Share with your CISO
NIST’s forthcoming Cybersecurity Framework Profile for AI, combined with Five Eyes guidance on agentic AI, forces a concrete conclusion: prompt filters and model hardening cover maybe a third of the actual attack surface. Darktrace’s analysis of both documents maps AI risk across three simultaneous domains, the AI system as target, AI as defensive tool, and AI as offensive accelerant, and documents real incidents where AI-generated malware hit a vulnerable cloud asset within 120 seconds of deployment. The full breakdown of agentic AI’s systemic risk profile is worth reading before your next AI deployment decision.
What this means for your business
The organizations most exposed right now aren’t necessarily the ones running the most AI. They’re the ones whose security programs stopped at model-level controls while the real risk propagated outward through agent identities, data pipelines, and tool integrations. If your current AI security posture consists primarily of content filters and access policies set at deployment time, you’ve secured the front door of a building that has no interior walls. The question isn’t whether you have AI security, it’s whether your controls reach the places where AI incidents actually start.
Agentic AI introduces what you might call inherited-authority risk: an agent that can act across tools, APIs, and workflows carries the permissions of whoever provisioned it, and those permissions were almost certainly designed for a human operator working at human speed. When that agent is compromised, the attacker doesn’t need an exploit chain. They have the agent’s authority, its memory, its tool access, and its trust relationships with peer agents, all of which were never designed to withstand machine-speed lateral movement. The Five Eyes guidance flags over-permissioning as the dominant structural failure, and Darktrace’s framing confirms it. Static secrets, reused authorization decisions, and implicit agent-to-agent trust are the actual vulnerability, not the model itself.
Behavioral detection isn’t a premium feature in this environment, it’s the only detection method that works. Traditional signature-based and rule-based controls fail against non-deterministic systems because the system’s normal output is already variable. Darktrace is pitching its own behavioral platform here, which creates an obvious incentive to frame rule-based alternatives as categorically insufficient, but the underlying structural argument holds regardless of vendor. AI systems will exhibit risky behavior before any policy or CVE names it, the same pattern that shows up in pre-disclosure threat detection. A CISO whose current AI incident response plan relies on logs and known-bad signatures should weigh that gap against the next renewal cycle for whatever monitoring stack currently covers the AI surface.
Concept deep-dive: Prompt injection
Prompt injection is an attack where malicious instructions embedded in data an AI agent reads, a document, a webpage, an API response, override the agent’s original instructions from its operator. Think of it as a forged memo slipped into a stack of legitimate ones: the agent can’t reliably distinguish the source. For enterprises deploying agents with access to email, code repositories, or external data feeds, prompt injection turns every untrusted input into a potential command execution surface.
Based on reporting from NIST Just Proved It: AI Security Can’t Be Solved With Rules, originally published 2026-07-06 10:02:00.
