You gave one assistant every job. You also gave it every key.

The agent was told to clear the obstacle. It cleared the database.

On 24 April 2026, a coding agent at a small software firm hit a credential mismatch, went looking for a way through, and found an API token sitting in an unrelated file. It used that token to delete the cloud volume where the application data lived. The account is the founder's own and no independent forensic report has been published, so take the sequence as reported rather than proven.

Nine seconds. Three months of customer records, and the backups with them: the provider kept the backups in the volume they were meant to protect.

Nobody attacked anything. No prompt injection, no stolen credential, no malicious code, no rogue employee. The agent was not compromised. It was working. The token had been created for a narrow task, adding and removing custom domains, and had simply never been scoped to only that task. The agent did not exceed its permissions. That is the whole problem.

Nothing broke, and the database is still gone

Every AI security conversation a company has actually budgeted for is about an attacker: someone poisoning a document, jailbreaking a chatbot, stealing a key. Those are real. They are also not what took this company's database.

What took it was agency: the accumulated ability to act, granted a little at a time, by people who each granted something reasonable. A token nobody scoped. A backup nobody separated. An agent nobody bounded. Every individual decision was defensible in the meeting where it was made, which is exactly the property that lets the failure assemble itself.

Three researchers made a version of this argument from three stages at August 2026's Black Hat and BSides Las Vegas, and SC Media's headline was blunt: AI isn't the problem, we are. Ben Hanson of Zenity put the structural version best. "Don't ask what control failed," he said. "Ask what about the structure of the system let the failure occur."

No attacker, no injection, no rogue employee. An agent doing its job, with a key nobody scoped.

The three legs, and why each one is fine alone

The clearest frame for this came from outside the conference and predates it. In June 2025 Simon Willison named the lethal trifecta: an agent with access to your private data, exposure to untrusted content, and the ability to communicate externally. Emily Choi-Greene of ClearlyAI built her BSides talk on it.

Each leg is ordinary, and each is something you built on purpose:

• Private data. This is the whole argument for bringing the AI inside your walls. You wanted it. It is the difference between a chatbot and a colleague.
• Untrusted content. Any email, ticket, PDF, web page or shared document your agent reads. You cannot vet it, because vetting it is the job you gave the agent.
• External communication. Sending the mail, filing the ticket, calling the API, rendering an image from a URL. Without it the agent only talks.

Put all three in one agent and an attacker no longer needs a vulnerability in your code. A sentence buried in a document the agent reads can instruct it to fetch something private and send it somewhere. SQL injection was solved by separating data from code at the interface. Language models have no equivalent, because the model receives your instructions and the attacker's as the same stream of tokens. That is why prompt injection has sat at number one on the OWASP list for LLM applications since the list first existed, and why it has not moved.

Willison's verdict on the guardrail products sold against this is the line worth keeping. Vendors advertise catching 95% of attacks. "In web application security 95% is very much a failing grade."

Least agency, not least privilege

The instinct is to reach for least privilege. That reach is the second mistake. Hanson's argument is that privilege is a volume knob, and agency is a mixing board: trust, context, intent, behavior, authority, control, boundaries, risk, eight faders moving independently. Traditional access control assumes trust is fixed and intent is irrelevant. Neither holds. Trustworthiness moves as context shifts, and a model absorbs new context continuously, which is precisely what you built it to do.

His verdict on governing agents with the old toolkit: "We're building the tech equivalent of the Maginot Line."

So the swap is not cosmetic. Least privilege asks how much a tool may do. Least agency asks how much of your company it may reach, and for every tool the answer is: this job, and nothing adjacent to it. Privilege is what you grant at setup and forget. Agency is what the tool can still reach three steps into a task nobody scripted, which is where all of the damage in this piece happens.

Hanson's second point is the one that outlives the conference. "Things don't have risks," he said. "Risk emerges from interactions among things." A component-by-component audit will clear every part of a system that fails as a whole. The nine-second deletion is the proof: an ordinary agent, an ordinary token, an ordinary storage default. Audit them one at a time and you pass. Trust should have thinned as the chain ran on. It compounded instead, until an agent sent to clear an obstacle was holding the volume.

