Most of the noise about AI agents is about what they can do. The more useful question, and the one fewer people are asking, is what they’re allowed to do.
A chatbot answers. An agent acts. It calls APIs, writes to databases, moves money, opens tickets, changes records. To do any of that it needs credentials and access, and in the rush to get something live it tends to be handed rather a lot of both. The permissions that felt reasonable during a demo quietly become standing access in production, and nobody goes back to trim them.
This is not a new problem wearing a new hat. It is the oldest problem in security: an account that can do far more than its job requires. We have spent years learning to give people least privilege, to log what they do, to treat identity as the thing worth guarding. An agent is just another identity, except it works faster, never sleeps, and will read a planted instruction in a document or an email and act on it without a flicker of doubt.
That last part is the bit worth sitting with. You don’t have to break the perimeter to misuse an agent. You have to get a few lines of text in front of it. It reads the instruction as a legitimate task and carries it out using access it already holds. No malware, no exploit code, just words and an action it was already trusted to take.
None of this is an argument against agents. They are genuinely useful and the region is adopting them quickly. It is an argument for treating them as what they are: identities with real power, governed by the same dull discipline we apply to any other account. Least privilege. An audit trail. A human gate on anything that moves money or touches a customer record.
Nobody gets breached by a clever sentence. They get breached by an account that could do too much. Some of those accounts are now agents.