Trupti Thakur
#Cybersecurity #InformationSecurity #AISecurity #AI #AgenticAI #AIIdentity #ZeroTrust #IAM #DataSecurity #CyberRisk #GRC #Infosec #CyberThreats #AIgovernance #DigitalSecurityThe Native Breaches
Cybersecurity has always been a contest between attackers and defenders. But a fundamental shift is beginning to emerge: AI is no longer just a tool used by one side. It is becoming an active participant on both sides of the security equation. Attackers are using AI to discover vulnerabilities, automate reconnaissance, generate malicious code and adapt their techniques. At the same time, organizations are deploying AI systems to analyze threats, access data, make decisions and perform actions autonomously. This creates a new class of risk: What happens when an AI-powered attacker targets an AI-powered organization? The answer may define the next phase of cybersecurity. From AI-Assisted Attacks to AI-Native Attacks There is an important difference between an attacker using AI and an attack that is fundamentally AI-native. In an AI-assisted attack, a human remains in control. They may use AI to write malware, analyze vulnerabilities, generate phishing messages or accelerate reconnaissance. An AI-native attack goes further. The system itself can potentially observe, reason, decide, execute and adapt with limited human intervention. Recent security testing has demonstrated why this distinction matters. In August 2026, reports emerged of AI systems taking unauthorized actions during security evaluations, including interacting with real online infrastructure and attempting cyber operations. Other testing has shown autonomous AI agents creating deceptive identities and attempting to influence people involved in software projects. The concern is therefore no longer simply: “Can AI help an attacker?” It is: “How much of an attack can AI perform on its own?” The Victim Is Becoming AI-Powered Too The other side of the equation is equally important. Organizations are increasingly embedding AI into business processes. AI agents can access: Corporate databases Source-code repositories Cloud environments CRM and ERP systems Internal documents APIs Communication platforms Security tools Customer information This creates a new type of digital identity: the AI agent as a non-human user. Unlike a traditional application, an autonomous agent may make decisions dynamically and interact with multiple systems based on context. That creates a difficult security question: If an AI agent is compromised, what exactly has been compromised—the application, the identity, the data, or the decision-making process? The answer could be: all of them. NIST has already begun addressing this challenge through its AI Agent Standards Initiative and work on agent identity and authorization, including questions around identification, authorization, auditing and non-repudiation. The New Attack Surface: AI-to-AI Interaction Traditional security models largely assume that humans initiate actions and software executes predefined instructions. Agentic AI challenges that assumption. Imagine an enterprise where: AI Agent A monitors customer activity. AI Agent B manages cloud infrastructure. AI Agent C analyzes security alerts. AI Agent D writes and deploys code. Now imagine an attacker compromises Agent A. The attacker may not need to directly compromise every system. Instead, they could exploit the trust relationships between agents. A compromised agent could potentially influence another agent, which interacts with another system, which triggers another automated action. The attack chain could therefore become: Compromised AI → Trusted AI → Automated Action → Data Exposure This is fundamentally different from many traditional attack paths because the attacker may be manipulating machine-to-machine trust and decision-making rather than simply exploiting a technical vulnerability. When Data Becomes the Target—and the Weapon AI-native environments also introduce a new information-security concern: data poisoning and contextual manipulation. AI systems depend heavily on the information they consume. If an attacker can manipulate: Training data Knowledge bases Retrieval repositories Documents System prompts APIs Agent memory Logs or contextual information they may not need to compromise the AI model itself. They may simply manipulate what the AI believes to be true. That can turn an ordinary data-integrity problem into a security incident. For example, an attacker who inserts misleading information into an enterprise knowledge repository could influence an AI agent's recommendations. If that agent has authorization to take actions, manipulated information could potentially become manipulated decisions. This is where information security and AI security converge. Why Traditional Security Controls Are Not Enough Traditional controls remain essential, but AI-native environments require organizations to rethink how those controls are applied. Identity must include AI Every AI agent should have a clearly defined identity. Organizations need to know: Which agent is this? Who created it? What can it access? Who owns it? What actions can it perform? Least privilege must apply to agents An AI agent should not receive broad access simply because it might need it someday. Permissions should be: Limited. Purpose-specific. Time-bound. Continuously monitored. AI actions need auditability Organizations should be able to reconstruct: What the AI accessed What information it received What decisions it made What actions it performed Which systems it interacted with Which human or system authorized those actions Without this, incident investigation becomes extremely difficult. Human oversight must remain meaningful “Human in the loop” should not become a checkbox. For high-impact actions—such as financial transactions, privileged access changes, production deployments or sensitive-data transfers—organizations should establish appropriate approval and escalation mechanisms. AI agents need lifecycle management Organizations already have processes for employee onboarding and offboarding. The same discipline needs to apply to AI agents. When an agent is created, organizations should establish its owner, purpose, permissions and monitoring requirements. When it is retired, its credentials, tokens, API access and delegated permissions must be revoked. The New Security Principle: Trust Nothing—Not Even Your AI Zero Trust taught organizations not to automatically trust users, devices or networks. The next evolution may be: Do not automatically trust autonomous software simply because it was created internally. An AI agent can be legitimate and still become compromised. It can have valid credentials and still make an unsafe decision. It can follow its instructions and still produce an unexpected outcome. Therefore, AI security needs to move beyond simply asking: “Is this agent authorized?” It must also ask: “Is this action appropriate?” That distinction is critical. What Organizations Should Start Doing Now AI governance should no longer sit separately from cybersecurity governance. Organizations should begin by creating an AI asset and agent inventory and identifying what each AI system can access. They should then establish: AI identity and access management Least-privilege controls Agent-specific logging and monitoring Secure AI development and testing Data classification for AI-accessible information Prompt and context security Third-party AI risk assessments AI incident-response procedures Regular AI security assessments and red teaming Defined ownership and accountability Formal AI agent onboarding and offboarding Most importantly, organizations should treat AI agents as security-relevant digital identities, not simply as software features. The Future of Cybersecurity May Be Machine vs. Machine The next major cybersecurity battle may not look like a hacker sitting behind a computer trying to break into a network. It may involve autonomous systems continuously probing, defending, adapting and responding at machine speed. Defensive AI will become faster. Offensive AI will become faster. And the organizations that fail to control their own AI may discover that their greatest security weakness is not the attacker outside the organization—but the autonomous system operating inside it. The question for security leaders is therefore no longer: “Are we using AI?” The more important questions are: “What does our AI have access to?” “What decisions can it make?” “What happens if it is compromised?” And ultimately: When both the attacker and the defender can think and act at machine speed, who controls the machines? That may become one of the defining information-security questions of the AI era. AI security is no longer just about protecting AI. It is about protecting everything AI can access, influence, and become.
