Somewhere in your business right now there might be an AI agent doing real work. Reading email. Pulling files. Categorising transactions. Maybe drafting replies to clients. It was set up to save someone a few hours a week, and it does. Nobody's watching it at 2am, because that's the point. You're not supposed to have to.
Here's the part that keeps me up. To do that job, someone gave it access. And in almost every case I've looked at, they gave it far more access than the job actually needed.
That's not a hypothetical. Among firms running AI agents, 88% reported at least one security incident tied to those agents in the past year, and when researchers traced the failures back, the same root cause kept coming up: agents granted more permission than they required. Not exotic zero-days. Just an agent that could touch things it never should have been able to touch.
The coverage problem
If you go looking for advice on this, you'll find plenty. It's just not written for you.
Almost all of it is aimed at enterprise security teams: CISOs, SOC analysts, people with a budget line for "non-human identity management." A Dark Reading poll this year found 48% of cybersecurity professionals now rank agentic AI as the single biggest attack vector for 2026, ahead of deepfakes and everything else. That consensus is real, and it's driving a lot of enterprise spending.
But the firms adopting agents fastest aren't the ones with a security team. They're small. Roughly 73% of accounting and CPA firms have now put some form of AI automation into their workflow, a jump most people haven't clocked yet. A ten-person practice can wire an agent into its inbox and its file store in an afternoon. There's no security review, because there's no security person. The enterprise advice assumes guardrails that a small firm simply doesn't have.
So the risk isn't smaller for small firms. In a lot of ways it's worse, because the speed of adoption has outrun the oversight, and nobody's writing the version of this article that assumes you're the whole IT department.
What actually goes wrong
Let me be concrete, because "AI security" gets waved around as a vibe and it's more specific than that.
Between December 2025 and February 2026, a single attacker used off-the-shelf AI coding agents to breach nine Mexican government agencies, including the federal tax authority. The haul was 195 million taxpayer records. One person, using tools anyone can sign up for, moving faster than any human team could respond. If you handle other people's financial data for a living, that example should land differently than a generic breach headline. The same dynamic showed up in the JADEPUFFER AI ransomware analysis earlier this month, where AI agents exploited over-permissioned infrastructure through credentials sitting in plain sight.
Most incidents are duller than that, and that's the point. They come down to two boring things: an agent with too much access, and an agent that can be talked into misusing it.
The second one deserves a plain explanation, because it's the part people underestimate. An AI agent reads instructions and data through the same channel. It can't reliably tell the difference between "your boss is telling you to do this" and "a sentence buried in a document you're processing is telling you to do this." That's called prompt injection, and there's no clean fix for it, because the problem is baked into how these models take input. A malicious instruction hidden in an invoice, an email, or a webpage the agent reads can become a command the agent follows. If that agent has the standing ability to move money, delete records, or email clients, you've handed a stranger a remote control.
In my own work (bug bounty hunting, poking at LLM-driven systems), over-permissioning is the single most common thing I find. It's not clever. It's that setting up narrow, scoped access is tedious, and giving the agent broad access "just to get it working" is easy. The easy path is the vulnerability.
Four controls that actually help
You don't need an enterprise security programme. You need four habits. OWASP published its first framework built specifically for agentic applications this year, and if you strip out the jargon, the recurring theme is one idea: least privilege. Give the agent the minimum it needs, and put a human in front of anything that can't be undone.
Scope the access down. An agent that categorises transactions does not need the ability to send payments or delete files. Give it read access where read is enough. This is unglamorous and it's the control that prevents the most damage.
Put a human in the loop for anything irreversible. Money moving, data being deleted, a message going to a client: these get a human approval step, every time. It slows the agent down by seconds and it's the circuit breaker that stops a hijacked agent from doing real harm before anyone notices.
Don't give the agent standing credentials. If it holds a permanent key to your systems, that key is a target, and a compromised agent session is a compromised login. Short-lived, task-scoped access beats a permanent all-access pass.
Keep a kill switch you can actually reach. Know how to shut the agent off and revoke its access without calling a vendor. If you can't answer "how do I stop this right now," that's the first thing to fix.
None of this makes agents less useful. It makes them safe enough to leave running. The firms that get burned aren't the ones being cautious. They're the ones who set an agent loose with broad access and assumed "AI" meant "handled."
Where this leaves you
Agentic AI is worth adopting. I'm not writing this to scare anyone off it. The productivity is real, and the firms using it well are pulling ahead. But the gap between how fast small firms are deploying agents and how little thought goes into what those agents can reach is a genuine problem, and right now most of you are on the wrong side of it.
If you're running an agent in your practice and you're not sure what it can actually access, that's worth an afternoon of someone's time to map out. At OrionX we do this kind of review for small businesses: scoping what an agent can touch, adding the approval steps that matter, and making sure a hijacked agent can't take the rest of the business with it. If that's a question you've been putting off, get in touch. It's a good one to stop putting off.
Sources
- Agentic AI security: incident rates and root causes, Shattered.io
- Dark Reading poll, agentic AI as top 2026 attack vector, via Kiteworks
- Mexican government agency breach via AI coding agents, Beam AI
- AI adoption across accounting and CPA firms, AI Business OS
- OWASP Top 10 for Agentic Applications 2026 and least-privilege framing, DeepInspect
