Radio With No Radar: Why Agent Runtime Security Fails Without the Layers Beneath It
Nearly every agent security pitch now ends on the same promise: the product stops the bad action in real time; the promise holds for one kind of agent, the kind whose traffic passes through a gateway the enterprise owns.
Nearly every agent security pitch now ends on the same promise: the product stops the bad action in real time; the promise holds for one kind of agent, the kind whose traffic passes through a gateway the enterprise owns.
One recent case shows what that gap looks like in practice.
Workday, which says AI now drives more than a quarter of its new annual contract value, runs its agents inside Workday.
It allows the known-good, warns where justification is plausible, redacts where the data is the problem and blocks where the chain is hostile.
What can be bought now, everywhere, is the stack runtime depends on: discovery across every vantage point, posture on every platform, identity and ownership for every agent and context for every decision.
The employee approved without registering that the assistant was about to route around the sanctioned system, and an unknown number of external recipients received email from a personal account rather than the approved channel.
The OWASP Agentic Skills Top 10 describes this gap as the unreachable skill scenario under AST09, No Governance: a capability deployed inside a third-party platform where no external scanner can go.
The malicious packages were live for about forty minutes, and CloudSEK later put the exposure at more than 2,500 organizations.
In each case the agent's tools are the application's features, its knowledge is the application's data and its permissions are the application's permission model.
The agent's identity and owner, its permissions, its normal behavior, the sensitivity of the data, the destination and the delegation chain behind the request do.
The assistant did exactly what it was built to do, and the fix was not retraining a model.
It was a single runtime rule that blocks any attempt to reach more than fifty external domains and explains to the user what the tool is about to do.
Knowing where to apply a rule like that depends on seeing which agents exist, what they are connected to and what normal looks like for each.
Every verdict is logged with its full causal path, because an incident review and a regulator want the same five things: the agent, the chain, the data, the destination and the policy.
What happened
Nearly every agent security pitch now ends on the same promise: the product stops the bad action in real time; the promise holds for one kind of agent, the kind whose traffic passes through a gateway the enterprise owns.
One recent case shows what that gap looks like in practice.
What changed
Workday, which says AI now drives more than a quarter of its new annual contract value, runs its agents inside Workday.
It allows the known-good, warns where justification is plausible, redacts where the data is the problem and blocks where the chain is hostile.
What can be bought now, everywhere, is the stack runtime depends on: discovery across every vantage point, posture on every platform, identity and ownership for every agent and context for every decision.
Who is affected
The employee approved without registering that the assistant was about to route around the sanctioned system, and an unknown number of external recipients received email from a personal account rather than the approved channel.
Why it matters
The OWASP Agentic Skills Top 10 describes this gap as the unreachable skill scenario under AST09, No Governance: a capability deployed inside a third-party platform where no external scanner can go.
The malicious packages were live for about forty minutes, and CloudSEK later put the exposure at more than 2,500 organizations.
Technical details
In each case the agent's tools are the application's features, its knowledge is the application's data and its permissions are the application's permission model.
The agent's identity and owner, its permissions, its normal behavior, the sensitivity of the data, the destination and the delegation chain behind the request do.
Response
The assistant did exactly what it was built to do, and the fix was not retraining a model.
It was a single runtime rule that blocks any attempt to reach more than fifty external domains and explains to the user what the tool is about to do.
What security teams should do
Knowing where to apply a rule like that depends on seeing which agents exist, what they are connected to and what normal looks like for each.
Every verdict is logged with its full causal path, because an incident review and a regulator want the same five things: the agent, the chain, the data, the destination and the policy.
What remains unknown
An unknown number of external recipients received email from a personal account rather than the approved channel.
Attribution
The Hacker News: Nearly every agent security pitch now ends on the same promise: the product stops the bad action in real time.
What to watch next
Watch for additional victim details, indicators of compromise and follow-on exploitation reports.
Watch for revised vendor guidance, fixed versions and mitigation updates.