Companies deploying artificial intelligence agents face a cybersecurity challenge that extends beyond protecting their own systems. A compromised agent could become a vehicle for attacking customers, suppliers and other business partners, exposing its operator to broader legal and financial consequences.

Complete the form to unlock this article and enjoy unlimited free access to all PYMNTS content — no additional logins required.

An analysis published Monday (Oct. 5) by the International Association of Privacy Professionals (IAPP) argues that businesses need to evaluate agentic AI through both cybersecurity and liability frameworks. Regulation could play a constructive role by establishing security standards that help prevent incidents and give compliant companies grounds to defend their conduct when safeguards fail.

The analysis builds on a Forbes article by technology executive Emil Sayegh, who says companies should treat AI agents as privileged identities. An agent connected to financial software, internal databases or collaboration platforms may possess credentials and authority comparable to those of an employee with sensitive access.

That requires companies to answer five foundational questions: Which AI agents are operating, and who owns them? What systems and data can they access? Which actions require human approval? Are their activities monitored? Can their access be revoked immediately?

For IAPP, however, identifying those controls is only the starting point. Businesses must account for the speed at which attackers could exploit an agent authorized to execute code, call application programming interfaces or change system configurations.

A compromised artificial intelligence agent could enable credential theft, privilege escalation or movement across connected systems before a human reviewer has time to intervene.

Source link