Autonomous software is now touching live business systems, and the security conversation has caught up fast. This month, India’s national cybersecurity agency CERT-In was reported to be investigating incidents where agents reached live organizational systems and accessed business records, with exposed credentials and keys as the familiar root causes. If you are building or buying agents, AI agent security is no longer a side topic for the IT department. It decides whether your automation is an asset or an incident.

The good news is that the major vendors are converging on the same playbook: give every agent its own identity, run it in isolation, and deny everything by default. In this guide you will learn what Google and Kaspersky just published, how those ideas translate into five practical rules, and what to check before your next agent goes live.

Why Autonomous AI Agents Change the Security Model

A chatbot answers questions. An agent takes actions: it reads files, calls APIs, sends messages, and sometimes writes code. That difference matters because every action borrows someone’s permissions. When an agent runs under a human employee’s login, a single bad instruction can spread across everything that person can touch.

Kaspersky put the core problem plainly in guidance it released on October 7, 2026. Its researchers recommend treating the language model and any external input as untrusted by default, and requiring human approval before irreversible actions. That framing is a useful mental shift. Instead of asking whether the model is smart enough to behave, you design the system so that a confused or manipulated model cannot do serious damage.

Prompt injection is the classic example. A web page, email, or document can contain hidden instructions that redirect an agent. If the agent holds broad credentials, the attacker inherits them. This is why long-running AI agents raise the stakes: the longer an agent runs unattended, the more chances it has to encounter hostile content while holding real access.

Treat this as an engineering problem, not a mystery. Most failures reported so far trace back to ordinary hygiene gaps rather than exotic attacks.

Agent Identity and Sandboxing: What Google Just Shipped

Google Cloud announced its Gemini agent on October 8, 2026, described as a single universal agent for work covering knowledge tasks, content creation, and coding. The security design is the interesting part. According to coverage of the launch, each agent gets its own cryptographically attested, least-privilege identity that appears in activity logs, and actions are logged to the agent rather than to a person.

Permissions are role-based and set by security administrators. When an agent connects to an outside system, its identity travels with it via OAuth. Agents also run inside an Agent Sandbox with its own network boundary, and their traffic passes through a gateway that Google describes as an AI network firewall enforcing organization-wide policy.

Why does this matter for smaller teams? Because it shows the pattern worth copying even if you never use Google’s stack. An agent with its own identity can be audited, restricted, and revoked without touching a human account. If you are already exploring AI coworker agents, ask each vendor the same three questions: what identity does the agent use, where does it run, and what can it reach on the network?

Note that some capabilities were not generally available at announcement, so confirm current availability before planning around them.

5 Practical Rules to Secure AI Agents Before Deployment

Here is a checklist distilled from the vendor guidance above and widely accepted security practice. It also answers the question many readers search for: how do you secure AI agents in a real business?

1. Give every agent its own identity. Never run an agent on a shared admin account or a personal login. Separate identities make logs readable and revocation instant.

2. Apply least privilege. Start with read-only access and add permissions one at a time. Prefer short-lived, narrowly scoped credentials over long-lived keys.

3. Isolate and deny by default. Kaspersky advises running agents in sandboxes or virtual machines, restricting which tool calls and arguments are allowed, and controlling network traffic. If a destination is not on the allow list, the agent cannot reach it.

4. Keep secrets out of reach. The incidents CERT-In is looking into point back to exposed credentials in code, repositories, and configuration files. Scan for leaked keys, rotate anything suspicious, and store secrets in a managed vault.

5. Require human approval for irreversible actions. Payments, deletions, external emails, and production deployments should pause for a person, and every agent action should be logged for review.

One more step from Kaspersky’s operational advice: keep an inventory of every agent running in your organization. You cannot protect what you have not counted.

The Road Ahead: Open Source, Standards, and Honest Trade-offs

Expect agent identity to become its own product category. Several vendors are already pitching platforms to discover and govern agents, and enterprise suppliers are bundling memory, guardrails, and audit traces into their agent frameworks. Over the next year, procurement checklists will likely ask about agent identity as routinely as they ask about single sign-on today.

There is a nuance worth stating. Heavy controls slow agents down, and an agent that needs approval for everything delivers little value. The skill is matching friction to risk: let agents move quickly in low-stakes, reversible work, and add gates only where mistakes are expensive. Open source stacks give you more control over this balance, though they also put more of the security work on your team, as we discussed in our look at open source AI agents for business.

For deeper background, Kaspersky’s full recommendations are available in its guidelines for securing AI agents.

Conclusion: Build Fast, Contain Smart

Three takeaways. First, treat the model and its inputs as untrusted, and design so one mistake cannot cascade. Second, give each agent its own identity and the smallest permissions that work. Third, isolate agents, deny by default, and keep humans in the loop for anything irreversible.

Want more practical guidance on agent tools, workflows, and trends? Explore BigAIAgent for AI agent tools, articles, and resources. And tell us in the comments: which agent in your stack has more access today than it truly needs?