AI Agent Permissions Are Outpacing Security Governance: What Organisations Should Consider

New survey findings reported by Help Net Security reveal that 70 per cent of organisations have granted AI agents the ability to make decisions and take actions that would previously have required human approval, with three in four organisations experiencing at least one AI-related security issue or warning sign in the past twelve months. The survey covered 1,100 IT and security decision-makers and reflects the pace at which AI tools are being integrated into business workflows — often faster than security governance frameworks can keep pace. Separately, Infosecurity Magazine reports that researchers have uncovered a new phishing-as-a-service platform called Athena StealthRoute, which uses an integrated AI Studio to generate convincing phishing lures and decoy content designed to evade detection tools, illustrating that attackers are exploiting the same AI capabilities to improve the quality and scale of their campaigns.

Why this matters for UK organisations

The combination of AI agents with broad system permissions and AI-enhanced phishing attacks creates a compounding risk for UK organisations. On one side, AI tools are being granted access to sensitive systems, data and decision-making processes without the same level of scrutiny that would apply to a new employee or a significant software deployment. On the other, attackers are using AI to generate phishing content that is more contextually convincing and harder for both humans and automated detection tools to identify. If an employee falls for a well-crafted AI-generated phishing lure and an AI agent with elevated permissions has already been integrated into the same environment, the potential impact of a successful attack is amplified. This is not a reason to avoid AI adoption, but it is a clear signal that security governance needs to keep pace with deployment.

What to review

Organisations should audit what permissions and system access have been granted to AI agents and tools, applying a least-privilege principle in the same way they would for any user or service account. Security and IT teams should ensure that AI-enhanced phishing techniques are reflected in current awareness training, so that employees understand that AI-generated content may be more polished and convincing than traditional phishing attempts. Any process for adopting new AI tools should include a security review as a standard step before those tools are granted access to sensitive systems or data. Governance frameworks that were designed before AI agents became commonplace may need to be revisited to ensure they adequately address the new categories of risk these tools introduce.

Source: Help Net Security