FirstCover

The cyber story changed in May

In May 2026, Google said it had disrupted a criminal operation that used artificial intelligence to help discover a previously unknown vulnerability in a widely used system-administration tool. The flaw could have allowed attackers to bypass two-factor authentication. Google alerted the affected company and law enforcement before the operation caused known damage. The importance of the episode was not that an AI system had become a movie-style supervillain. It was that a capability long discussed in theory—using a model to shorten the path from finding a weakness to exploiting it—had appeared in a real investigation.[1]

A month later, Anthropic published a review of 832 accounts banned for malicious cyber activity between March 2025 and March 2026. Most of the observed use was still familiar: 560 accounts used AI in connection with malware development. But the direction of travel was more consequential. Attackers were applying AI deeper inside compromised networks, including account discovery, lateral movement and privilege escalation. In one state-sponsored espionage campaign disclosed earlier, an AI agent executed commands, exploited vulnerabilities, stole credentials and made tactical decisions with limited human intervention.[2]

These cases matter because they dissolve a comforting distinction. Until recently, companies could imagine AI as a tool that produced text while cybersecurity systems protected the machines that performed real work. That boundary is disappearing. Models are increasingly surrounded by tools, connected to corporate applications and allowed to take actions. The question is no longer only what an AI can say. It is what the system around it permits the AI to do.

THE CENTRAL SHIFT Cyber risk is moving from bad content to authorized action. The danger grows when an AI can combine reasoning, access and execution.

AI is a force multiplier, not a magic weapon

The most useful way to understand the current moment is to resist both complacency and hype. AI has not made passwords, phishing, unpatched software or ransomware obsolete. It has made many of those old methods cheaper, faster and easier to scale. Unit 42, drawing on hundreds of incident-response engagements, reported in July that the underlying attack patterns remained largely familiar. The change was operational efficiency: activities that once took days could be compressed into hours.[3]

This distinction is crucial for business leaders. If AI had created an entirely alien form of cyberattack, companies might reasonably wait for a new generation of specialist defenses. But if it is accelerating weaknesses they already understand, delay is harder to justify. Poor credential management, excessive permissions, slow patching, incomplete asset inventories and weak vendor oversight become more dangerous when attackers can search and act at machine speed.

The Five Eyes cybersecurity agencies made this point unusually bluntly in a joint statement on June 22: the relevant timeline is measured in months, not years. Their recommendations were strikingly non-exotic—understand risk and accountability, prioritize foundational controls, empower cybersecurity leaders and integrate resilience into business strategy.[4] The message was not that every organization needs a science-fiction defense system. It was that yesterday's acceptable delay may become tomorrow's material exposure.

The overlooked risk is already inside the company

External attackers are only half the story. The same qualities that make AI useful to an intruder—speed, persistence and the ability to connect multiple steps—also make an authorized enterprise agent difficult to govern. A chatbot that summarizes a document has limited power. An agent that can open email, retrieve customer records, edit code, schedule payments or operate a cloud console has something closer to a job description. It also has keys.

A Cloud Security Alliance survey published in April illustrates the visibility gap. Among 418 IT and security professionals, 82% said their organizations had discovered previously unknown AI agents in their environments during the prior year, and 65% reported at least one agent-related incident. Only 21% had a formal process for decommissioning agents. The survey was commissioned by an AI-security vendor, so its figures should be read as an industry signal rather than a universal prevalence estimate. Even with that caveat, the pattern is recognizable: adoption is distributed, inventories are incomplete and digital workers can retain access after their original purpose has disappeared.[5]

This is the AI version of shadow IT, but with a larger potential blast radius. A forgotten software subscription may waste money or expose data. A forgotten agent may continue to hold credentials, trigger workflows and communicate with other systems. Because its activity can resemble legitimate automation, the organization may struggle to distinguish a compromised agent, a badly instructed agent and a properly functioning agent producing an unacceptable outcome.

Why the keys matter more than the model

Public debate often focuses on which frontier model is most capable or dangerous. Capability matters, especially when models become better at coding and vulnerability discovery. But enterprise risk is produced by the full system: the model, its instructions, the tools it can call, the data it can retrieve, the credentials it can use and the degree of human review around consequential actions. A highly capable model with narrow, temporary access may create less practical risk than a weaker model connected carelessly to production systems.

NIST's May analysis of public responses on AI-agent security reached a similar conclusion. Respondents widely agreed that basic cybersecurity principles still apply, but they need to be adapted for agents.[6] The adaptation is not merely technical. Traditional access control assumes that a human identity or a conventional software service has a relatively stable purpose. An AI agent may interpret an open-ended objective, select among tools and adjust its plan as new information arrives. The company therefore has to govern not only who the agent is, but also the intent, context and consequences of each action.

