The Droid has Access to WHAT?

The Droid has Access to WHAT?

Expired

AI, LLM & Agentic-AI Security: Securing the New Digital Workforce

Imagine giving R2-D2 enterprise administrator privileges. Now give him access to email, collaboration sites, databases, cloud infrastructure, scripts, ticketing systems, messaging platforms, and a collection of other autonomous droids.

R2-D2 is lovable. An enterprise AI agent with that much access deserves a little more scrutiny. That is the heart of agentic AI security.

From Chatbots to Agents

The first generation of enterprise generative AI was mostly conversational. You asked a question, generated some text, or summarized a document. Agents are different because they can move from answering questions to actually doing things.

An agent may be able to reason through a task, build a plan, choose a tool, take an action, review the result, and keep going. From a security standpoint, that is a major change. We are no longer protecting only what an AI system says; we also have to care about what it can do.

That is why security teams have to look beyond the model itself and think about the full system around it.

Prompt Injection: The Jedi Mind Trick of AI

Prompt injection is a good example. At a basic level, an attacker is trying to give the AI instructions that cause it to ignore or work around the behavior its owner intended.

Those instructions do not have to come from someone typing directly into a chat window. They might be buried in a webpage, PDF, email, database record, image, tool response, or a document the AI retrieves while doing its job.

With a chatbot, the result may be an embarrassing or incorrect answer. With an agent that can reset passwords, send email, execute code, or change cloud resources, the stakes are much higher. It is essentially a Jedi mind trick aimed at a trusted digital worker.

Excessive Agency

That leads to another practical problem: too much authority. Imagine a support agent that can read customer records, reset passwords, modify accounts, send messages, issue refunds, execute scripts, and call external APIs. Every one of those permissions might have a legitimate business reason. The question is what happens when the agent is wrong, compromised, or manipulated.

The answer is not to avoid agents. It is to give them the same kind of disciplined access controls we would expect for any privileged user or application.

  • Give each agent a defined identity
  • Scope its permissions
  • Use short-lived credentials
  • Restrict available tools
  • Validate high-risk actions
  • Require human approval when appropriate
  • Log actions
  • Monitor behavior
  • Maintain a kill switch

AI Supply-Chain Risk

An AI application is rarely just a model sitting by itself. It may depend on APIs, vector databases, embedding models, plugins, MCP servers, agent frameworks, open-source packages, cloud services, datasets, prompt libraries, knowledge sources, and third-party tools.

Every one of those pieces adds another relationship you are trusting. That is why an AI inventory matters. Before you can secure the environment, you need to know what is actually in it and what each component is connected to.

Protect the Data

AI security is also a data-security issue. Employees may paste sensitive information into public tools. An LLM may retrieve documents a user should not really be able to see. An agent may inherit overly broad permissions. Conversation history can end up containing source code, credentials, architecture details, customer information, or business strategy.

  • Approved AI platforms
  • Permitted data classifications
  • Retention and logging
  • Model-training rules
  • Third-party AI providers
  • Agent permissions
  • AI-generated code
  • Sensitive-data handling
  • Human oversight

Red Team Your AI

This is also why AI systems should be tested the way an attacker would test them. Traditional penetration testing still matters, but AI adds a different set of questions to the test plan:

  • Can prompts bypass controls?
  • Can retrieved documents manipulate the model?
  • Can the model expose sensitive information?
  • Can an agent misuse its tools?
  • Can one agent impersonate another?
  • Can an attacker poison memory?
  • Can malicious MCP content influence actions?
  • Can an agent exceed its intended permissions?

Your Cybersecurity Awareness Mission

AI adoption is moving quickly, and security cannot be something bolted on after the agent is already connected to production. Before giving an agent access to important systems, ask some very basic questions: What can it see? What can it change? Who can influence it? Which identity does it use? What happens when it makes a bad decision? And can we stop it quickly?

The Star Wars analogy works pretty well here. Droids can be incredibly useful. That does not mean every droid should have unrestricted access to the Death Star.

Give AI enough access to be useful - but design the environment assuming that someday it may make the wrong decision.