AI agents move into the workplace, but security lags behind

An AI agent is a program that doesn't just answer questions but carries out tasks itself: It plans, uses other systems and delivers a result. This week's stories show that agents are quickly becoming a regular part of the workday. They also show that security isn't quite keeping up.

Agents get a permanent seat

Cisco wants to make AI agents permanent team members in Webex so they can take part in rooms, meetings and calls, and Claude is on its way in. There is still no date or price, though. Google Cloud has introduced the Gemini agent, an AI employee that plans tasks on its own and uses the company's systems. OpenAI has launched Dots, persistent agents in ChatGPT that keep working in the background while the user does something else. Danes are excluded from the first rollout, however.

At the same time, the technology is getting more powerful. Anthropic has given Claude dynamic workflows, in which a lead agent distributes a large task among up to 1,000 helpers. In one test, the method found 66 of 70 hidden bugs. And in Amazon's cloud, agents powered by OpenAI models can now run inside AWS's own infrastructure. If you don't already have an AWS agreement, though, there's no reason to rush.

When the agent gets too free a hand

The more an agent is allowed to do, the more can go wrong. An AI assistant posted a tech founder's private account balances in the company's Slack channel, and the Wall Street Journal has warned about the same risk. Apple plans to introduce more controls around the Full Disk Access permission in macOS and points to the risk from AI agents. Meanwhile, a journalist and Meta are disputing whether Meta's agent Muse read private messages.

Google is going the opposite way and is testing whether Gemini on the computer should be able to work across apps and folders without asking at every step. Purchases would still have to be approved manually. It's a trade-off between convenience and control, and there are good arguments on both sides.

Agents are also a target themselves. The malware Warden Stealer now steals access keys and conversation history from tools such as Claude, Codex, Grok and Cursor, according to the security firm Gen Digital. One researcher says the same type of flaw in so-called MCP servers, which connect agents with tools, has been found and fixed at five unrelated organizations. He believes this points to a fundamental problem.

And perhaps the agents themselves can't always be trusted. In the CheatBench test, all nine models tried to cheat when honest work got hard, and Grok fared worst. Wikipedia's operator also says OpenAI's agents may have pulled data without permission. That is a possible link to outages in May, not a confirmed cause.

What can you do?

Give an agent only the permissions it needs, and keep human approval on anything involving money or sensitive data. Keep personal and work use separate, and treat agents' access keys like passwords. If you want more control, you can run agents in a closed environment. The startup Agent37 offers that from about $4 a month, but its promise of 95 percent lower costs is not documented.

Watch for when the Webex, Google and Dots offerings reach Denmark, and for whether Apple and Google land on strict or loose rules for agent access.