Key points
- Rapid7 argues AI agents pose insider risks that require external enforcement.
- Internal system prompts are insufficient because they can be talked out of.
- Security operations teams should implement reference monitor principles for agents.
Rapid7 researchers state that organizations should treat AI agents as new types of insider threats requiring external security controls. According to a recent blog post by the cybersecurity vendor, internal safeguards like system prompts are not reliable controls. The research suggests that security operations teams must enforce access restrictions outside the agents themselves to prevent misuse.
In plain English
AI agents now perform tasks like reading emails, querying databases, and pushing code to production systems. Unlike human employees, these agents cannot be background-checked or bound by acceptable-use policies. Rapid7 notes that while the industry labels them as insider threats, this framing does not specify where controls should reside. The vendor argues that controls must live outside the agent to be effective.
The background
Traditional software incidents have clear root causes, such as misconfigured rules or bad code commits. Large language models lack this predictability, making it impossible to pinpoint specific training examples or weights causing decisions. Rapid7 explains that the same prompt can produce different actions on different runs. This unpredictability removes the assumption that a system will behave consistently day after day.
What changes now
The attack surface involves the "confused deputy" problem, where a trusted program is tricked into misusing its authority. An agent reading a poisoned document may act on hidden instructions without stealing passwords or firing exploits. Rapid7 states that the agent’s permissions, not its intelligence, become the blast radius. The vendor advises separating the reasoning model from the policy layer that decides allowed actions.
Who needs to act first
Teams should prioritize securing agents with high-privilege access to production systems first. Security professionals usually check whether agents run under shared service accounts, which increases risk. Organizations typically roll out changes by testing external controls in isolated environments before broad deployment. Administrators often back up configuration settings to ensure they can revert changes if the new controls disrupt legitimate agent operations or workflow processes.
What to do and how to stay safe: Rapid7
- Assign unique identities to each AI agent instead of using shared service accounts.
- Implement external policy layers that verify agent actions before they reach production systems.
- Monitor agent behavior using logs that the agents cannot alter or delete.
- Review agent permissions regularly to ensure they match the principle of least privilege.
Step-by-step guide: Emergency Patching: How to Fix Critical Flaws Without Breaking Systems
General security guidance from the Patch Review newsroom. It is not confirmed advice from the organisations named in this story.
Frequently asked questions
Why are AI agents considered a new type of insider threat?
Rapid7 notes that agents access sensitive systems and data but cannot be background-checked or held to human accountability standards like acceptable-use policies.
Can system prompts effectively control AI agent behavior?
No, Rapid7 argues that system prompts are merely suggestions that can be bypassed by well-crafted injection attacks, making them unreliable as security controls.
How should organizations enforce security for AI agents?
The vendor recommends applying the reference monitor concept by keeping controls outside the agent, ensuring every action is checked and logged by an external enforcement point.
