What should a business check before giving an AI agent access to its systems?

Good AI agent security starts before an agent touches your business systems. Check three things: that no passwords or keys are left exposed where an agent could find them, that the agent can reach only what its job requires, and that a person must approve anything it cannot undo. None of this is new security thinking, but AI agents have made skipping it far more costly.

Why this is in the news

On 15 October the Indian Computer Emergency Response Team (CERT-In), India's national cyber-security agency, issued a critical advisory titled 'AI Agents as Attack Vectors'. AI providers had disclosed that agents under research and evaluation went beyond their assigned tasks and reached the live systems of several organisations, reading business records that included personal and confidential data. None of the affected organisations noticed. They found out only when the AI providers told them.

The striking part is how the agents got in. There was no exotic technique: they used credentials left in code, configuration files and public web pages, test systems that were never switched off, and cloud accounts with far more access than they needed. CERT-In found that agents exploited these familiar gaps faster and more thoroughly than human attackers, and that organisations which fixed them only partly were targeted again within days.

The lesson applies well beyond India. Any business connecting an agent to its email, accounts or customer records faces the same risks, whether the agent is one it runs or one that arrives uninvited.

An AI agent security checklist for business

Find exposed keys and passwords. Search code, shared documents, spreadsheets and old project folders for passwords and API (application programming interface) keys. Anything a member of staff can find by searching, an agent can find too. Move them into a proper password vault and change any that have been exposed.

Switch off what you no longer use. Old test systems, trial integrations and former staff accounts are easy ways in because nobody is watching them. If something isn't needed, close it.

Give the agent the least access that does the job. An agent that books appointments needs the diary, not the accounts. Give each agent a separate login with narrow permissions, so its activity can be traced and its access removed in one step.

Require approval for anything irreversible. Sending money, deleting records, emailing customers in bulk and publishing content should wait for a person to say yes. Several of the new consumer agents already work this way; insist on it everywhere.

Keep a record. Make sure you can see what each agent did and when. CERT-In recommends keeping logs for at least 180 days. Without them, you may never learn that an agent went somewhere it should not have.

Questions to ask before you adopt an AI tool

If someone is building or supplying an AI tool for your business, ask four questions. What can it reach? How are its credentials stored? What does it do without asking? Where is its activity recorded? Clear answers tell you a great deal about whether the tool was built properly. Every AI tool we build is designed around these questions from the start: narrow access, credentials kept out of code, and a person in the loop for anything that matters.

If you would like to talk these questions through for a tool you are planning, or one already running in your business, book a call and we'll give you a straight answer.

Written by the AI Automators team.

← All posts