{"slug": "palo-alto-networks-tackles-the-risks-of-autonomous-ai-agents", "title": "Palo Alto Networks tackles the risks of autonomous AI agents", "summary": "Palo Alto Networks Inc. announced an integration of its Prisma AIRS runtime security with Google Cloud's Agent Gateway, a component of the Gemini Enterprise Agent Platform, to inspect autonomous AI agent activity inside Google Cloud environments. Spencer Thellmann, principal product manager at Palo Alto Networks, told theCUBE's John Furrier that agents' autonomy, memory and tool use make them \"uniquely dangerous,\" and that security controls must evaluate agent intent and behavior at runtime rather than only inspecting chatbot prompts and responses. Thellmann said enterprises may eventually run far more agents than employees, making the reconciliation of continuous nonhuman activity the \"next frontier for AI security.", "body_md": "### Palo Alto Networks tackles the risks of autonomous AI agents\n\nAI agent security now has to govern what autonomous software can do, not just what it can say.\n\nThe shift from chatbots to autonomous agents changes the enterprise risk equation now that agents can access tools, retain information and act without waiting for a human prompt. Palo Alto Networks Inc. is addressing that change through [Prisma AIRS integrations](https://www.paloaltonetworks.com/sase/prisma-airs-contact-us?utm_source=google-jg-amer-portfolio-brnd-port&utm_medium=paid_search&utm_campaign=google-portfolio-ai_netsec-amer-multi-discovery-en-brand&utm_content=701Ki000000osCfIAI&utm_term=palo%20alto%20prisma%20airs&cq_plac=&cq_net=g&gclsrc=aw.ds&gad_source=1&gad_campaignid=23588641131&gbraid=0AAAAADHVeKlh6TyvXixH5rNC9tdKmEM_Q&gclid=CjwKCAjwj7HTBhBiEiwA8s35OlFMkHGqkQMzuzaaEOInTSt5RCDlzhynyi4fAy0fAlpRNMOhIFpQlhoCa_gQAvD_BwE) designed to inspect agent activity within Google Cloud environments. According to [Spencer Thellmann](https://www.linkedin.com/in/spencer-thellmann-444b80113/) (pictured), principal product manager at Palo Alto Networks, the larger challenge is that the same capabilities making agents useful also create their most consequential vulnerabilities. \n\n“We can’t treat agents like a chatbot,” Thellmann said. “Agents are autonomous applications that take action on behalf of users or other agents. They do this by invoking tools, and they have memory, both short and long term, just like you and I do. It’s those things that make an agent powerful – their autonomy, their memory and their tool use – that also make them uniquely dangerous.”\n\nThellmann spoke with theCUBE’s [John Furrier](https://www.linkedin.com/in/furrier/) for the [Google Cloud: AI Agents in Action Series](https://www.thecube.net/events/google/ai-agents-in-action) on theCUBE, SiliconANGLE Media’s livestreaming studio. They discussed how Palo Alto Networks is [securing autonomous agents](https://siliconangle.com/2026/05/12/idira-launches-palo-alto-networks-extends-cyberark-tech-machine-agentic-identities/), model activity and tool interactions within Google Cloud. *(* Disclosure below.)*\n\n### AI agent security moves beyond prompts\n\nTraditional chatbot security largely concentrates on inspecting inputs and responses for prompt injection, data leakage or harmful content. Autonomous agents require broader oversight because they may call external services, manipulate enterprise resources or coordinate with other agents. Security controls therefore must evaluate intent and behavior while activity is happening, Thellmann noted.\n\n“A flip side of autonomy is your agent can do anything, which means it can do anything,” he said. “That could include doing things like deleting production databases, which no one wants happening. Tools can be manipulated. Memory can as well.”\n\nThe scale of agent deployment compounds the problem. Enterprises may eventually operate far more agents than employees, leaving security teams to interpret continuous activity from nonhuman identities. Static policies alone will struggle to distinguish a legitimate automated task from an action that is technically permitted but operationally dangerous, Thellmann emphasized.\n\n“You’ll have these autonomous beings, non-humans, within your network that are just doing things all the time, either in isolation or together,” he added. “Reconciling what they’re doing and making a deterministic call as to whether or not that should happen is the sort of next frontier for AI security.”\n\n### Runtime controls follow agents into production\n\nSecurity products also need to operate inside the platforms where developers build and deploy agents. Palo Alto Networks has announced an integration of Prisma AIRS runtime security with [Google Cloud’s Agent Gateway](https://cloud.google.com/blog/products/identity-security/introducing-agent-gateway-isv-ecosystem-for-security-and-governance), a component of the [Gemini Enterprise Agent Platform](https://cloud.google.com/products/gemini-enterprise-agent-platform?utm_source=google&utm_medium=cpc&utm_campaign=Cloud-SS-DR-GCP-1713658-GCP-DR-NA-US-en-Google-BKWS-BRO-GEAP&utm_content=c-Hybrid+%7C+BKWS+-+BRO+%7C+Txt-AIML-Generative+AI-Gemini+Enterprise-2478898188682&utm_term=gemini%20enterprise%20agent%20platform&gclsrc=aw.ds&gad_source=1&gad_campaignid=23749696287&gclid=CjwKCAjwj7HTBhBiEiwA8s35OkHMfoHUx0-H6eAW72Pxz-lMBnR92HiQM7OfK9OIxgHpQBt33_U5JhoCfLUQAvD_BwE), with broader availability expected this fall. The connection is intended to inspect tool calls as they pass between agents and external systems, according to Thellmann.