AI agents are fast becoming the latest tech obsession, with companies racing to tap their potential for automation and growth, but as the hype reaches fever pitch, IT experts are urging caution, with many seeing them as a bigger threat than traditional machine identities.

New research from identity security provider SailPoint has found that although 98% of organisations plan to expand their adoption of AI agents, 96% of tech professionals view AI agents as a growing security risk, with less than half (44%) having policies in place to secure them. 

SailPoint’s report, AI Agents: The New Attack Surface, shows these agents are raising more red flags than standard digital identities, with 72% of the more than 350 IT pros polled viewing them as more dangerous than existing machine identities. 

A major factor contributing to their worries is that AI agents often need several different machine identities to access diverse data, applications and services, introducing complexities into security landscapes, like self-modification and the potential to generate sub-agents. 

IT experts are worried about AI agents’ ability to access privileged data (60%), their potential to perform unintended actions (58%), and their potential for sharing privileged data (57%). 

Also keeping them up at night is the chance that autonomous AI agents might make decisions based on bad data (55%), and the possibility that they might access and share inappropriate information (54%)

SailPoint found that, despite these risks, 82% of organisations are now using AI agents, which have access to customer information, financial data, intellectual property, legal documents, supply chain transactions, and other highly sensitive data.

Without proper guardrails in place, the widespread rollout of AI agents is leading to tangible harm in some cases, as well as several close calls.

The vast majority (80%) of companies say their AI agents have taken unintended actions, including accessing unauthorised systems or resources (39%), sharing sensitive or inappropriate data (33%), and downloading sensitive content (32%).

Perhaps most alarmingly, a near quarter of firms (23%) reported their AI agents have even been tricked into revealing credentials.

With that in mind, it’s little wonder that businesses have deep concerns over their ability to control the data AI agents can access and share, with an overwhelming 92% stating that governing AI agents is critical to enterprise security.

Recommended reading

• PwC Interview | How Agentic AI is Reshaping Business
• Report: Enterprise AI Agent Adoption Set to Soar in 2025
• UK Orgs Have High Hopes for Agentic AI ROI

“Agentic AI is both a powerful force for innovation and a potential risk,” said Chandra Gnanasambandam, CTO at SailPoint.

“These autonomous agents are transforming how work gets done, but they also introduce a new attack surface. They often operate with broad access to sensitive systems and data, yet have limited oversight.

“As organisations expand their use of AI agents, they must take an identity-first approach to ensure these agents are governed as strictly as human users, with real-time permissions, least privilege and full visibility into their actions.”

SailPoint’s study adds to what is a growing body of research highlighting the dangers of introducing AI agents too quickly.

Last week, a survey from Salesforce found that UK cyber teams are not ready for AI agents, with more than half not yet confident they have the right guardrails in place to deploy the technology safely, while in March, a Gartner study predicted that AI agents will reduce the time it takes to exploit account exposures by 50% within the next two years.

Don’t Miss Scotland’s Biggest Tech Event!

Join us at DIGIT Expo West on 5th June at the SEC Glasgow. Get leading industry insights across AI, Cyber Security, and Data, and grow your network at Scotland’s largest gathering of tech leaders – with 1500+ attendees, 50+ speakers, and 50+ exhibitors.

Register your FREE place now at www.digitexpowest.com