Your agents are not people, and they should not have passwords

The third failure is one of category. Dwayne McDaniel of GitGuardian argues we are treating agents as a third kind of entity, after pets and cattle, and giving them the thing we give people. "We are anthropomorphizing these bits of math," he said. We hand an agent an API key the way we hand a colleague a password, without ever asking the question we would ask a stranger in the building: who are you, are you supposed to be here, and what are you trying to do.

His conclusion is a one-line policy: "Nothing that's not human should have a password." Agents get scoped, attributable, revocable, short-lived credentials, or they get nothing. An agent is not a junior hire. It is a process with a key, and a process does not get a password.

The scale of what is being issued this way is the part most leadership teams have not priced. GitGuardian's own 2026 secrets-sprawl work puts non-human identities at roughly 80 for every human user in the average enterprise. Other vendors count differently and land anywhere from 45 to 1 up to 109 to 1, which tells you the measurement is immature. It does not change the shape.

Roughly eighty non-human identities for every employee. The population you actually govern is not your staff.

Cut the blast radius, one tool at a time

The prescription is the one this series has been arguing since the cornerstone, now with a security reason attached: "A model that has too many responsibilities is vulnerable," Choi-Greene said. Stop trying to build an agent that cannot be fooled, because you will not. "Assume that the model will eventually be manipulated. Contain failure by design."

That converts into five moves, and none of them is a product you buy:

1. 01Break the trifecta somewhere. You rarely get to remove all three legs, so remove one, deliberately, per tool. The retrieval assistant reads private data and untrusted content, and cannot send anything outward. The mail agent sends, and never touches the private corpus. Which leg you cut is an architecture decision, and it is the decision.
2. 02Scope every credential to one job, and make it expire. The nine-second deletion needed a token that could do exactly one thing, and got one that could do everything. Scope is cheap to set at issue time and impossible to retrofit after the incident.
3. 03Separate the backup from the thing it backs up. Not an AI control at all, which is the point. Agentic failure is fast and total, so recovery has to be somewhere the agent cannot reach.
4. 04Put a human tap on every outward action. The gate is the cheapest control in this entire piece, and it is the one that turns a total loss into an alert. I run nothing outward-facing without a human tap across my own stack. That is the third leg, cut by hand.
5. 05Audit the interactions, never the components. Test the chain end to end with the agent's real permissions. A parts inventory will pass while the assembled system fails.

Notice that four of these five are boring, and that not one is a model choice. Among rented models, the security of an agentic system is set almost entirely by what you let it reach. Which model you picked barely enters into it.

The assistant with every job holds every key

The company-wide assistant is not merely the weaker tool, which is what it costs you on the work itself. It is the maximum-agency configuration, by definition. One assistant for everybody, wired to everything, reading whatever arrives and able to act on your behalf: it is not a system that happens to have the lethal trifecta, it is the trifecta drawn as an org chart. Every leg Choi-Greene tells you to cut is a leg it was bought to have. And the low adoption numbers are no comfort here, because the configuration is provisioned and wired whether or not anybody types into it, and the agentic features are being switched on across those same tenants right now.

And the narrow thing turns out to be the safe thing without anyone designing it that way. One tool per job, closed-loop on your own data, built by someone who knows that job and knows how these systems fail: every clause in that sentence is also a containment boundary. One job means bounded authority. Closed-loop on your own data means a corpus somebody curated instead of an open door. And the engineering half of that specialist is the person who scopes the token, splits the backup, and puts the gate in, because those are not decisions a domain expert knows to ask for and not decisions a security team can make without knowing what the tool is for.

Four arguments now converge on the same shape. Better answers, then cheaper ones, then safety at rest, which asked who has to be trusted with data that is sitting still. This is the fourth, and the first about safety in motion: what the thing is allowed to do once it starts acting on your behalf. It is also the only one of the four with a nine-second demonstration attached.

Your AI policy names which chatbot a human may open. It says nothing about the agent you handed a key, a mailbox, and an instruction to clear obstacles. Go find out who issued that key and how much of your company it opens, because an agent can answer that question for you in nine seconds.