Your AI Assistant Could Soon Spend Money For You. Who Pays If It Goes Wrong?

Imagine telling an AI assistant to plan your holiday.

It finds the flights. Checks the hotel. Compares prices. And then, instead of merely showing you the options, it books everything for you.

Or imagine asking it to manage your monthly bills, order something you need, update your subscriptions or work across several apps on your behalf.

Convenient? Absolutely.

But there is a catch.

What Happens When The AI Gets It Wrong?

And more importantly, what happens when an AI agent has access to your money, apps, work accounts or sensitive information and someone else gets control of it?

That is the next big headache the technology industry is preparing for as AI moves from simply answering questions to actually taking action.

AI Is Moving From Answers To Actions

For years, most people have used AI as a glorified search box or chatbot. Ask something, get an answer and decide what to do next. AI agents are changing that model.

These systems can be designed to perform tasks across software applications, databases and APIs. In other words, they don't just tell you what to do. They can potentially do it for you.

That could eventually mean an AI agent booking a ticket, placing an order, moving information between applications or carrying out a series of workplace tasks.

And that is where the security problem starts. An AI agent needs permission to access the tools it uses. Give it too little access and it may not be useful. Give it too much and a mistake - or a compromised agent - could have consequences far beyond a wrong answer.

A chatbot giving you the wrong restaurant recommendation is annoying. An AI agent making the wrong transaction or deleting the wrong data is a very different problem.

The New Risk: AI With The Keys To Your Digital Life

Rubrik, the security and AI operations company, says organisations are already struggling to keep track of what their AI agents can access.

Its latest data from Rubrik Zero Labs found that 86 per cent of global IT and security leaders expect AI agents to outpace their organisation's security guardrails within the next year.

Yet only 23 per cent say they have full visibility into the agents operating in their environments. That gap could become important as companies and individuals deploy more autonomous AI.

The concern is not necessarily that an AI agent will suddenly "turn evil". The bigger problem could be much simpler: an agent may have access to something it shouldn't, make an unexpected decision or be compromised by an attacker.

And because these systems can operate at machine speed, a mistake could spread much faster than a human employee could react.

Your AI May Need A Password. But It Shouldn't Have The Keys Forever

This is where the way AI gets access becomes critical. Traditional systems were largely built around human users. A person logs in, gets access and carries out a task.

Autonomous AI agents are different. As Dev Rishi, General Manager of AI at Rubrik, put it, "Agents are no longer just synthesising information, they are acting on behalf of employees."

The company argues that static credentials were never designed for autonomous actors. Its answer is Rubrik Agent Identity, unveiled as an expansion of the Rubrik Agent Cloud platform.

The basic idea is relatively easy to understand. Instead of giving an AI agent broad, permanent access, organisations can decide exactly what it can access at the moment it needs to perform a particular task.

Rubrik calls this just-in-time access. The system can mint scoped, short-lived tokens for individual tool calls, rather than leaving standing permissions active indefinitely.

So if an agent needs to perform one particular action, it gets permission for that action -- rather than a permanent digital key to an entire system.

What If The AI Tries To Do Something It Shouldn't?

Rubrik's system is also designed to check an AI agent's action before it happens. Its MCP Gateway uses three checkpoints.

First comes behavioural analysis. The system evaluates the requested tool call, its context, inputs and potential operational impact. Then comes access policy enforcement, where security policies are checked at the infrastructure level.

Finally, there is identity verification. The agent session is authenticated and a short-lived token is created specifically for that tool call. If an agent attempts an action outside its permitted scope -- such as modifying something it isn't authorised to change - the transaction can be blocked before execution.

That is important because the risk with autonomous AI isn't only a hacker breaking in. Sometimes, the AI itself could simply do the wrong thing.

And What If The AI Has Already Made The Mistake?

This is where another part of Rubrik's announcement becomes interesting. The company has also highlighted Agent Rewind, designed to undo destructive actions taken autonomously by an AI agent. Think of it as an undo button for certain AI-driven mistakes.

This could become increasingly important if AI agents are allowed to operate across databases, software and other business systems with limited human intervention.