In an exclusive interview with Cyber Brief Daily, Tim Grieveson, chief security and risk officer at global payroll provider CloudPay, explains the pitfalls of AI agents and the best ways to deploy agents safely and securely.
Do you see AI agents as a potential insider threat?
AI agents are not the same as human insiders as they do not have any intent. With agents, what we are seeing is a shift from the question "Can they misuse the access they get?" to "How do they weaponize with speed, with multiple machines, with request permission across multiple infrastructures and how do they exploit controls in ways we may miss?" How do I, as a security and risk professional see this? It is medium-to-high risk but this rises to critical risk as soon as you give the agent the authority to execute transactions, manage infrastructure and make operational decisions autonomously.
What should AI be able to do and what shouldn't it?
It is very important to get this right at the agent's initial conception, by establishing the correct guardrails and putting an ethics committee in place. Are you understanding it from a privacy, a governance and a compliance perspective? AI agents can be used to increase productivity by functions such as onboarding customers. We see this as low risk. But AI agents are frequently used for insights into the company's systems and processes and this is the one that needs careful consideration. How do you look at that data? It is essential to understand where the human in the loop needs to be and to monitor GDPR compliance and other mandates to spot potential regulatory breaches, policy exceptions, supply chain security weaknesses and early signs of an AI agent drifting away from its guardrails. That is why it is vital to have the right guardrails in place right from the beginning and to conduct a full impact assessment, understanding exactly what you are using the agent for.
What are the key danger points?
When making a massive transaction, you have to ensure that a human okays the final transaction. This is also in the case of something that might impact someone in society, such as a credit rating. AI should not be seen as a replacement for people, but as something to make it easier for them to do their jobs.
What actually prevents an agent from exceeding its remit and how would you know if it had?
Firstly, it is important to think of digital agents as employees with privileged access — not just as a software feature. Agents should therefore only have access to the systems they need to limit the blast radius of a potential attack. Just as no single employee should have access to the entire business process, so neither should an AI agent. AI agents must also be prevented from assembling datasets unless that is their job. Be alert to prompt injections, as this is effectively a social engineering attack. Make sure no payment above a certain amount has automatic approval.
How should you monitor an AI agent's behavior?
Log everything including inputs and outputs so that you can go back and look at it. Continuous behavior analytics should also be put in place to monitor the AI agent's activity and a kill switch must be made available to terminate instantly any agent that has become a threat.
As seen when the Bank of Bots recently granted an AI agent a loan based on its credit history, agents are becoming increasingly autonomous. How should companies handle this development?
Monitor AI agents as if they were employees, granting them no more access to data than they need. Ask what does your future road map look like in 12 to 18 months, because AI is coming at us really fast? The three main considerations are: what actions can your AI agent take without human approval? Is company data being used to train the agent and, if so, where is it? How do you validate a proper response to an agent's self-generated autonomy?
