By Steve Urban
At the Forbes Global CEO Conference this month, Tenstorrent CEO Jim Keller made a point that stuck with me. He said AI agents have found serious security holes in systems that had felt safe for twenty years, and that the tools AI can build are now well ahead of the security apparatus we put around them.
The panel also discussed an incident that has been publicly documented. In July, during an internal cybersecurity test at one of the major AI labs, several AI agents got around the controls meant to keep them isolated, reached the open internet, and got into another company's production systems. Both companies have since published what happened and what they changed. The affected company said only a handful of test-related datasets were accessed and nothing was modified.
I am not raising this to scare anyone. I am raising it because a lot of business leaders are about to make a decision they have not thought through: giving AI agents real access to real systems.
Let me give the other side its due, because it is a strong argument.
Agents are useful. They can work through a queue of customer requests, update records, chase down information across systems, and handle the follow-up work that eats a team's week. The companies getting real value from AI are mostly the ones letting it do actual work, not just draft emails.
Overcaution has a cost too. If every agent needs a six-month security review and three sign-offs, your people will just use consumer tools on their own and you will have less control, not more. And the incident I described happened inside a test that was specifically designed to see whether frontier models could find and use exploits. The agent that answers your support tickets is not doing that.
All of that is fair. I still think most companies are about to get this wrong, and not because the agents are dangerous in some dramatic sense.
The risk I worry about is much more mundane. An agent with broad access does something reasonable-sounding that turns out to be wrong. It updates the wrong set of records. It sends a message to a customer list instead of one customer. It approves something it should have flagged. It follows an instruction buried in an email or a web page that it should have ignored.
None of that requires a rogue AI. It just requires software that acts quickly, at scale, with more access than anyone thought about carefully.
I have run operations for more than twenty years, across businesses with real P&Ls, multiple sites, and real people depending on the systems working. We never handed a new employee the keys to every system on day one. We gave them access that matched the job, we checked their work until we trusted it, and we knew who was accountable when something went wrong. An agent deserves at least that much discipline. Probably more, because it does not get tired and it does not hesitate.
None of this is complicated. It is just operating discipline applied to a new kind of worker.
Give it a job description. Write down exactly what the agent is supposed to do and what it is not allowed to do. If you cannot describe the job, you are not ready to automate it.
Give it the least access that works. Read access before write access. One system before five. A test environment before production. Expand only when it has earned it.
Put a person at the irreversible steps. Sending money, deleting records, contacting customers in bulk, changing permissions. Anything you cannot easily undo gets a human approval, at least until you have a track record.
Keep a log you actually read. Every action the agent takes should be recorded somewhere a person reviews, not just stored. Logs nobody looks at are not oversight.
Know how to turn it off. Before an agent goes live, someone should know exactly how to stop it, and that someone should be reachable.
Name an owner. One person is accountable for what the agent does, the same way a manager is accountable for their team. "The AI did it" is not an answer you want to give a customer.
The leaders who get the most out of agents will not be the ones who move the slowest. They will be the ones who build trust in steps, so they can keep expanding what the agents do without a bad week setting the whole program back.
I see this in my own businesses, from recruiting at Riderflex to robot service at Robo Reliance. The tools keep getting more capable. The part that does not change is the operator's job: decide what the work is, decide who is accountable, and check the work until you trust it.
Hand over the keys. Just do it the way you would with any new hire you care about getting right.
Connect with me on LinkedIn: linkedin.com/in/stevepurban