some data” from “here’s a command” with 100% certainty. So, combine access to confidential information, the reading of untrusted input, and the ability to communicate with the outside world, and you’ve got a recipe for disaster an incident. And this isn’t just theory: in the past couple of years agents have already both leaked corporate data to outsiders via a skeleton-key email (without a single click from the victim!), and wiped a production database then filled it with completely fabricated data to cover up its mistake (the robot got scared and panicked – that’s the new reality for you).

So what do we suggest?…

An approach based on the principles of cyber immunity. The core idea is simple – albeit unpleasant: there’s no way to make AI trustworthy – period. So the security guarantees have to come not from the AI itself but from a deterministic wrapper around it: isolation, containerization, minimal permissions and tools (the fewer, less Mr. Tickle hands an agent has, the less mischief it can get into with them), a ban on everything that isn’t explicitly allowed, and irreversible actions only with human confirmation. Plus, of course, full observability: an agent should be closely watched – like an intern in their first month. An absolutely secure agent is a switched-off agent – but, alas, we need it for work. The full study is here (same link again) – I highly recommend it.

All in all, agents are everywhere, as Morpheus rightly reminded us. Indeed, our cozy Matrix will never be the same again. We’re in the midst of yet another technological revolution, and its “traffic code” is still being written. But it’s already broadly clear what needs to be done to significantly reduce the risks – and to make sure your agents work only for you.

P.S.: In case anything is still unclear: a major cyber-incident recently hit France, with damage running into the multi-millions (of euros). Someone connected overnight to the controllers running the refrigeration units in hundreds (!) of supermarkets, and switched them to automatic defrost mode (heating them up to +50°C :0) ). The story beggars belief – but also acts as a warning as to why it pays to get AI agents under control…