| TL;DR: AI agents are gaining access to company data, tools, and business systems faster than many enterprises can govern them. Permissions approved separately can combine into far greater authority, while hidden instructions and untracked actions create risks traditional security tools may not catch. NeuralTrust is addressing this gap by monitoring agent behavior throughout a task. Its launch highlights a wider race to control what agents can access and execute, and who is responsible when something goes wrong. |
Taking over an Instagram account this spring did not require a stolen password or phishing link. It required asking.
Attackers used Meta’s AI-assisted recovery tool to request a password reset using an email address they controlled. The system sent the link without verifying that the address belonged to the account. The flaw went undetected for nearly seven weeks. Meta later told regulators that 20,225 accounts had been taken.
The tool did not go rogue. It had enough authority to turn a stranger’s request into a real action. And that is the security problem now following AI agents into businesses. Unlike chatbots that return answers, agents can use tools and act inside other systems.
NeuralTrust, an AI security company in Barcelona, has launched runtime security that monitors those actions. It is entering a market where identity providers, cloud platforms, and security vendors are racing to control agent activity. The question is who gets there first. Whoever wins could shape how much authority companies give AI.
Agents Can Do More than Their Permissions Suggest
The early worry about AI security was prompts: could someone talk a chatbot into ignoring its instructions? That risk has not gone away.
However, an agent raises a second question: What happens after the model answers? What does it do with it?
Usually something. It queries a database, or approves a request, or writes to a system that other people rely on. Each of those abilities gets signed off separately, by someone looking at one box on one form. That gets harder to reason about when AI agents accumulate permissions without a clear owner.
Rodrigo Fernández, chief marketing officer at NeuralTrust, told SaaSTake:
Conventional software does not work this way. A developer fixes the route in advance, and the program follows it. An agent is handed a goal and a set of tools, then works out part of the route as it goes. That difference is the point.
Researchers mapped the Instagram incident to excessive agency, a label for automated systems given more reach than the job needs.
The Next Instruction May Not Come from the User
Instagram’s tool failed to confirm one thing: that the email requesting a reset was the email on the account. Meta found that code and removed it. However, the harder problem is that an agent reads instructions from the material it encounters while doing its work.
In a tool poisoning attack, the instructions sit inside a tool’s description. Nobody sees that text, but the model reads it when deciding which tool to use. For instance, an agent checking a support ticket could encounter a hidden instruction telling it to retrieve customer information and send it somewhere else.
The same trick works through issue tracker comments and search results that a connected system pulls in during ordinary work. The difference from a conventional vulnerability is simple: the attacker never touches the agent. They leave something where the agent will go looking, and wait. That is enough.
The Model Context Protocol raises the stakes by giving AI applications a standard way to connect with more tools and data. Its own documentation compares it to a USB-C port. In other words, every connection built that way is another place an instruction can be left. Those connections also create more API activity that security teams have to interpret. Salt Security is approaching that problem at the API layer, where an agent can use valid access and still take actions that fall outside its intended task.
AI Agents are Multiplying Faster than Security Can Follow
The problem is growing while companies are still deciding who owns agent governance.
A survey of 750 senior technology leaders in the US and UK found the number of agents running inside companies doubling in four months, while security coverage barely moved. That visibility gap is already creating a new security category. Obsidian found that AI agents can inherit broad SaaS access and move data across connected applications, often with less oversight than human users.
Gartner expects some of that growth to unwind, predicting that 40% of enterprises will demote or discontinue autonomous agents by 2027. Its explanation is that companies keep confusing two different questions. How independently an agent can act is not the same as how far it should be allowed to reach.
Regulation sets a second deadline. Fernández said public sector buyers feel less day-to-day attack pressure than banks do, but face firmer dates, with the EU AI Act and NIS2 asking for evidence of how agents actually behave.
All of that assumes a company knows what it is governing. Many do not. And that leaves a basic problem: An agent nobody has inventoried is an agent nobody is watching.
NeuralTrust is Watching the Action, Not Just the Instruction
NeuralTrust’s answer is to stop reading the instructions and start watching the work.
Its system sits between agents and the models, tools, and data they use, inspecting activity throughout a session.
Two things matter here.
It reads what a tool sends back before the agent acts on it. That is where planted instructions can surface. It also follows tool selection across a whole session instead of judging one request at a time.
The second check looks for patterns rather than individual moments. That is where the category still has something to prove. Catching a single bad call is familiar work. Catching a run of permitted calls that add up to something else is not, and that is true of every vendor here.
The problem looks different from one customer to the next. Fernández described a banking group spanning 40 countries. Its problem was not a rogue agent but keeping customer data inside the country that governs it. He said a European carrier routed “31 million requests” through NeuralTrust over six months. It classified and blocked 1.2% of customer-facing traffic as malicious. The firewall guarding the airline’s website, he said, saw none of it.
The Race to Control Agent Activity Has Begun
NeuralTrust is not alone.
Money moved into this category fast this year. NeuralTrust raised a $20 million seed in June, billed as the largest cybersecurity seed financing by an EU company. Straiker closed a $64 million Series A the same month, and HiddenLayer announced a $100 million Series B on September 2.
Identity vendors are arriving from another direction. Microsoft’s Entra Agent ID gives agents identities of their own, and Okta is extending its platform to govern how agents reach business applications.
None of this is really a contest over who spots prompt injection most accurately. It is a contest over which layer gets to sit in the middle. Cloud providers already run the infrastructure agents live on, and identity vendors already own the question of who may do what. That control layer is becoming more important as agentic AI platforms give agents more connectors, tools, and authority to act across enterprise systems.
Fernández stated:
Nobody holds that middle position. Not yet. It goes to whoever enterprises actually route their agents through.
A Gateway Can Only Control the Activity It Can See
Every gateway rests on one assumption. Agent activity has to pass through a point where policy can apply.
That works for agents a company builds or buys on purpose. It works less well for the rest. Agents inside third-party software show only what the vendor chooses to show, and employees pick up tools without telling IT.
Inspection costs something too. Checking every request adds delay, and the system still has to separate genuinely dangerous behavior from behavior that is merely unfamiliar. Block too little and the exposure stays. Block too much, and you lose the speed that justified the agent.
Accountability May Matter More than Perfect Predictability
Agents are unlikely to become completely predictable. Their usefulness comes from choosing how to do the work rather than following a fixed script, and that is the same property that makes them hard to secure.
So the goal shifts from perfect control to accountability. A business needs to know which agent acted and whose authority it borrowed. It needs to know whether anything stopped it before the action landed.
NeuralTrust’s gateway provides the mechanism, but the evidence it produces may matter more. A bank or government buyer needs an audit trail it can take into a room with an examiner.
The Instagram takeovers were remarkably simple. The automated system held significant authority, and one failed check was enough for that authority to be abused.
The companies that win this category will not be the ones promising agents never behave unexpectedly. They will be the ones that can tell you what happened while there is still time to do something about it.
