Quick answer: AI agents are now treated as a new kind of insider. To deploy one safely, give it its own identity, the smallest set of permissions it needs, human approval for risky actions, a log of every tool call, and a reviewed list of the MCP servers and skills it may use. These controls are cheaper to design in from day one than to bolt on after an incident.
Why agent security is suddenly everywhere
In the second half of October 2026 the security industry moved almost in unison. Microsoft published "Agents are your newest insiders" (October 19), arguing that agents need the same insider-risk controls as employees because they can make mistakes, be manipulated or be compromised. On October 21 BeyondTrust made its AI Agent Security product generally available and SentinelOne launched Singularity Agentic Detection and Response. IBM also announced that IBM Agent Identity is generally available, treating agents as first-class identities.
The reason is adoption. G2's 2026 AI Agents Report says 66% of organizations now have agents in limited or scaled production, and that companies give back part of the gains through oversight and corrections, which G2 calls the "distrust tax". BeyondTrust's research found coding agents requesting roughly ten shell commands per prompt, and 85% of observed coding-agent users having at least one MCP server configured.
The five risks that matter for a small or mid-size business
- Too much access. An agent connected with an admin API key can do anything that key can do, including things nobody asked for.
- Prompt injection. Text inside an email, web page or document can instruct the agent to do something else, such as forwarding data.
- Unvetted tools. MCP servers and agent skills can contain code and can shape the agent's behaviour through their responses.
- No audit trail. If you cannot see which tool was called with which input, you cannot investigate a mistake.
- Intent drift. The agent completes a different task from the one it was given, and nobody notices until a customer does.
A practical checklist before an agent goes live
- Give the agent its own identity. Never reuse a staff member's login or a shared admin token. A separate service account makes it possible to revoke, rate-limit and audit the agent on its own.
- Scope permissions to the task. Read-only by default; write access only to the specific tables, folders or endpoints the workflow needs.
- Require approval for irreversible actions. Payments, refunds, deletes, outbound emails and anything customer-facing should pause for a human click.
- Keep an allow-list of tools. Review each MCP server and skill like a code dependency: who maintains it, what it can reach, and pin the version. Our MCP server guide covers how to build your own instead of trusting a stranger's.
- Treat all retrieved content as untrusted. Emails, web pages and uploaded files are data, not instructions. Keep them separate from the system prompt and never let them trigger tool calls on their own.
- Log every tool call. Store the input, output, user and timestamp so you can replay what happened.
- Add a kill switch and budgets. Cap spend, steps and run time per task, and make it possible to stop one agent without stopping the whole system.
- Test with hostile inputs. Before launch, try documents and messages that attempt to hijack the agent, and re-run those tests whenever the model or tools change.
Do you need an enterprise security platform?
The products launched this month are aimed at large organizations running many agents across endpoints and SaaS. If you run one or two agents inside your own product, most of the protection comes from how the agent is built: scoped credentials, approval steps, logging and a narrow toolset. Those are engineering decisions, not purchases. Enterprise tooling becomes worth evaluating when staff are installing their own agents and MCP servers faster than anyone can review them.
How we build agents at Localhost Labs
When we build AI agents for clients we design these controls into the architecture: per-agent credentials, human-in-the-loop steps for risky actions, full tool-call logging and evaluation tests that include injection attempts. If you want to see how this fits your use case, read our guide to AI agents for small business or our notes on RAG in production. Projects typically range from USD 3k to 15k+ depending on scope; tell us what you are building and we will give you a straight answer on what it needs.