Agent security moves to the handoff, the identity, and the sandbox

The gap is between agents, not inside them

Traditional AI agent security tools check one agent at a time, and FalkorDB says that misses the point. In its testing, per-agent scanners missed 56% of attack paths, and every missed path crossed an agent handoff. The vulnerability lives in the transfer: one agent hands data, credentials, or a task to another, and no single-agent check sees the whole chain. m:…2888

FalkorDB's answer is to model agents, tools, and memory as a single graph and query it for paths. The company says its graph queries found all 174 tested attack paths with no false alarms, and that a max-flow calculation found the cheapest set of revocations in 20 of 20 tested scenarios. Its Reach Gateway, acting as a proxy for the Model Context Protocol, blocks calls that would complete an attack path, with cross-process exfiltration attempts blocked at a median guard time of 1.8 milliseconds. Those are vendor test results, but the design argument stands on its own: if attacks cross handoffs, the security model must too. m:…2888

Conifers, writing from five lessons running autonomous agents in enterprise security operations, makes a parallel case for isolation. The firm mandates that security operations agents run without direct internet access, in isolated cloud sandboxes rather than on analyst endpoints, and as disposable agents terminated when their task ends. Sandboxed agents do not inherit local credentials or endpoint privileges, which removes whole classes of misuse at the source. m:…7539

Identity is the missing inventory

A survey cited by Linx shows how far practice lags the risk. Seventy-seven percent of surveyed enterprises have AI agents in production, but only 20% of organizations using or exploring agents report having a complete agent inventory. Fifty-one percent of chief information security officers name compromised or hijacked agents as a top AI-related threat, which is an odd combination: the threat is ranked near the top while the inventory of what needs protecting is incomplete. m:…5830

The identity numbers explain part of the exposure. Only 34% of organizations use dedicated per-agent identities with scoped permissions. Twenty-six percent pass human credentials to agents, and 15% use shared service accounts, which means an agent's actions are hard to attribute and harder to revoke cleanly. On the other side, 55% of CISOs plan to evaluate agent identity, authorization, and access governance tools in the next 12 months, so the buying cycle is already starting. m:…5830

Conifers adds that auditing agent reasoning traces is necessary for accountability and performance improvement, and that governance controls alone cannot eliminate risks in an overly permissive execution environment. A policy that says an agent should not do something is weak protection if the environment lets it do that thing anyway. m:…7539

Personal agents enter the same frame

The newest wrinkle is personal agents. OpenAI Dots, introduced on September 29, 2026, is an always-on personal agent that works toward goals in the background using its own cloud computer and browser, and users reach it through ChatGPT, Slack, and Microsoft Teams. An agent like that touches company systems through the employee, which is why Aembit says it now secures Dots through its existing MCP Identity Gateway, without new product deployment. m:…6195

Aembit's design blends the agent, the employee, group membership, and security posture into one policy decision, filters tool discovery, and checks each tool call before it reaches the server. It issues short-lived, scoped credentials for target servers at runtime, so agents do not hold long-lived credentials, and it offers a kill switch that revokes one agent's access without locking the employee out of their accounts. All policy decisions and tool calls are logged centrally through the gateway. m:…6195

The survey context makes the urgency plain: 88% of surveyed organizations permit AI to execute some security response actions without human approval, though 71% limit that autonomy to low-risk actions. Agents already act. The question now is whether anyone can say, for each agent, who it is, what it can touch, and what it did. m:…5830