Researcher and member of the Academic Committee at TalTech’s IT College
An AI agent can be a company’s most diligent employee. The trouble starts when it is given more permissions than judgement.
We are used to thinking of cybersecurity in terms of human error: someone clicks the wrong link, shares a password or leaves a digital door open. But an AI agent is a digital extension of a person, so the same mistake can be made by a system authorised to read emails, open documents, run queries, write code and sometimes even make financial decisions.
That is the appeal of AI agents: unlike an ordinary generative chatbot, an agent does more than answer questions — it acts on the user’s behalf. In cybersecurity terms, however, this makes it a digital employee that can be difficult for a company to control, with access to real tools and data.
The use of AI agents must therefore be carefully considered before they are admitted into a working environment, and employees must be made aware of the potential dangers. An agent may not assess whether its actions are legal or beneficial to the company. AI has been given a task, and responsibility for its execution rests with the person who assigned it.
Criminals can exploit AI agents
When we give an AI agent access to our email, attackers gain an opportunity to send messages containing instructions for the agent. The aim is to persuade it to do something it is technically authorised to do, but which harms the company’s interests and which a human employee might not respond to.
A person may recognise spam and ignore it, for example, while an agent may follow an instruction hidden in the message, enabling an attacker to obtain every address in the contact list or make the agent forward copies of all emails to an address specified by the attacker.
AI agents risk being given more permissions, capabilities or autonomy than they actually need to perform their tasks.
A 2026 analysis of AI agent security by the US National Institute of Standards and Technology (NIST) reached a similar conclusion: existing cybersecurity principles need to be adapted for AI agents. An agent must have a clearly identifiable identity, defined permissions and traceable actions.
In Estonia, discussions about AI use tend to focus on what AI can do and how to make even greater use of it. One suggestion, for example, is to let AI agents make automatic transfers of up to €100, with people handing over some of their decision-making authority to AI.
A cybersecurity specialist asks a different question: what should AI be allowed to do when it misunderstands something?
These are two entirely different questions. The same cybersecurity principle applies to people and AI agents: grant only the minimum access necessary.
For example:
- An agent that prepares an invoice does not necessarily need permission to approve the payment.
- An agent that reads emails does not need permission to reply to every customer.
- An agent that analyses documents does not need to see the entire file server.
AI agents risk being given more permissions, capabilities or autonomy than they actually need to perform their tasks.
An AI agent can be a diligent assistant, but excessive permissions can also make it a serious security risk if a criminal manages to influence its actions. Photo: Philip Oroni / Unsplash
The logic of data theft is changing
Companies may not yet be ready for the changing logic of data theft. Previously, attackers looked for a database or a person who would click the wrong link. Now they may look for an AI agent with database access instead.
An agent with excessive permissions can also cause other problems, such as disrupting systems or causing loss of access. Ransomware, denial-of-service attacks and fraud have not disappeared.
Companies should therefore treat an AI agent as a very fast, very eager, but surprisingly impressionable digital employee.
An agent must have its own identity, limited permissions, an activity log and a comprehensive list of actions it may not take without human approval.
Human approval is particularly important when money, data deletion, access rights, contracts or the transmission of sensitive information outside the organisation is involved.
For companies, a completely obedient AI agent following the wrong person’s instructions is far more dangerous than AI taking someone’s job or deciding to conquer the world.
One of the biggest challenges in improving corporate cybersecurity in 2026 and 2027 will be establishing on whose behalf AI acts within a company, what it can access and who notices when an agent becomes a little too helpful.
Companies must also consider what to do when an employee says: “The robot did it, not me!”
How can we oversee AI’s actions while keeping responsibility in human hands?
For companies, a completely obedient AI agent following the wrong person’s instructions is far more dangerous than AI taking someone’s job or deciding to conquer the world.
This opinion piece is based on the Delfi Forte article “TalTech researchers warn: a company’s most diligent employee could become a cybersecurity risk”.
