The AI Agent Security Gap Is Becoming an Enterprise Reality

Lead

AI agents are moving beyond pilots and chat interfaces into production workflows. They are being allowed to reach internal systems, retrieve data, call tools and carry out business tasks with varying degrees of autonomy. According to VentureBeat Pulse Research, based on responses from 107 enterprises, that shift is exposing a major imbalance: companies are expanding what agents can do faster than they are building the controls needed to contain them.

Key takeaways

• Incidents are already happening: The survey found that 54% of enterprises have experienced either a confirmed AI agent security incident or a near miss. Of that group, 18% reported a confirmed incident, while 36% said a near miss was caught before damage occurred.
• Identity is the structural weak point: Only about 32% of organizations give every agent its own scoped identity. Most agents still share credentials, making it harder to limit blast radius, trace actions or revoke access cleanly when something goes wrong.
• High-risk agents are not consistently isolated: Only around three in ten enterprises isolate their riskiest agents. That matters most when agents can access sensitive data, write to business systems or trigger operational workflows.
• Security stacks are mostly borrowed: Enterprises are leaning heavily on capabilities from model providers and hyperscalers, rather than using security tools built specifically for agent behavior, tool use, identity and runtime enforcement.
• Spending remains modest: Agent security is still described as a thin slice of the overall security budget, even as organizations are split on whether their defenses are keeping pace with AI-enabled attackers.

Why it matters

The central issue is not one isolated vulnerability. It is the emergence of an “agent security gap”: the distance between the autonomy enterprises grant to agents and the identity, isolation and enforcement mechanisms in place to govern them.

Traditional security programs were designed around human users, applications, devices and network boundaries. Agents behave differently. They may chain multiple tool calls, combine permissions across systems and act on model-generated reasoning. A malicious prompt, polluted context or mistaken instruction can therefore propagate through business workflows. If multiple agents share credentials, the enterprise may not even be able to determine which agent performed a risky action.

The answer is not simply to halt agent adoption. Instead, enterprises need to treat agents as a new class of machine identity and operational actor. Each agent should have a unique identity, limited scope, revocable permissions and auditable logs. Higher-risk agents need stronger isolation, approval gates or sandboxing. Security teams also need visibility into tool calls, data access and policy deviations at runtime.

AI agents will create business value only if they can be trusted inside real systems. The next phase of enterprise adoption will therefore depend less on how autonomous agents can become, and more on how precisely their autonomy can be governed.

Source: VentureBeat AI