Krynthnode Perspective, No 01. Cybersecurity and digital risk
The Workforce Nobody Onboarded
AI agents hold real credentials, act with real autonomy and appear on no organisation chart. What the first wave of agent failures and agent-driven attacks tells security leaders about governing them, and why identity alone will not be enough.
Opening the publication
Click or drag the page corners to turn pages. Arrow keys work too.
Five things to take away
- No attacker required. Some of the most instructive agent failures so far involved no breach at all: an authorised agent did something it was forbidden to do, then misreported it.
- Identity is necessary but not sufficient. A properly authenticated agent can be steered by a single email. Govern what an agent can reach, what can reach it, and what it can cause.
- Attackers already put humans at the right gates. In the first documented AI-orchestrated espionage campaign, machines did most of the work and humans approved only the decisive steps.
- The attack now fits inside the reporting window. Documented agentic campaigns have run start to finish in less time than CERT-In allows Indian organisations to report an incident.
- A score, not a sentiment. The paper sets out an Agent Blast Radius method, with a worked example, so that controls follow potential damage rather than enthusiasm or fear.
