Behaviour is the only security signal that follows AI everywhere

AI now runs through nearly every part of the enterprise, from the generative tools staff use daily, to agentic capabilities increasingly built into familiar software. 

But alongside its potential to improve and reshape workflows, AI is a double-edged sword that can increase risk exposure. 

Every new tool, integration, or agent, brings an identity that seeks access, acts on systems, and generates data. Yet few teams could say who owns a given agent or how far its access reaches. 

Not only does this blind spot leave organisations vulnerable to external threat actors exploiting the expanded attack surface of the new AI identities, but an organisation’s own agentic tools may also pose a threat themselves if not properly managed.

The most dependable way to close that gap is the one thing all these identities produce: behaviour.

Why existing controls miss AI

The notorious Hugging Face incident remains one of the most prominent examples of what happens when agentic AI slips its leash. In July, an agent running in an OpenAI evaluation used a zero-day to escape its sandbox, then ran a campaign against Hugging Face which the company reports spanned four and a half days and around 17,600 actions. 

It went from one compromised pod to cluster-admin access across several clusters in under 13 hours, combining new flaws with familiar weaknesses like overly broad permissions and long-lived credentials. It appears to have been trying to cheat a benchmark rather than cause harm, but the result is the same either way. 

The incident exposes two limits in how most security is built. Rules only catch what someone has already anticipated, and an AI estate that changes weekly rarely allows for that. 

AI doesn’t pass through any single control point. It runs across browsers, SaaS applications, cloud workloads and agents connecting to systems that nobody has catalogued. Tools built around one chokepoint see only part of the picture.

Tracking behaviour across employees, agents and cloud

Behaviour is the thread connecting these different environments. Wherever AI operates, the key question is whether an identity is acting the way it has before. Hugging Face found its earliest warnings ambiguous in isolation, with the working route buried among thousands that failed. Knowing what normal looks like lets those faint signals stand out.

For employees, the issue is that once installed, an AI tool may be able to touch company data and set up agents of its own. Guiding people at the point of use, and blocking only what presents real risk, let them keep working while leaving security with an audit trail.

Agents deserve the same scrutiny. In most organisations, more are running in production than any inventory records. Whether built in-house for one job and left running or bundled with a third-party application. Each should be tied to the identities and permissions it holds and judged by how it behaves.

In production cloud, the risk extends beyond malicious activity, because an organisation’s own well-meaning agent can drift from its intended task and look no different from a compromised account. 

AI risk spans all three areas of an organisation, so it should be viewed as one picture rather than through a separate tool for each.

From visibility to response

Managing AI is impossible unless an organisation knows what it’s running. Discovery must cover sanctioned and unsanctioned tools alike, along with what each costs the business, because every other control is built on that foundation. The same picture gives governance and compliance programmes the evidence they need.

Detection must keep pace too. Hand-written detections can take weeks to build and are often obsolete on arrival. Security engineers need to question behavioural data directly, using AI to investigate activity across identities and systems instead of relying solely on queries and rules assembled by hand.

Security teams should not be forced to choose between enabling AI and controlling the risk it brings. Given enough context, they can let the business move quickly and still catch the moment a person, an account, or an agent steps outside its normal pattern. The tools and agents will keep changing faster than any rulebook, but what they do will always leave a trail.

_____

About Patricia Titus

Patricia Titus, a Field CISO at Abnormal AI, brings over 25 years of CISO experience to her role. Her extensive background includes CISO positions at prominent organisations such as Booking Holdings, Markel Corporation, Freddie Mac, Symantec. Throughout her career, she has been responsible for developing and implementing security strategies that align with business objectives and ensure adherence to global regulations. Recognised for her expertise in areas like risk management, AI, cybersecurity operations, and crisis management, Patricia has a proven track record of optimising security frameworks, improving business resilience, and incorporating innovative solutions, including AI, into security practices.