A practitioner’s guide to securing what AI has become. The chatbot now has memory, it has tools, and in many organizations it has admin access. The question is whether anyone has been assigned the job of governing it.

By Sampa David Sampa

Intro

Back in 2023, I wrote a piece for ISACA asking a fairly straightforward question: are AI chatbots a weak security link? The answer was a cautious yes. They leaked data when prompted cleverly, hallucinated sensitive information, and opened new social engineering channels. Serious, but manageable. You could sandbox the chatbot, restrict what it knew, and move on.

Today’s AI systems are agentic. They have memory, they plan, they use tools, and most importantly, they act. They open pull requests, query live databases, trigger automated workflows, and collaborate with other AI agents in ways no human ever reviews in real time. Gartner predicts that by the end of 2026, 40% of enterprise applications will be integrated with task-specific AI agents, up from less than 5% just a year ago.

OWASP’s 2025 Top 10 for LLM Applications ranks prompt injection as the #1 critical risk in LLM applications. Cisco’s State of AI Security 2026 report found prompt injection weaknesses in 73% of audited production AI deployments.

In August 2025, Brave researchers disclosed indirect prompt injection vulnerabilities in Perplexity’s Comet AI browser. Hidden instructions on a webpage (a Reddit comment, an image, an email visible in another tab) could be executed by the browser’s AI agent as if they were the user’s own commands. The agent operated with the user’s full authenticated privileges across every open tab, including banking, email, and corporate dashboards. Multiple subsequent vulnerabilities have been disclosed by other researchers since, demonstrating that this is a category of risk in agentic browsers, not a single bug to patch.

The Access Problem Is No Longer Theoretical

According to Acuvity’s State of AI Security, 70% of organizations currently lack optimized AI governance. CIOs hold AI security decision authority in 29% of organizations. CISOs, who traditionally own security, rank fourth at just 14.5%. Security says it is an IT problem. IT says it is a business problem. Nobody has written a policy for the agent that the operations team quietly connected to Slack last quarter.

A Microsoft-commissioned survey found that 29% of employees are already using unsanctioned AI agents for work tasks, creating shadow AI with elevated privileges that traditional security tools simply cannot detect.

The consequences are starting to show. In June 2025, researchers at Aim Labs disclosed EchoLeak (CVE-2025-32711), described as the first known zero-click attack against an AI agent. A single crafted email could cause Microsoft 365 Copilot to silently exfiltrate sensitive data from the user’s mailbox, OneDrive, SharePoint, and Teams context, with no user interaction required. Microsoft patched it server-side, but the underlying class of attack, what researchers called LLM Scope Violation, remains structural to RAG-based AI agents rather than something patched out of existence.

The Attack Your Cybersecurity Solutions Were Not Built To Catch

Your SIEM and other analytical security tools were designed to detect anomalies in human behavior. An AI agent executing thousands of perfectly formatted API calls looks completely normal until you realize it was executing an attacker’s instructions through indirect prompt injection.

Pull Quote: An AI agent executing thousands of perfectly formatted API calls looks completely normal until you realize it was executing an attacker’s instructions.

What Sound Defense Actually Looks Like

Honest inventory. You cannot govern what you cannot see, and shadow AI is your highest immediate risk. Discovery starts with network traffic review, SaaS access logs, and asking department heads what AI tools their teams are actually using. The answers are usually surprising.

Least privilege for agents. Apply the same rigor you apply to human contractors. An agent that schedules meetings has no business touching your financial system. Scope permissions to the task, not the tool, and recertify those permissions on a quarterly cycle. IBM’s 2025 Cost of a Data Breach Report found that 97% of organizations that experienced an AI-related breach lacked proper AI access controls.

Treat external data as untrusted. Validate and sanitize all external content before it enters your agent’s context window, and require human confirmation for any irreversible action. The agent can propose. A human should still approve.

Full agent tracing. Record what AI agents do in meaningful terms, not just technical logs. Knowing why an API call was made, what decision chain produced it, what data it accessed, what it returned, is what enables incident response and audit.

The Governance Gap Is The Real Vulnerability

McKinsey’s State of AI survey found only 28% of organizations have CEO-level AI governance oversight, 17% board-level, and just 25% have fully implemented AI governance programs.

That is the attack surface. Not the model. Not the API. The gap between who deployed the agent and who is accountable for what it does.

Most AI breaches are not happening because organizations chose the wrong AI platform. They happen because nobody decided who was responsible for the AI agent that showed up in production without a security review.

Pull Quote: They happen because nobody decided who was responsible for the AI agent that showed up in production without a security review.

The chatbot grew up. It has memory, it has tools, and in many organizations it has admin access. Governing it requires clear ownership, scoped permissions, behavioral monitoring, and someone whose job it is to answer for what it does.

That job exists now. The question is whether your organization has assigned it to anyone.

About The Author

Sampa David Sampa (CISA, IGP) is a senior IT audit and governance professional with over 15 years of experience spanning Big 4 firms, international NGOs, and government institutions. He is an IT assurance specialist and member of the ISACA Emerging Trends Working Group.