When I began working on autonomous cyber agents in 2020, the timeline for real-world deployment was still measured in decades. At the time, these systems were seen as long-range bets \u2014 interesting but still mostly niche improvements for any near-term application.<\/p>\n\n\n\n
Then, something changed. <\/p>\n\n\n\n
While generative AI (GenAI) wasn\u2019t one, singular event, it unleashed an ongoing cascade of advances that are, to this day, causing development timelines to collapse at a continuously accelerating rate. This isn\u2019t just a case of moving the goal; the GenAI-driven wave is relentlessly bulldozing old benchmarks and redefining the frontier of what\u2019s possible, faster than we\u2019ve ever experienced before. Capabilities once reserved for long-term research are now being integrated into live environments with astonishing speed. <\/p>\n\n\n\n
Startlingly, but not surprisingly, agentic systems are being embedded in countless locations \u2014 company workflows, decision-making pipelines and even critical infrastructure \u2014 often before we\u2019ve established how to govern or secure them. The year 2020 seems a lifetime ago considering we\u2019re no longer preparing for the arrival of agentic AI but responding to its continued and rapid evolution.<\/p>\n\n\n\n
The workshop report I\u2019ve co-authored, Achieving a Secure AI Agent Ecosystem<\/a><\/em>, is the product of a cross-institutional effort to make sense of this acceleration. Developed in partnership with RAND<\/a>, Schmidt Sciences<\/a>, and leading minds in agentic AI from across industry, academia, and government, the paper doesn\u2019t offer silver bullets but rather a different way to think about and approach agentic AI.\u00a0<\/p>\n\n\n\n The crux of the paper outlines three foundational security pillars for AI agents and suggests where our current assumptions \u2014 and infrastructure \u2014 might falter as these systems evolve. Beyond simply acknowledging current realities, this argues for a profound mindset shift: We must recognize that the age of agentic systems is already upon us. Consequently, securing these systems is not a problem for tomorrow. It\u2019s an urgent challenge today that\u2019s intensified by the relentless pace of innovation, expanding scale, uneven risks for early adopters and the stark asymmetry between attack capabilities and defense goals.<\/p>\n\n\n\n One of the challenges in securing AI agents is that these systems don\u2019t look or behave like traditional software. They are dynamic, evolving and increasingly capable of executing decisions with minimal oversight. Some are purpose-built to automate tasks like scheduling or sorting email; others are inching toward fully autonomous action in high-stakes environments. In either case, the frameworks we use to secure traditional applications aren\u2019t enough. We are encountering problems that aren\u2019t merely variations on known vulnerabilities but are fundamentally new. The attack surface has shifted.<\/p>\n\n\n\n This mindset shift is why the security landscape has been organized around three core concerns:<\/p>\n\n\n\n These categories are not static \u2014 they are points along a spectrum of capability and threat maturity. Today, most organizations that deploy agents are dealing with the first two concerns. But the third \u2014 malicious, autonomous adversaries \u2014 looms large. Nation-states were among the first to invest in autonomous cyber agents.1<\/sup> They may not be alone for long. <\/p>\n\n\n\n Navigating this new era of potent, widespread autonomous threats, therefore, demands far more than incremental refinements to existing defenses. It requires a foundational shift in how our expert communities must collaborate and innovate on security.<\/p>\n\n\n\n Historically, AI researchers and cybersecurity professionals often operated on parallel tracks, holding different assumptions about risk and architecture. Yet, the complex frontier of agentic AI security demands their unified effort, as neither community can tackle these immense challenges in isolation \u2014 making deep, sustained collaboration paramount. And while universal protocols and comprehensive best practices for this entire field are still maturing, the notion that effective turnkey products for securing agents are scarce is, frankly, becoming outdated. Sophisticated, deployable solutions<\/a> are now offering vital, specialized protection for critical agentic systems, signaling tangible progress. This further underscores the urgent need for adaptive, multilayered security strategies \u2014 spanning model provenance, robust containment and resilient human-in-the-loop controls \u2014 all evolving as rapidly as the agents themselves.<\/p>\n\n\n\n While robust and evolving product solutions are increasingly crucial in mitigating the immediate operational risks posed by agentic AI, achieving comprehensive, long-term security also necessitates dedicated industry-wide investment in foundational capabilities and shared understanding. Several such key directions, complementing product innovation, are well within our collective reach and warrant-focused effort. <\/p>\n\n\n\n For instance, a kind of \u201cagent bill of materials,\u201d modeled after the \u201csoftware bill of materials,\u201d is envisioned to provide visibility into an agent\u2019s components like its model, training data, tools and memory. However, its functional viability currently faces hurdles, such as the lack of a common system for model identifiers, which is crucial for such transparency. <\/p>\n\n\n\n Additionally, standardized, predeployment test beds could allow for scalable, scenario-based evaluations before agents are released into production environments. And communication protocols like MCP (Model Context Protocol) and A2A (Agent-to-Agent) are emerging, but few have security baked in from the start<\/a>. However, even when security measures are integrated from the outset, the prevalence of \u201cunknown unknowns\u201d in these novel agentic systems means these protocols will require rigorous and continuous assessment to maintain their integrity and safety. <\/p>\n\n\n\n One approach our paper attempts to navigate is the critical challenge that an agent\u2019s memory, while essential for it to learn, improve, and crucially avoid repeating past mistakes, is also a significant vulnerability that can be targeted for malicious tampering. The strategy involves using \u201cclone-on-launch\u201d or task-specific agent instances. In this model, agents designed for particular operational duties or limited-duration interactions treat their active working memory<\/em> as ephemeral. Once their specific task or session is complete, these instances can be retired, with new operations handled by fresh instances that are initialized from a secure, trusted baseline. <\/p>\n\n\n\n This practice aims to significantly reduce the risk of persistent<\/em> memory corruption or the lingering effects of tampering that might occur within a single session. It is paramount, however, that such a system is meticulously architected to ensure an agent\u2019s core foundational knowledge and long-term learned lessons are securely maintained, protected against tampering, and effectively and safely accessible to inform these more transient operational instances. While managing operational states in this manner is not a comprehensive solution to all memory-related threats, it represents the kind of creative, systems-level thinking required for advancing agent security and robust containment.<\/p>\n\n\n\n Ultimately, securing agentic AI will not come from any single breakthrough but from a sustained, multistakeholder effort. These include researchers, policymakers, practitioners and industry leaders working together across disciplines. The threats are both technological and foundational. We are trying to secure systems that we do not yet fully understand. But if there\u2019s one thing the last few years have made clear, it\u2019s this: Waiting to act until the picture is complete means acting too late.<\/p>\n\n\n\n The evolution of agentic AI means our industry is developing critical safeguards concurrently with its widespread adoption. This simultaneous development isn\u2019t inherently a crisis, but a clear call for collective responsibility. Our success in this endeavor hinges on a shared industry commitment to building these foundational elements with transparency, rigorous standards and a unified vision for a trustworthy AI ecosystem.<\/p>\n\n\n\n Read the full paper: Achieving a Secure AI Agent Ecosystem<\/a><\/em>.<\/p>\n\n\n\nThree Pillars for AI Agent Security<\/h2>\n\n\n\n
\n
Interventions Within Reach<\/h2>\n\n\n\n
A Call for Shared Commitment<\/h2>\n\n\n\n
\n\n\n\n