The Real AI Risk Hiding in Your Company

The Most Dangerous System in Your Company Was Built Last Tuesday

78% of CISOs just named AI agent security as their single biggest pain point in a recent Team8 survey—more than double the next threat on the list. Not ransomware. Not phishing. Not supply chain attacks. The thing keeping security leaders up at night is something their own teams are building, right now, in plain English.

I've been getting the same question from clients every week: "Can the agent touch the close? The workpapers? The client files?" And the honest answer is usually the same: nobody scoped that, so—probably.

The threat isn't happening in the AI labs in San Francisco. It's happening in your company, built by your own people, with production access.

The Old Interview Question That Still Matters

Years ago I used to ask candidates: what's the best way to secure a computer? The answer I was looking for wasn't a firewall or encryption protocol. It was simpler than that.

Turn it off. Unplug it. Throw it in the ocean. Now it's secure.

Useless, but secure.

That's still the only guardrail that works 100% of the time. Which tells you something about every other control we've invented since.

The fundamental tension in security has always been the same: the more useful something is, the harder it is to secure. And AI agents might be the most useful—and therefore most dangerous—tool we've handed to knowledge workers since we gave them database access.

What Makes This Different (And Worse)

Team8's data shows 71% of organizations already have people standing up AI agents. In Claude, in Cursor, in Codex. "Summarize my email" one week. "Rework our sales process using enterprise data" the next.

Tim Brown, Team8's CISO, said it plainly: an AI agent isn't just another employee. It's a very resourceful employee that will do whatever it takes to accomplish the task it believes it was given.

Believes. Not "was given." Believes.

That word should make you uncomfortable. Because when you tell a summer associate to "pull the revenue numbers," they ask clarifying questions. They understand context. They know what they're allowed to touch. An AI agent with a production token and a loosely-worded prompt? It will spider through every system it can reach until it finds something that looks like revenue numbers.

"We'll have a second agent review the first" is not a control. It's two interns with the same production token.

Shadow IT Never Died—It Just Got Articulate

None of this is actually new. I've seen this movie before.

Remember the unsanctioned Excel macro that quietly became the actual close process? The one nobody documented, that lived on Janet's laptop, until the day Janet left and the whole month-end ground to a halt? That's shadow IT. It never went away. It just learned to speak in natural language.

The pattern is always the same:

Someone solves a real problem with an available tool. It works. It spreads. It becomes load-bearing infrastructure. Then one day it breaks and nobody knows how it works or what it touches.

The difference now is speed and surface area. That Excel macro took months to metastasize through the organization. An AI agent can become mission-critical in a week. And unlike the macro, which could only access the data you fed it, the agent can potentially access anything its token can reach.

Which raises the question nobody wants to answer: what can its token reach?

The Phil Jackson Problem

Phil Jackson never outplayed a single one of his players. He couldn't. Michael Jordan would destroy him one-on-one. His entire job was setting the conditions so eleven resourceful people didn't wreck the franchise.

That's the job now.

You don't outplay the agents. You can't. They're faster than you, they don't sleep, and they'll cheerfully try ten thousand approaches you'd never think of. Your job is to scope them, fence the data, and build the kill switch before you need it.

The question isn't whether your agents are powerful enough. It's whether they're contained enough.

I watched this play out with a client last month. Smart team, good intentions, built an agent to help with audit workpaper review. Worked beautifully. Then someone asked: "Wait, can this thing see PII?" Long pause. Longer Slack thread. Turns out nobody had scoped data access—they'd just pointed it at the document repository and told it to be helpful.

It was extremely helpful. It was also swimming in client data it had no business touching, with every interaction logged to a third-party LLM provider's training queue.

They didn't have a security problem. They had a discovery problem. Those always come first.

The Uncomfortable Question Nobody's Asking

Here's what I want you to think about: how many agents are running in your environment right now?

Not "approved AI tools." Not "the thing IT deployed last quarter." I mean: how many AI agents are currently making decisions, touching data, or taking actions on behalf of your organization?

If you said "zero" or "I don't know," those are the same answer.

The Team8 survey shows 71% of organizations have people building agents. Your number is probably not zero. But I'd bet real money you can't name them all, can't map their access, and don't have a kill switch.

Which means the first time you'll get full visibility into your AI agent footprint is when one of them does something you wish it hadn't.

What Actually Works (And What Doesn't)

I'm not going to tell you to ban AI agents. That ship sailed. Your team is already using them, with or without permission, because they make hard jobs easier. Telling them to stop is like telling them not to Google things—technically possible, functionally absurd.

But here's what you can do Monday morning:

Map the territory. Which agents exist? Who built them? What do they touch? This is boring, unglamorous work. It's also the only thing that matters. You can't secure what you can't see.

Scope the access. Every agent should have the minimum token privileges it needs to do its job, and not one permission more. If it's summarizing emails, it doesn't need database access. If it's drafting client communications, it doesn't need to touch the close files. Treat agent permissions like you'd treat a contractor on their first day: show them their desk, tell them where the bathroom is, and don't hand them the master key.

Build the kill switch. Before the agent goes into production, someone should be able to answer: if this goes sideways, how do we turn it off? Not "pause the task." Not "review the logs." Off. Unplugged. In the ocean.

Ask the uncomfortable question. Before your next risk committee, make sure you can answer this: Which of our agents can reach the close, the workpapers, or the client files—and who decided they could?

If you can't answer that sentence, you don't have an AI strategy. You have hope. And hope is not a control.

The Pattern We Keep Repeating

Every technology cycle, we make the same mistake. We fall in love with what the tool can do and forget to ask what it shouldn't be allowed to do.

We did it with database access in the 90s. We did it with mobile apps in the 2010s. We did it with cloud permissions in the 2020s. Now we're doing it with AI agents.

The technology changes. The mistake doesn't.

The good news? You've survived this before. Maybe not with AI agents specifically, but with some other powerful tool that your team adopted faster than your controls could keep up. You figured it out. You built the guardrails. You didn't ban the tool—you made it safe enough to use.

You just have to do it again. Faster this time.

Because the most dangerous system in your company wasn't built in San Francisco. It was built last Tuesday, by your own team, with the best of intentions and a production token.

And it's been very, very helpful.

What to do right now: Schedule 30 minutes with your security team and whoever owns your AI initiatives. Ask them to map every AI agent that has production access. Don't wait for the quarterly review. The agents won't.