A year ago, most enterprise AI answered questions. Now it acts. AI agents read inboxes, query databases, and call APIs to finish tasks on their own. Many also hold live credentials. Some act, move data, or call systems with no human signing off. That independence is the point of an agent. It is also the problem.
An agent is not a chatbot with extra features. It can keep reaching systems after the first approval. It runs on its own schedule, it remembers, and it acts faster than any analyst can review. Give it a goal, and it will find a path to that goal, including paths you did not intend.
Security teams spent two decades building controls around human users and the apps they run. Agents fit neither. They behave like users but multiply like software. That is the ugly part: many teams cannot even count them yet, let alone say what each one can reach.
Old weaknesses, new reach
The first opening is the input the agent reads. In prompt injection, instructions hidden in an email, a web page, or a document get treated as commands, and the agent does what the attacker wrote instead of what you asked.
The tools around the agent are the next opening. An agent leans on connectors and other software to get its work done. A poisoned tool can feed it false data or quietly pull data out, and open agent protocols like the Model Context Protocol make that tool layer more useful and more exposed. It is a confused-deputy problem: the agent uses its own legitimate access to act on an instruction it should never have trusted.
Then there is access. Agents are often handed more than the task needs, so if an attacker takes over one, they reach everything the agent could. The field calls this excessive agency. Memory makes it worse: one bad instruction, planted once, can shape every decision the agent makes later.
And it can spread on its own
Agents increasingly call other agents. Trust starts to chain, so one compromised agent becomes the way into the next. The autonomous-spread risk is no longer just theory. In a University of Toronto proof-of-concept, a worm ran on a local open-weight model, no commercial AI service behind it. It reasoned its way across a deliberately vulnerable 33-host test network and replicated to 62 percent of it in seven days, no human in the loop. The hosts were soft on purpose. The autonomy was not.
Everything runs on a machine identity
Underneath all of it sits identity. Every agent, and most of the tools it uses, needs credentials to act. Service accounts, API keys, tokens, delegated sessions. Not people. Machines with access. These machine identities pile up fast, and they outlast the projects that created them.
The systems most companies use to manage access were built for employees who log in and log off, not for software that logs in constantly, calls services silently, and rarely has a clear owner. That gap is where agent risk piles up: stale tokens, broad scopes, weak rotation, and agents no one remembers creating.
What this year's winners are building
Vendors are building toward these gaps now. The 2026 Cybersecurity Stars Awards map to the basics of agent security: limit what an agent can do, track the identities it uses, watch it while it runs, find where it is exposed, and control the data it moves. The categories are new and the tools are early, so the practices matter more than any single product.
Lasso Security and Trent AI took the Agentic AI Security category, the problem of limiting what an agent can reach and do so a hijacked one can only go so far. Token Security took the identity side of that problem: the machine accounts agents use to log in, the kind of sprawl older identity tools were not built to track.
Limits mean little if no one watches the agent while it works. eSentire was recognized in security operations for systems that act on their own: let the agent run, but keep monitoring, limits, and human oversight around it. Sevii took its award for automatic defense and remediation, stepping in when an agent outruns the human review queue.
You cannot secure an agent you cannot see. Reclaim Security and Akto were recognized in Agentic Exposure Management for finding agents that are reachable, over-permissioned, or exposed through the systems around them. Reclaim's angle is remediation, not just reporting. Akto was also named Best Cybersecurity Startup.
Surf AI took its award for agentic security hygiene. Less glamorous, more necessary: keeping an agent's permissions, tools, and workflows from drifting into a mess over time.
Agents also handle sensitive data, often with little context for what should stay internal. Bonfy.AI won an AI Security Solution award for data protection built around AI systems and agents: what data moved, where it went, and whether it should have moved at all.
Twine Security points to the obvious next phase. Named one of the year's Most Innovative companies, it builds what it calls AI digital employees, agents meant to do security work themselves rather than only assist an analyst. The autonomy that makes agents a risk is becoming the defense. Which means the same limits have to follow it there.
Five things to get right
For defenders, agent security comes down to five basics:
- Inventory the agents and the identities they hold.
- Scope each agent to the least access it needs.
- Treat everything an agent reads as untrusted input.
- Watch its behavior while it runs, not only at deployment.
- Govern the data it touches.
The tools above are built for those steps. But the first one is the one most teams skip, and it decides the rest: until you can count how many active agents hold live credentials, nothing else you do is complete.
Part of The Stars Briefing, our editorial series on the trends behind the 2026 Cybersecurity Stars Awards, a program The Hacker News runs. This piece analyzes where the field is moving and uses the winners as examples. It is not a product review. The complete list of 2026 winners is live at awards.thehackernews.com/winners/2026.