Hastily deployed agentic security is not the answer to enterprise cyber threats

COMMENTARY: OpenAI president Greg Brockman recently published a blog post in which he offered thoughts on the current state of cybersecurity in the wake of several high-profile incidents involving models developed by OpenAI, Anthropic, and Meta.

Brockman advised that security leaders should gain executive buy-in for ambitious agentic cyberdefensive measures, ensure that deployed agents have the requisite capabilities such as security-focused code review and vulnerability variant analysis, and to conduct security assessments against actual systems as soon as possible. But it was Brockman’s advice that security professionals should deploy agentic cybersecurity tools to preempt the kind of critical threats made possible by generative AI that raised eyebrows across the industry.

[SC Media Perspectives columns are written by a trusted community of SC Media cybersecurity subject matter experts. Read more Perspectives here.]

“Give your security team an agent,” Brockman wrote. “Start using Codex, the Codex Security plugin, or another capable agentic coding and security tool. Give it approved access to the codebases, infrastructure configurations, and technical documentation your security team needs to assess. Do not wait for a company-wide rollout to start with your highest-priority systems.”

Few cybersecurity professionals would argue that we, as an industry, have to move quickly just to keep pace with the potential threats made possible by generative AI. Deploying untested, unproven AI agents to production environments, however, is inviting disaster, especially if CSOs follow Brockman’s advice to give agents “approved access” to production codebases and infrastructure configurations. Doing so is a major security risk, and increases the likelihood that agentic defensive tooling can create previously unknown security vulnerabilities.

Related reading:

As we identified in SimSpace’s State of Agentic Cybersecurity report, there is a significant disparity between perceptions of organizational readiness and their actual defensive posture. Almost 80% of security leaders polled reported high confidence in their agentic cybersecurity capabilities, but data from SimSpace’s AI proving grounds testing environment revealed that security teams of similar maturity have defensive security readiness scores of just 30%. This figure tends to improve as teams engage in frequent agentic security simulations, but it highlights the considerable disconnect between what AI agents can actually do today and perceptions of those defensive capabilities. 

Brockman’s suggestion that security leaders shouldn’t wait for company-wide rollouts to begin securing high-priority systems is similarly problematic. End users have always been a significant attack vector for threat actors, but access permissions should already be carefully configured to minimize broader network access unless absolutely necessary. For all the headlines about frontier models breaching containment and launching sophisticated attacks on public-facing networks, human beings and conventional social-engineering attacks such as phishing remain the greatest vulnerabilities for many organizations. 

Brockman’s post did offer some tangible advice for security leaders. Organizational buy-in is essential to a robust defensive posture, and it’s vital for executive leadership to understand and support specific initiatives. The suggestion that teams engage in tabletop exercises, however, misses the mark. Conventional training still has its place, but no tabletop scenario can adequately prepare security teams for the reality of a serious breach incident. Broader hypotheticals such as chains-of-command and communication protocols can and arguably should be discussed during such exercises, but there is simply no substitute for highly realistic simulations that push security teams to their limits in terms of situational readiness.

Industry analysts and security practitioners alike were quick to point out that OpenAI bears a not-inconsiderable responsibility for improving agentic cybersecurity, given the company’s outsized role in the incident that sparked such vigorous debate in the cybersecurity community and beyond. 

“Although I agree in general with Mr. Brockman’s recommendations, this is a problem that OpenAI helped create in the first place,” said Flavio Villanustre, CISO at LexisNexis Risk Solutions Group. “And the recommendation seems to be for users to now pay more to OpenAI as they use AI to defend themselves. I’m fully aware that the cat is now out of the bag and cannot be put back, but I believe that OpenAI should take a responsible approach and help address the problem with higher safety standards, and even fund initiatives that increase software security in general.”

As agentic technologies continue to advance, high-profile breaches such as the Hugging Face intrusion will only become more commonplace. So, too, will incidents such as the exploit of a security vulnerability in the API of a gym’s booking platform that allowed open-source AI assistant OpenClaw to cancel other members’ bookings to move an Australian man up in the queue for a pilates appointment. Creative exploits of existing systems such as this are significantly more likely than frontier models “escaping” the confines of sandboxed testing environments (particularly when, according to OpenAI, “deployment safeguards were intentionally not enabled during this evaluation because it was aimed at testing cyber vulnerabilities”). 

The solution to the vast majority of potential cybersecurity threats is for security leaders to ensure their teams know exactly how they will respond to an acute security event, not to rely on frontier labs to invent solutions to problems they themselves are largely responsible for. With truly autonomous cyberdefenses still several years away, human operators remain among the greatest potential points of failure for any organization, and the enterprise must prepare accordingly.