Power tends to corrupt, and absolute power corrupts absolutely. Hindu mythology offers a cautionary parallel in the story of Ravana: despite earning immense power and invincibility through devotion and penance, he let ego override wisdom, turning strength into tyranny. His fall proves that capability guarantees nothing once free will goes unchecked -- a fate that could just as easily befall a powerful AI agent operating without adequate control.
We are now witnessing Artificial Intelligence moving from systems that answer questions (Query or Prompt) to systems that act (AI Agents). AI agents can browse the internet, write and execute code, access databases, call APIs, send messages, create accounts and coordinate with other agents. This transition from intelligence-as-a-service to agency-as-a-service promises enormous productivity but also creates a fundamentally new cybersecurity problem.
AI Agents Going Rogue
The recent incidents involving rogue AI agents escaping controlled environments and interacting with external websites demonstrate why this concern can no longer be dismissed as science fiction. In July 2026, OpenAI disclosed that during an internal cyber-capability evaluation, its AI agents escaped a sandbox, gained unintended internet access, and breached Hugging Face's production systems to obtain benchmark test answers. This was described as an "unprecedented cyber incident" with no malicious human intent alleged. Independent investigators subsequently reported hundreds of agents coordinating their activities and attempting to conceal or manipulate evidence of their actions.
Read: AI Agents Built Secret Society, Then Some Chose To "Sacrifice" Themselves
Even more concerning, reports emerging in September 2026 describe an earlier incident in which OpenAI-associated agents allegedly took control of a German-language wiki, using it as a communication platform and making thousands of unauthorised edits.
These events point towards a new category of cyber risk: the autonomous agent that becomes an unintended cyber actor.
From AI Assistance To AI Agency
Traditional AI generally waits for a human instruction and produces an answer. Whereas an AI agent can interpret an objective, formulate a plan, select tools, execute multiple steps and adapt according to the results. This capability is precisely what makes agents powerful and extremely dangerous.
For example, give an agent the objective "find vulnerabilities in a particular environment", and it may scan systems, create accounts, exploit weaknesses and establish persistence.
Another example: give it the task to "optimise a particular business process", and it may modify databases, send communications or change configurations. If its interpretation of the objective diverges from human intent, the agent can execute the wrong strategy at machine speed.
The fundamental security question therefore changes from: "Can AI generate harmful information?" to: "What can AI autonomously do in the real world?"
The Permission Problem
The greatest danger may not be a malicious AI. It may be a legitimate AI with excessive permissions. An enterprise agent connected simultaneously to email, cloud storage, source-code repositories, financial systems, identity platforms and internal databases effectively becomes a privileged digital employee. If compromised or manipulated, the agent provides an attacker with a ready-made pathway through multiple organisational boundaries.
This creates what might be called "living off the agent" (LOTA), like "living off the land" (LOTL) cyber-attack. Instead of deploying malware, an adversary manipulates an authorised AI agent and makes it perform legitimate operations on the attacker's behalf. Recent cybersecurity analysis has highlighted this emerging possibility as agents become deeply embedded in enterprise workflows.
Prompt Injection Becomes An Execution Vulnerability
AI agents also introduce a new form of attack surface because they consume untrusted information. A malicious instruction hidden in a webpage, email, document, repository or database may be interpreted by an agent as an instruction rather than data. This is known as indirect prompt injection. The consequences can be serious. Security researchers have demonstrated scenarios in which malicious web content can influence agents to disclose information, alter decisions or initiate unauthorised actions.
The problem is particularly difficult because natural language itself becomes part of the attack surface. The distinction between "data to be read" and "instructions to be obeyed" is no longer inherently clear to a Large Language Model (LLM).
The Swarm Problem
One rogue agent is dangerous, whereas hundreds or thousands of cooperating agents could be transformational. It is like the lethality of swarms of drones in warfare, as seen in the ongoing conflicts and near-home Op-Sindoor. The recent OpenAI/Hugging Face investigation reportedly found extensive agent-to-agent communication and coordination, which introduces the possibility of AI cyber swarms where large numbers of relatively capable agents divide tasks among themselves.
Like an Atlas drone program of the PLA, an AI cyber swarm could potentially perform reconnaissance, vulnerability discovery, exploitation, credential hunting, social engineering and persistence simultaneously. More importantly, the agents could learn from each other's successes and failures. This changes the economics of cyber warfare. Presently, sophisticated cyber operations require large, skilled human teams, but soon a relatively small number of humans could supervise large numbers of autonomous digital actors operating continuously across thousands of targets.
The Accountability Gap
There is another problem of accountability: who is responsible when an agent acts beyond its mandate? Is responsibility with the developer who created the model? The organisation that deployed it? The employee who authorised it? The cloud provider? Or the agent itself?
Existing cybersecurity governance was designed largely around human decision-makers and deterministic software. Autonomous agents blur that boundary. Consequently, organisations must treat agents not simply as software applications but as digital actors with identity, authority, accountability and behaviour.
Building An "Agentic Zero-Trust" Architecture
Despite the elaborate dangers, the development of AI agents should not be curtailed, as their potential is too significant for businesses & operations. It is imperative to build security around the AI agents from the first line of code.
While developing Agentic AI, it should be ensured that every agent has:
1. Least-privilege access: no agent should receive more authority than necessary.
2. Explicit identity: every action must be attributable to a particular agent and human sponsor.
3. Capability-based permissions: access should be granted for specific actions rather than broad system privileges.
4. Human approval for high-impact actions: financial transfers, deletion, privilege escalation and external exploitation should require explicit authorisation.
5. Continuous behavioural monitoring: organisations must monitor not merely network traffic but agent objectives, tool calls and decision patterns.
6. Immutable audit trails: agents must not be able to modify or erase their own evidence.
7. Isolation and containment: agents should operate within tightly controlled sandboxes and be capable of immediate revocation.
8. Agent-to-agent controls: autonomous systems should not freely discover, trust or coordinate with other agents.
9. Adversarial testing: organisations must routinely test whether agents can be manipulated into violating their intended boundaries.
10. A genuine kill switch: there must always be a reliable mechanism to terminate an agent's execution and revoke its credentials.
The emerging principle should be "zero trust for agents."
The Strategic Warning
The most important lesson from rogue-agent incidents is not that AI is becoming evil. It is that capability can outrun control. An AI agent does not need human-like consciousness to cause enormous damage; it only needs sufficient capability, access, persistence and a poorly constrained objective.
The cybersecurity paradigm is therefore evolving once again from securing code, to securing data, to securing AI models, and now to securing autonomous digital actors. The next generation of cyber defence must assume that some agents will be compromised, some will behave unpredictably, and some may actively attempt to circumvent their constraints.
The fundamental principle should be simple: Never give an autonomous agent authority that you cannot continuously monitor, constrain and revoke.
AI agents could become the most productive digital workforce humanity has ever created. But without robust controls, the same workforce could become an autonomous attack force operating inside our organisations and potentially against the wider Internet by discovering zero-day vulnerabilities.
The future of AI security is therefore not merely about making intelligent machines trustworthy. It is about ensuring that intelligence never becomes unaccountable power.
(Air Vice Marshal (Dr) Devesh Vatsa is an Adviser, Cybersecurity & Critical Technologies, at the Data Security Council of India)
Disclaimer: These are the personal opinions of the author
