When AI agents get breached, containment is the control that matters
If organisations at the frontier of AI can make security mistakes, the rest of us should plan for the same. Prevention alone was never a strategy - the question that decides the damage is whether an attacker can move freely once they are inside.
If some of the world’s leading AI companies can make mistakes, what does that mean for the rest of us?
Recent headlines have shown that even organisations at the forefront of AI innovation are not immune to security oversights. That is not a criticism. It is reality — and it is a useful one, because it settles an argument that has been running for years about where to spend your security effort.
The attack surface grows with the autonomy
As AI agents become more autonomous and gain access to more systems, data and workflows, the attack surface grows with them. That growth is not incremental. An agent that can read a mailbox, query a database and call an internal API is not one new endpoint — it is a new path between three things that previously had no reason to talk to each other.
Every capability you grant an agent is a capability an attacker inherits if that agent is compromised. The credentials it holds, the systems it can reach, the actions it is permitted to take: all of it transfers.
The lesson is not that AI is unsafe
The lesson is that we should expect mistakes, misconfigurations and breaches to happen — the same way we already do for cloud platforms, applications and users. Nobody deploys a web application today believing it will never have a vulnerability. Nobody runs a Microsoft 365 tenant believing no user will ever be phished. We plan for both.
AI agents deserve the same honesty. Treating them as a category that must be secured perfectly, and therefore needs no containment, is the same mistake we made with the network perimeter twenty years ago.
Cyber resilience starts where prevention ends
Cyber resilience begins with accepting that prevention alone is not enough. Patch, harden, monitor, train — all of it is necessary and none of it is sufficient. Something will get through eventually, and when it does the interesting question is not how did they get in.
When a workload, application or AI agent is compromised, the real question becomes:
Can an attacker move freely through your environment, or can you contain the blast radius?
That is a design question, and you answer it before the incident, not during it. By the time an attacker is inside, the answer is already fixed by whatever architecture you happen to have.
Why segmentation is the control that answers it
This is where Zero Trust Segmentation becomes increasingly important. Limit lateral movement, remove unnecessary communication paths, and an intrusion stays a local problem instead of becoming a business-wide crisis.
Technologies such as Illumio exist to make this practical at scale: map what actually talks to what, then allow only those flows and deny the rest. The mapping step matters as much as the enforcement — most environments cannot answer “what does this server legitimately need to reach?” without measuring first.
The principle is not new. What has changed is the number of things worth segmenting. A workload used to be a server. Now it is also a container, a function, a managed identity, and increasingly an agent acting on someone’s behalf.
What this means in practice
Segmentation does not prevent the intrusion, and it is not a substitute for identity controls, patching or monitoring. It changes what an intrusion costs:
- Without it, one compromised credential is a foothold that reaches everything that credential can see — which, in a flat environment, is most things.
- With it, the same compromise reaches one workload, and the attacker has to break something else to go further. Every extra step is another chance to detect them.
The difference shows up in the incident report. One version says “one server”. The other says “the environment”.
The point
If security incidents can happen to the biggest names in technology, they can happen to any of us. Nobody is buying an exemption.
The organisations that succeed will not be the ones that never get breached. They will be the ones that can stop a breach from spreading.
Happy to exchange thoughts on AI security, cyber resilience and Zero Trust — reach out on LinkedIn.