Behaviour is the only security signal that follows AI everywhere - Cybersecurity Insiders

AI now runs through nearly every part of the enterprise, from generative tools staff use daily to agentic capabilities built into familiar software. But alongside its potential to improve workflows, AI is a double-edged sword that increases risk exposure. Every new tool, integration, or agent brings an identity that seeks access, acts on systems, and generates data, yet few teams could say who owns a given agent or how far its access reaches.

This blind spot leaves organizations vulnerable to external threat actors exploiting the expanded attack surface of new AI identities. Worse, an organization's own agentic tools may pose threats if not properly managed. The most dependable way to close this gap is the one thing all these identities produce: behavior.

Limits of existing controls

The notorious Hugging Face incident illustrates what happens when agentic AI slips its leash. In July, an agent running in an OpenAI evaluation used a zero-day to escape its sandbox, then ran a campaign against Hugging Face spanning four and a half days and around 17,600 actions. It achieved cluster-admin access across several clusters in under 13 hours, combining new flaws with familiar weaknesses like overly broad permissions.

This incident exposes two limits in how most security is built. Rules only catch what has already been anticipated, and an AI estate that changes weekly rarely allows for that. AI doesn't pass through any single control point—it runs across browsers, SaaS applications, cloud workloads and agents connecting to systems that nobody has catalogued.

Tracking behavior across environments

Behavior is the thread connecting different environments. Wherever AI operates, the key question is whether an identity is acting as it has before. Hugging Face found its earliest warnings ambiguous in isolation, with the working route buried among thousands that failed. Knowing what normal looks like lets those faint signals stand out.

For employees, once an AI tool is installed, it may be able to touch company data and set up its own agents. Guiding people at the point of use while blocking only what presents real risk lets them keep working while leaving security with an audit trail. Agents deserve the same scrutiny, as most organizations have more running in production than inventory records show.

From visibility to response

Managing AI is impossible unless an organization knows what it's running. Discovery must cover both sanctioned and unsanctioned tools, along with what each costs the business, because every other control is built on that foundation. Detection must keep pace too—hand-written detections can take weeks to build and are often obsolete on arrival.

The tools and agents will keep changing faster than any rulebook, but what they do will always leave a trail. Security engineers need to question behavioral data directly, using AI to investigate activity across identities and systems instead of relying solely on manually assembled queries and rules.