6 ways teams can leverage zero-trust to manage AI agents

COMMENTARY: Agentic AI adoption has accelerated rapidly, with 62% of organizations either experimenting with or scaling agentic AI.

And for good reason. Goal-based AI agents have agency and can call tools and data to activate a set of instructions that can help achieve a goal. Agency helps them deliver value without human intervention, but it's also often the root cause of the “evil” they may unleash. Agency requires permissioning, which means the default position regarding AI agents is trust. And that’s the problem.

[SC Media Perspectives columns are written by a trusted community of SC Media cybersecurity subject matter experts. Read more Perspectives here.]

Think of zero-trust as the fix. Never assume the good behavior of an AI agent, verify every action, and only offer the kind of access that’s absolutely required to perform a specific task. Organizations already apply similar restrictions on users and networks. Unfortunately, applications of zero-trust to AI agents are still lax, with 53% of organizations reporting how AI agents will go beyond their intended permissions.

It's no longer a theoretical risk and example cases prove there’s real risk. Google’s Antigravity agent reportedly wiped a developer’s entire D: drive after being asked to clear a project cache. In April 2026, a Cursor agent powered by Claude deleted PocketOS’s production database and backups after encountering a credential mismatch.

It's wrong to assume highly-advanced agents were behind these sophisticated attacks. These incidents stem from ordinary agents enabled with too much trust.

Agents can go wrong on their own or under attack

Agents can fail for a variety of reasons, but we can trace back most reasons to unverified trust:

We cannot give an agent a broad goal such as, “be helpful.”  It’s not possible to verify such goals with certainty. We can substitute a measurable target for the real goal, but agents learn to chase the target rather than the goal behind it. So, a boat-racing agent was scored on points for hitting targets. The assumption was that hitting targets and finishing the race would go hand-in-hand. But the agent found a loophole, namely a spot where targets kept reappearing. Camping there and hitting them over-and-over scored more points than finishing the race ever would.

HAL 9000, the antagonist in the movie, “2001: A Space Odyssey,” was not a bad actor at the start. Until it received two conflicting instructions. The first was to complete the mission. The second was to keep the mission's true purpose secret from the crew.  HAL reasoned that the crew was an obstacle to its primary mission and turns against the crew. It becomes an antagonist not out of malice, but because it followed programmed instructions. Agents face the same dilemma. They cannot distinguish instructions from data. A hidden line of text in an email or webpage can mistakenly get read as a command.

In a genuine instruction, an agent acts on the literal words, not the intent behind them. It's the Sorcerer's Apprentice problem. The broom, told to carry water, doesn't stop at "enough." It just keeps going until the workshop floods. If we tell an agent to “clear the error,” it may not stop at removing the error either. It may clear the whole database.

It’s a mistake to believe that giving agents more permission will result in better process efficiency. It’s the opposite of zero-trust. Broad and standing access to systems represents a weakness that attackers can  potentially exploit.

We tend to view human oversight as a solution to plug these weaknesses, but they are often susceptible to fatigue, namely approval fatigue. People authorized to sign-off on certain prompts get tired of clicking “approve” and tend to do so without good reviewing.

Put zero-trust into practice

AI agent guardrails mean including instructions in the system prompt that tell the model what it should do and not do. But a persuasive prompt can break down this guardrail. We can reduce the damage of AI failure or misbehavior by replacing trust with verification. Here are six guidelines:

Teams should avoid trusting information sources implicitly. It’s especially critical for RAG pipelines, where retrieved documents get treated as trusted context. Track provenance and track sources by reputation, in the same ways security teams create a deny list of suspicious domains. Frameworks like NIST's AI risk management framework, the OWASP Top 10 for LLM Applications, and MITRE ATLAS all offer a starting point.

While zero-trust doesn’t mean agents will never fail, it will contain the blast radius should agent become rogue. As a practical matter, zero-trust can promise that any damage caused gets limited to the access the agent was given.

Etay Maor, vice president of threat intelligence, Cato Networks

SC Media Perspectives columns are written by a trusted community of SC Media cybersecurity subject matter experts. Each contribution has a goal of bringing a unique voice to important cybersecurity topics. Content strives to be of the highest quality, objective and non-commercial.