In April 2026, an AI coding agent deleted a company’s entire production database in under ten seconds. When asked why, it admitted to guessing rather than verifying.
The story sounds concerning, but actually, there’s a lot we can learn from it—namely because the agent didn’t malfunction. It was asked to clean up a staging environment, found a forgotten API token an unrelated file, and used it. That token worked like a master key, so one wrong guess reached production, and the rest is history. Or it will be, anyway.
And this isn’t an isolated incident. I recently had the opportunity to speak with Susanne Senoff on our podcast, Identity Decoded, and she shared a similar story where an agent went rogue, looking like a threat actor to complete its task.
So, the agent didn’t act maliciously or make a bad judgement call. It could just access too much, and that makes it an identity problem. But, because I’m a bit allergic to FUD, I’m happy to share that this is a problem organisations can start solving now.
I recently sat down with CNBC Explains to chat about the increasing risks of AI Agents (and what to do about them). You can watch the full segment here, or continue reading to see how I would get ahead of stories like the one we’ve just discussed:
Agents have identities, so onboard them like digital workers
A new hire gets an identity, a manager, and access scoped to their job. AI agents need the same. They authenticate, hold credentials, and act inside (and sometimes outside) your systems, often without human supervision, ownership, or guidance. When an agent gets it wrong, early legal thinking points the same way: the business that deployed it owns the outcome.
All AI agents’ access permissions must be treated with the same rigour as humans’. When thinking about agents, we need to get into the habit of asking: “what can this identity reach if it gets something wrong?”
Best practices are coming, but here’s what you can do in the meantime
In the grand scheme of things, agents are really new, and that means no one is completely certain how we should protect them (and our businesses). I’ve noticed this affecting many identity and security teams, who are hesitant about picking an approach to securing agents without the guidance of established, time-tested best practices.
This leads to a kind of analysis paralysis: should agents have their own identities and credentials, or not? Should you wait for proven approaches or act now as the risk grows—as more and more business are adopting agents?
I’m a strong believer in mastering your risk and in progress over perfection. Here are five steps that can be taken today to help you understand your agents, reduce risk, and build maturity without waiting for best practices—or an incident.
#1: Find your agents. Yes, all of them.
Inventory the agents running in your environments, including ones other teams set up themselves, and the credentials and access each one uses. Expect surprises (that’s the point of looking) and expect to find a lot more than you anticipated, especially as you’re likely experimenting with multiple agentic platforms.
You don’t have to find every single one before you start protecting (see tip #5 for more on this), but you should aim to catch ‘em all!
#2: Give each agent its own identity and a human owner.
No shared tokens or borrowed developer access. Every agent should trace back to a distinct identity and an accountable human, so you know who to ask, what to switch off, and how to manage it.
#3: Limit what each agent can reach.
Apply Least Privilege properly. Scope credentials tightly by starting with what you absolutely DON’T want an agent to touch, and verifying existing permissions; for example, to payment systems, regulatory systems, customer databases, etc. Hunt down forgotten tokens, let agents work on a copy rather than production, and keep backups out of reach. An instruction in a prompt is a request. An access policy is a control—and it’s one that’ll stop these kind of incidents.
Listen
What happens when a well-intentioned AI agent goes rogue?
Hear it from a CISO: When a sanctioned AI agent started acting like a threat actor on one of Conga’s most important databases, Susanne Senoff’s team had to act fast. Hear what happened, and why she treats agents like teenagers, on Identity Decoded.
#4: Control agents at runtime and prepare your environment for the fast and curious.
There are two sides to protection, and you need both.
The first is controlling what agents do, as they do it. A valid credential isn’t proof that an action is right, so you need to be able to check each request at the moment of access. Is it unusual, risky, or out of character for the agent? Answering that inline, before access is granted, turns policy into protection, and lets you stop an agent from overstepping.
The second is making your environment ready for things that are both fast and curious. Lock your most critical systems to known users and usage patterns only. Build it into platform engineering and governance, so every new account is born with restrictions and an accepted use case. Even an agent you haven’t yet vetted is then far less able to wander into something they shouldn’t.
#5: Don’t wait for the work to be done before you switch on enforcement.
I’ll say it again: progress beats perfection. Waiting until you have a complete inventory, perfect ownership map, and finished clean-up before you can reduce your exposure to rogue or over-permissioned agents isn’t going to do you any favours. It’ll just leave you with a headache and a to-do list that feels like it’ll never end.
So, I suggest putting runtime guardrails around every identity—human, non-human, and AI—regardless of your current set-up or tech debt. Start by stopping the worst-case scenarios first, and go from there. This keeps access in check while you catch up, reducing risk now, not when the to-do list is finished.
learn more
Secure in spite of legacy: The IAM leaders' guide to controlling identity risk
Take a look at my blog on how to get secure in spite of your tech debt—and how to master your identity risk.
The bottom line
Stopping AI agents from going wrong starts with access, not intent. Find your agents, give each one an identity and an owner, limit what they can reach, and make progress towards reducing your risk today, and for what matters most to your business.
Want to see how this works in practice? Find out how Silverfort helps you discover, control and secure agents at runtime.
Watch this video with CNBC Explains for the real incidents, the question of who’s liable if it goes wrong, and how to deploy agents safely.
