Are AI agents safe to deploy? (And what actually goes wrong)
Most agent incidents are permission accidents. Of 750 technology leaders surveyed in April 2026, 54% had already had an agent-related security incident, and 32.9% put it down to over-privileged access rather than model behaviour. The useful question is how far a single agent can reach before anyone notices.
What decides whether an agent is safe
Agent safety is set by blast radius: what one agent can read, what it can change, and whether a person can put it back. Gravitee surveyed 750 technology leaders across the UK and US in April 2026 and found 54% had already had an agent-related security incident, with 32.9% naming excessive permissions as the failure pattern. Only 37.8% could name a person accountable for what their agents did.
The test that makes the decision concrete
Meta published a rule on October 31, 2025 that holds up in a budget conversation. Count three properties for any agent session: it reads untrusted input, it reaches private data or sensitive systems, and it can change state or send things outside the company. Any two are workable. All three creates a path where hostile text arriving in an email or a web page instructs the agent to move company data out, which no vendor patches away. Agents that need all three run under human approval or they do not run.
What that changes about the rollout
Scoping is the work, not vendor selection. Give each agent one job, one set of credentials, and one named owner, and require approval on anything irreversible: money moving, records deleting, messages leaving the company. Agent fleets roughly doubled between December 2025 and April 2026, and 38% of organizations now run more than 100 agents, so the scope rules set for the first three get inherited by the next hundred. Start where a mistake costs an hour of rework, widen once the logs are boring.
Last updated: Aug 14, 2026