AI Agents Expand Cyber Liability, Putting Corporate Safeguards in Focus

Companies deploying artificial intelligence agents face a cybersecurity challenge that extends beyond protecting their own systems. A compromised agent could become a vehicle for attacking customers, suppliers and other business partners, exposing its operator to broader legal and financial consequences.

An analysis published Monday (Oct. 5) by the International Association of Privacy Professionals (IAPP) argues that businesses need to evaluate agentic AI through both cybersecurity and liability frameworks. Regulation could play a constructive role by establishing security standards that help prevent incidents and give compliant companies grounds to defend their conduct when safeguards fail.

The analysis builds on a Forbes article by technology executive Emil Sayegh, who says companies should treat AI agents as privileged identities. An agent connected to financial software, internal databases or collaboration platforms may possess credentials and authority comparable to those of an employee with sensitive access.

That requires companies to answer five foundational questions: Which AI agents are operating, and who owns them? What systems and data can they access? Which actions require human approval? Are their activities monitored? Can their access be revoked immediately?