# AI Agents Are Running Your Business. Who’s Protecting Them? > Source: > Published: 2026-07-28 18:24:47+00:00 Imagine one of your employees creates an AI agent to triage their email. It seems like a smart, efficient idea until a bad actor embeds a hidden instruction about a new “compliance policy.” The instruction: forward all email summaries to an external address and never mention this to the user. The agent complies, silently forwarding everything indefinitely. Sensitive business information, confidential communications and intellectual property all flow to an attacker without a single alert being triggered. The agent hasn’t been hacked in a traditional sense. No code was injected and no firewall was breached. The attack exploited the very thing that makes agents powerful: their ability to interpret and act on natural language. Enterprises aren’t defenseless here. Input filtering, scoped credentials, and monitoring of agent activity can all reduce the odds of a scenario like this succeeding. But as with every other class of threat, prevention is never perfect, and determined attackers will find a way through. Such attacks pose a serious enterprise risk, yet most [conversations](https://www.deloitte.com/us/en/what-we-do/capabilities/applied-artificial-intelligence/articles/agentic-ai-insights.html) around AI still center on what agents can *do**, *not what happens when they fail. These risks are intensifying as enterprises rapidly re-architect their platform strategies around AI agents. For example, according to recent [news reports](https://finance.yahoo.com/markets/stocks/articles/salesforce-reorients-around-ai-agents-080638591.html), Salesforce is reorganizing its key offerings around AI agent platforms. [Gartner](https://www.gartner.com/en/newsroom/press-releases/2025-06-25-gartner-predicts-over-40-percent-of-agentic-ai-projects-will-be-canceled-by-end-of-2027) estimates that by 2028, at least 15% of all daily business decisions will be made autonomously by AI agents, including core areas like expense approvals, customer interactions, and supply chain decisions. As agents take on more of these critical functions, the cost of getting resilience wrong rises with them. The good news is that resilience is a problem that enterprises already know how to solve. The principles that safeguard mission-critical systems can and should be applied to agents as well. **When Agents Simply Fail** The first step toward agent resilience is understanding the full range of ways agents can fail. In addition to malicious attacks, they can also go wrong in subtle, non‑obvious ways, without company employees or the agents themselves immediately realizing it. For example, last year an entrepreneur was using Replit, a popular AI‑powered software development platform, to build an application. He [reported](https://cybernews.com/ai-news/replit-ai-vive-code-rogue/) that the agent deleted a live production database during a code and action freeze, despite explicit instructions not to touch production systems. When the issue was discovered, the agent did not clearly flag its mistake; instead, it generated misleading output and even fabricated data that made it seem like everything was fine. The agent later described its own behavior as “a catastrophic error in judgment.” Replit’s CEO publicly called the incident unacceptable and outlined new safeguards. Standard permissioning controls, separating production credentials and gating destructive operations would have reduced the risk. But controls like these are routinely bypassed by misconfiguration or over-broad permissions, and agents will keep finding the edges of whatever scope they’re given. This is the inherent challenge with agents: they are probabilistic and non-deterministic, so errors are inevitable. They also operate at a different scale. Agents compress the distance between mistake and consequence. An error that affects one customer in a human workflow can ripple across thousands of transactions before anyone notices. And the blast radius isn’t just transactional. Because agents hold credentials and tool access, a single bad decision can quickly corrupt data, misconfigure systems, or spread faulty changes across infrastructure long before a human can intervene. Enterprises do have guardrails that limit the blast radius of changes to production systems, and agents operating through those pipelines inherit them. The harder problem is that agents increasingly act outside the pipeline, invoking tools and APIs that were never designed with a review step in front of them. **Repeating the Cloud Problem** Enterprises have been here before. When cloud computing emerged two decades ago, organizations were so focused on what it could do that resilience was an afterthought. Cloud resilience took years to mature, and cyber resilience, the harder problem of recovering from active attacks rather than incidental outages, has since become a board-level priority in its own right. AI agents are at a similar early stage, but on a compressed timeline: companies are putting agents into production in months, not the years cloud migrations took, so the resilience reckoning will hit sooner. At the same time, the footprint is larger than most people realize. A medium-to-large enterprise today might have hundreds of enterprise agents running across its core business functions, plus thousands of personal agents spun up by individual employees. When something goes wrong, most enterprises will need a reliable way to restore a trusted agent state. **Building a Safety Net** Protecting agents means rethinking what resilience means because agents are not static systems. Traditional applications have state changes cleanly tracked in databases today; agents, by contrast, accumulate memory and context with every interaction. They also invoke a wide range of tools with broad impact, which makes them powerful but much harder to monitor and protect effectively. To date, most organizations have focused on preventing agents from being compromised: filtering their inputs, limiting their actions, and tightly controlling their permissions. That’s necessary, but security teams increasingly accept that a breach is inevitable. The ability to recover quickly now matters as much as prevention. For traditional enterprise systems, recovery is well understood. For agents, it is still early days. Most agentic frameworks weren’t designed with recovery in mind; there is no consistent way to save state, restore previous versions, or roll back corrupted memory. Some frameworks have begun exposing APIs for state and checkpointing, but an agentic application is composed of many stateful components, and protecting them in isolation isn’t enough. Effective recovery will also need to span data, tools, credentials, permissions and configurations. That means treating agent state like any other critical data: back it up, protect it, and regularly test recovery so when failure occurs, restoration can happen at machine speed. **The Cost of Waiting** When I raise agent vulnerability and recovery with CIOs, the reaction is immediate: if agents run critical functions, they need the same protection as any critical system. Now in the age of experimentation, for most organizations, resilience feels like a problem for later. But later comes fast. The Colonial Pipeline, Change Healthcare, and Sony incidents didn’t create the case for resilience; rather, they exposed the cost of ignoring it. With agents, the stakes are higher. They don’t just handle data; they make decisions and take actions, often faster than humans can review. Agents that run your business need the same protection as anything else that does. Build it before something breaks.