This leads to a simple but demanding principle: an agent should never receive more authority than the organization can observe, explain and revoke. Permanent credentials are especially risky. So are shared accounts, broad access to data stores and workflows in which one agent can approve the action of another without an independent control. The goal is not to eliminate autonomy. It is to make autonomy bounded, legible and reversible.

AI risk is now an operating-model problem

A study highlighted by MIT Sloan this month asked 272 international experts to judge 24 AI risks through 2030. The five with the highest expected severity included dangerous capabilities, competitive dynamics, weapons and cyberattacks, concentrated power, and false or misleading information. Information, national security and finance were identified as particularly exposed.[7]

The most revealing category may be competitive dynamics. It is not a single harmful application. It is the pressure that encourages companies and governments to deploy faster, accept uncertainty and underinvest in safeguards. In cybersecurity terms, the threat is not only that attackers are moving quickly. It is that defenders are simultaneously connecting more agents to more systems because no business wants to appear late to the AI transition.

That creates an ownership problem. Cybersecurity teams may manage identity and incident response. Technology teams may select models. Business units define the process being automated. Legal and procurement teams negotiate vendor obligations. Risk committees approve policy. Yet no single function may own the end-to-end question: what authority has been delegated to this agent, and who is accountable if it uses that authority badly?

The regulatory direction reflects this shift. Ropes & Gray notes that U.S. financial regulators are increasingly treating AI-related cybersecurity controls as an examination and governance issue. Its practical recommendations focus on decision rights, enterprise-wide inventories, third-party contracts and incident plans built for exploitation timelines measured in hours rather than weeks.[8] This is cybersecurity moving out of the server room and into corporate governance.

Five questions every leadership team should be able to answer

1. Which AI systems can act?

Separate tools that only generate information from agents that can change records, send messages, execute code, approve transactions or control infrastructure. Maintain a living inventory that includes owner, purpose, connected systems and expiration date.

2. What is the smallest key each agent needs?

Use narrowly scoped, short-lived permissions. High-impact actions should require independent approval. Access should be tied to a specific purpose rather than inherited from the employee who configured the agent.

3. Can the company reconstruct what happened?

Logs should capture the agent's identity, instructions, tool calls, data accessed, decisions and outcomes. If an incident cannot be explained after the fact, the autonomy granted was greater than the organization's control.

4. Who can stop the system?

Define an accountable owner and a rapid suspension path before deployment. Crisis governance should identify who can revoke credentials, isolate connected systems, notify customers and override ordinary change procedures.

5. How quickly can the business recover?

Prevention will not be perfect. Test scenarios in which an agent is compromised, a vendor connection fails or an AI-assisted attacker moves faster than the normal patch cycle. Resilience—not the promise of zero incidents—is the more credible objective.

The same technology can strengthen the defense

The outlook is not one-sided. AI can help defenders find vulnerabilities, triage alerts, prioritize fixes and respond at a speed closer to that of automated attackers. A July CSIS report argues that organizations relying entirely on human-speed workflows risk losing the race between discovery and remediation; it calls for persistent monitoring and faster repair supported by AI.[9]

But defensive AI does not remove the governance problem. It reproduces it in a more urgent setting. A defensive agent may need privileged access to scan systems, isolate devices or deploy patches. Those powers are valuable precisely because they are consequential. The winning model is therefore neither full manual control nor unbounded automation. It is supervised autonomy: machines handle volume and speed, while people establish boundaries, approve exceptional actions and remain accountable for outcomes.

The real race is institutional

The popular image of AI cyber risk is a brilliant model breaking through a digital wall. The more realistic picture is less dramatic and more important: thousands of ordinary weaknesses being discovered faster, familiar attacks being assembled with less expertise, and legitimate agents accumulating permissions across the enterprise. The technology accelerates both sides, but it does not accelerate every institution equally.

Companies that treat AI risk as a product feature will focus on model accuracy and safety filters. Companies that treat it only as compliance will wait for a checklist. Companies that understand the deeper shift will redesign authority itself: which machines may act, under whose mandate, within what limits and with what route back to human control.

That is what it means for AI to get the keys. The danger is not that software suddenly develops malicious intent. It is that organizations delegate real authority before they build the visibility, decision rights and recovery mechanisms needed to govern it. In the next phase of AI adoption, competitive advantage will not belong simply to the company that deploys the most agents. It will belong to the company that can move quickly without losing track of who—or what—is acting in its name.