Issue 012 organizations name it1 qualifies it2026 evidence
The agent is only as safe as the tools it may call, and those were not reviewed
Attention goes to the model and its prompts. The attack surface is largely the tools it can invoke, which were built as internal services and never assessed as something an autonomous caller would reach.
A misconfigured or vulnerable tool widens both what an attacker can reach and what the consequence is, because the agent will call it faster and more often than a person would. The controls are ordinary application security - sanitise inputs, enforce access control at the tool rather than in the prompt, and test the tools the way any other exposed service is tested - but they are rarely applied here, because the tool predates the agent and was reviewed under the assumption that a human was on the other end of it.
How to fix it — 1 approach, 3 steps
Security-review every tool an agent may call
Treat the tool list as the attack surface. Each tool gets the review an externally exposed service would get, with access control enforced at the tool rather than in the prompt.
Done when A tool register lists every tool each live agent may call with its owner and the date of its last security review, and a call carrying an agent credential that should not have it is refused by the tool itself.
- List every tool each live agent may call, and who owns it.
- Enforce authorisation at each tool, not in the agent instructions.
- Put the tools into the same security testing cycle as exposed services.
The evidence — 7 documents
| Organization | Document | Position |
|---|---|---|
| CISAOther · April 2026 | Careful adoption of agentic AI servicesOur reading Names third-party components as a distinct route rather than a subset of supply chain risk: integrated without a privilege review, they arrive holding entitlements beyond what the workflow needs, and compromising one low-consequence tool inherits whatever the agent around it can reach. Notes that tool integration commonly runs in both directions, so the tool is not only something the agent calls but something that can return instructions to it.The component nobody reviewed, carrying privilege nobody granted | names it |
| Palo Alto NetworksVendor · May 2025 | Agentic AI threatsOur reading Reports that misconfigured or vulnerable tools significantly increase both the attack surface and the impact, and that insufficient access control at the backend is what makes some of these straightforward to exploit.Misconfigured and vulnerable tools | names it |
| AnthropicFrontier lab · July 2026 | Anthropic’s CISO guide to agentic AIOur reading Proposes limiting reachable surface as the primary control, which makes the tool list the thing to review.Constrain what the agent can reach | proposes a fix |
| AWSHyperscaler · April 2025 | Navigating the security landscape of generative AIOur reading Extends least privilege past the agent to the external integrations it reaches, and asks for those to be audited, reviewed and patched on a continuing basis rather than assessed once at build time.Treat every integration as part of the agent | proposes a fix |
| Cloud Security AllianceInstitution | Agentic AI Identity and Access ManagementOur reading Qualifies where the check has to sit: enforcement at the resource rather than in the instructions, because instructions are advisory to an optimiser.Authorisation belongs at the resource | qualifies it |
| FS-ISACInstitution · April 2026 | Preparing the enterprise for AI-enabled vulnerability discoveryOur reading Proposes a control rarely written down: deliberately delay taking on new open-source software or new models, so there is an interval in which a vulnerability can be found and fixed by somebody else before the thing is load-bearing. Pairs it with a freshness floor in the other direction - nothing internal or third-party more than two major versions behind - so the delay is bounded rather than becoming its own exposure.Let a new dependency age before you depend on it | proposes a fix |
| Palo Alto NetworksVendor · May 2025 | Agentic AI threatsOur reading Proposes input sanitisation, strict access control and routine static and dynamic security testing of the tools themselves rather than of the model alone.Sanitise inputs and test the tools | proposes a fix |