— Start of the story
A few weeks ago, a security researcher demonstrated something that should worry every team racing to deploy AI agents: a worm-like exploit that could spread through nothing more than a missed call on a messaging app, no click required. Around the same time, one of the leading AI labs rated its newest model a critical cyber risk before it even shipped. Neither of these is a hypothetical anymore.
At SAARZ Int., we spend a lot of our time helping clients put AI agents into production, connected to real tools, real data, and real customers. So this isn't an abstract policy debate for us. It's the question we get asked in almost every project k
— The numbers tell the story
Here too, this isn't a hunch. Nearly half of cybersecurity professionals, 48% in a widely cited Dark Reading poll, now name agentic AI as the single biggest attack vector of the year, ahead of deepfakes and passwordless adoption. Darktrace's 2026 State of AI Cybersecurity report puts the concern even higher, with 92% of security professionals worried about what AI agents mean for their organizations. And among enterprises that have already deployed agents, 88% have logged at least one security incident tied to them.
The cost side is just as sobering. The average AI-agent-related breach now runs close to $4.7 million. Prompt injection, a term that barely existed three years ago, is already implicated in over a third of deployed agents, and roughly 4 in 100 GenAI prompts inside enterprises now carry a high risk of leaking sensitive data. This year also brought the first widely disclosed case of an AI system being used to run the bulk of a real cyber-espionage campaign autonomously, with human operators stepping in only at a handful of decision points.
None of this means AI is unsafe to use. It means the risk has moved. It's no longer just about whether a model gives a wrong answer. It's about what happens when a model with real permissions gets tricked, manipulated, or copied by someone who was never supposed to have access in the first place.
— Why an agent is a different kind of risk than software ever was
Traditional software does exactly what it's told, nothing more. A traditional cyberattack has to fight its way in from the outside. An AI agent flips both of those assumptions. It can read a webpage, an email, or a document, and treat instructions buried inside that content as if they came from you. It can hold API keys, database access, and login sessions across a dozen tools at once. And it can act at machine speed, making decisions in milliseconds, long before a human notices anything is wrong.
That combination, broad access plus a willingness to follow instructions from wherever they appear, is exactly what security researchers mean when they call agentic AI “the attack surface poster child” of 2026. The vulnerability isn't a bug in the model. It's the gap between what the agent can technically do and what anyone actually verified it should be allowed to do.
— Why this matters more than which model you pick
This is the same lesson we've written about before when it comes to harness engineering, and it holds just as true for security. Before we ask which model to use, we ask a different set of questions:
• If this agent is compromised or tricked, what is the worst thing it could actually do?
• Can it tell the difference between an instruction from us and an instruction hidden inside a document it's reading?
• Does every credential it holds expire, and is every action it takes logged somewhere a human can actually review?
• If something goes wrong at 2 a.m., does the system fail safely, or does it just keep going?
None of these are model questions. They're architecture questions. And they're the difference between an AI rollout that scales safely and one that turns into next year's breach headline.
— A quick example
Say you're building an AI agent that reads incoming customer emails and drafts replies. Without security built into the design, a malicious email could contain hidden instructions telling the agent to forward internal data or reset an account password, and the agent might comply without ever realizing it had been hijacked. With the right controls in place, the agent's permissions are scoped so it can draft, but not send account changes; every tool call is logged; and anything touching sensitive data requires a human to approve it first. The model didn't get smarter. The system around it got harder to fool.
— Where we see this going
AI adoption isn't slowing down, and it shouldn't. But 2026 is the year the industry stopped treating AI security as a someday problem. Regulators are starting to require adversarial testing for high-risk systems. Boards are asking security teams pointed questions about agent permissions. And the organizations getting real, durable value out of AI are the ones treating security as part of the build, not a review that happens after launch.
That's the lens we bring to every AI project at SAARZ Int.: build the intelligence, but never ship an agent that can act faster than anyone can catch it if it goes wrong.
