The Agency Gap: Why Your New AI Workforce is a Security Time Bomb

For the last two years, the enterprise world has been obsessed with “passive” Large Language Models (LLMs). We treated AI like a brain in a jar, a sophisticated chatbot that could answer questions but lacked the ability to interact with the physical or digital world. As cybersecurity expert G Mark Hardy puts it, we are now trying to figure out how to keep the “genie in the bottle” as that brain develops arms and legs.

We have officially entered the era of Agentic AI. These are autonomous agents that don’t just talk; they take action, moving money, accessing credit cards, and interacting with industrial equipment. While this autonomy is a powerful feature, it creates a massive new attack surface where security must be the foundation, not an afterthought.

Based on the insights of AI security leader Rock Lambros, here are the five critical takeaways every tech leader needs to understand about the transition from chatbots to agents.

1. The 46-Minute Window: The New Speed of Supply Chain Sabotage

Traditional cybersecurity advice tells us to “patch everything immediately,” but the speed of Agentic AI development has turned this wisdom on its head. In March, a threat group called Team PCP published two backdoored versions of Lite LLM, a critical piece of “plumbing” used to proxy calls to OpenAI and Anthropic, to the PyPI repository. In just 46 minutes, the malicious package was downloaded 47,000 times.

The stakes are even higher at the enterprise level; in July 2025, a compromise of Amazon Q saw “Delete all files” instructions shipped to 900,000 installs. This highlights a terrifying reality where by the time you run an automated update, the threat may already be deep within your environment.

“The malware is inside of your gates, it’s inside of your environment long before you ever realize it.” — Rock Lambros

This shift forces organizations to move away from blind patching toward “pinning dependencies” and manual smoke testing in dev environments. In the agentic world, the risk of a poisoned update often outweighs the risk of a delayed patch, forcing a re-evaluation of the opportunity cost of speed.

2. The “Confused Deputy”: The Critical Gap in AI Identity

The most significant structural flaw in enterprise AI today is the “identity gap” (ASI03). Most AI agents currently in production do not have their own unique credentials; instead, they inherit the identity and privileges of the human user who invoked them. This creates a “Confused Deputy” problem, where a low-privilege agent can trick a higher-privilege peer, such as a finance agent delegating to a database agent, into performing unauthorized actions.

This lack of distinct identity makes it impossible for systems to distinguish between a human’s legitimate intent and an agent’s internal manipulation. Without per-agent credentials, the enterprise AI ecosystem remains an unobservable black box where attribution and audit trails vanish.

“Most agents in production today run with the identity of the human who created them or invoked them. They don’t have a distinct identity, they don’t have clean attribution, they don’t have a real audit trail.” — Rock Lambros

3. “Trim Tabbing” the Truth: The Subtlety of Memory Injection

In aviation, a “trim tab” is a tiny flap on a rudder that makes minuscule adjustments to a craft’s position, yet it can alter a plane’s trajectory by hundreds of miles over a long journey. This is the perfect metaphor for Memory and Context Injection (ASI06). Attackers don’t need to rewrite an agent’s entire code; they simply inject small, repeated “truths” into its long-term memory until the model’s weights shift and it begins to act upon false information.

Once a model is poisoned in this way, “re-educating” it is notoriously difficult and cost-prohibitive. To put the scale of compute costs in perspective, Rock Lambros notes that even an undergraduate school project using Bedrock can cost $1,000 in just a day and a half. For an enterprise, you cannot simply press a “reset” button on a multi-million dollar training run once the memory is compromised.

4. “Least Agency” is the New “Least Privilege”

We are all familiar with the principle of Least Privilege, but in the age of agents, we must adopt Least Agency (ASI02). This means limiting not just what an agent can access, but what decisions it is allowed to make autonomously. If a task can be handled by a simple if-then-else statement, it should not be an agent; true autonomy should only be granted when absolutely necessary for the mission.

This approach is also a critical defense against the psychological burnout and “rubber stamping” that occurs when humans are left in the loop of high-velocity systems. By restricting an agent’s agency, we reduce the cognitive load on human supervisors and prevent tool misuse, such as an email summarizer being tricked into sending fraudulent payment requests.

5. The AI Telephone Game: Cascading Failures in Agent Chains

As we move toward multi-agent systems, we face the risk of Cascading Failures (ASI08). This is the “Telephone Game” of the AI era, where a minor hallucination or data injection in the first agent of a chain becomes unrecognizable and dangerous by the time it reaches the end of the line. A single compromised critical decision point can trigger a series of increasingly diverted actions across the entire agentic workforce.

To combat this, we must treat inter-agent communication as inherently untrusted, making this the purest use case for Zero Trust in cybersecurity history. While the industry is currently relying on TLS as a “band-aid,” keep an eye on emerging standards like AAuth and current IETF drafts aimed at formalizing secure agent-to-agent (A2A) protocols.

--------------------------------------------------------------------------------

Conclusion: A Five-Step Checklist for Next Week

The industry is currently caught in a wave of “vibe coding”, creating complex systems based on conversational intent rather than rigorous architectural discipline. To sober up and move toward a production-ready security posture, follow this immediate action plan:

1. Inventory: Find every agent with tool access and map their specific permissions.

2. Kill Switch: Implement a manual emergency disable function for every agent, no exceptions.

3. Least Agency: If a tool doesn’t need autonomy to function, strip its agency and revert to logic-based code.

4. Intent Gates: Add human approval gates for any agent action that writes, deletes, or transfers critical data.

5. Observation: Log every tool invocation, delegation, and goal shift to maintain visibility.

As we delegate our world to autonomous agents, we must decide if we are building on a foundation of security or merely hoping the genie stays friendly. Autonomy is a powerful feature, but without these foundations, it is a liability your organization cannot afford.