\n\n“How this works is through service extensions, where by adding a service extension to the gateway, I can today use it to send all MCP tool calls and responses to Prisma AIRS API for inspection,” he said. “We’re going to broaden that in the fall by extending the capability to also scan all user inputs and outputs to Gemini Enterprise Agent Platform agents.”\n\nModel Context Protocol connections present a two-way exposure. Sensitive credentials can leave an enterprise through an agent request, while a compromised MCP server can return malicious links, malware or instructions embedded in tool descriptions. Runtime inspection therefore must assess the request, the response and the metadata surrounding the transaction, Thellmann pointed out.\n\n“A server that’s legitimate today could be sort of illegitimate tomorrow,” he said. “One area where we see that is in tool descriptions, where the description of a tool can contain an indirect prompt injection attack, which could do something like coerce an agent into leaking its conversation history to someone who shouldn’t have access to it.”\n\n### Agents begin policing the AI supply chain\n\nAgent-based security is also extending into model governance. Palo Alto Networks has packaged its model-scanning service as an agent available through Google Cloud Marketplace. The system examines model files against policies configured in [Strata Cloud Manager](https://www.paloaltonetworks.com/network-security/strata-cloud-manager), allowing organizations to check licensing, publisher verification and suspicious components before deployment.\n\n“The cool thing about this is that because it’s built on ultimately an A2A card … other agents can talk to it now,” Thellmann said. “If you have some kind of agent that’s responsible for pulling models from the Internet and then running them in some kind of inference service, that agent could self-police itself by sending the model that it’s about to do something with to our model scanning agent for inspection.”\n\nThat model reflects a broader movement toward machine-to-machine security decisions. Rather than requiring a person to submit every model manually, an agent can request a policy verdict from another agent before continuing a workflow. Security becomes part of the automated process instead of a separate review imposed after development.\n\n“All that I have to do is go to the marketplace, assuming that I already have a license for model scanning, and then I can spin up the agent within Gemini Enterprise Agent Platform,” Thellmann said. “I can start sending it models and getting verdicts back that match the policy that I’ve set up in Strata Cloud Manager.”\n\nDemand for these controls is rising alongside enterprise agent adoption. Prisma AIRS more than tripled its customer base within three months, reflecting growing interest in model scanning, red teaming and runtime protection, according to Thellmann. Palo Alto Networks is now concentrating its product roadmap on securing agents across cloud platforms, software-as-a-service environments and endpoints.\n\n“Our focus right now is singularly on AI agents because of some of the problems that we’ve discussed today,” he said. “I spend all of my waking hours thinking about how to help our customers secure their agents across cloud, SaaS platforms and endpoint agents. I think we’ll have more to tell you about those three areas soon.”\n\nHere’s the complete video interview, part of SiliconANGLE’s and theCUBE’s coverage of the [Google Cloud: AI Agents in Action Series](https://www.thecube.net/events/google/ai-agents-in-action):\n\n*(* Disclosure: TheCUBE is a paid media partner for the Google Cloud: AI Agents in Action Series. Neither Google Cloud, the sponsor of theCUBE’s event coverage, nor other sponsors have editorial control over content on theCUBE or SiliconANGLE.)*\n\n##### Image: SiliconANGLE\n\n# A message from John Furrier, co-founder of SiliconANGLE:\n\nSupport our mission to keep content open and free by engaging with theCUBE community. **Join theCUBE’s Alumni Trust Network**, where technology leaders connect, share intelligence and create opportunities.\n\n- **15M+ viewers of theCUBE videos** , powering conversations across AI, cloud, cybersecurity and more\n- **11.4k+ theCUBE alumni** — Connect with more than 11,400 tech and business leaders shaping the future through a unique trusted-based network\n\n### Are you an AWS customer?  Support SiliconANGLE financially by buying your AWS services from our Marketplace portal page and links: [https://siliconangle.com/aws-marketplace/](https://siliconangle.com/aws-marketplace/)\n\n##### **About SiliconANGLE Media**\n\n[SiliconANGLE](https://cts.businesswire.com/ct/CT?id=smartlink&url=https%3A%2F%2Fsiliconangle.com%2F&esheet=54119777&newsitemid=20240910506833&lan=en-US&anchor=SiliconANGLE&index=9&md5=646b1b564e2259100a2b8638aab0a552),\n\n[theCUBE Network](https://cts.businesswire.com/ct/CT?id=smartlink&url=https%3A%2F%2Fwww.thecube.net%2F&esheet=54119777&newsitemid=20240910506833&lan=en-US&anchor=theCUBE+Network&index=10&md5=7de2a85f95ab4a4a495cede20b8cb1da),\n\n[theCUBE Research](https://cts.businesswire.com/ct/CT?id=smartlink&url=https%3A%2F%2Fthecuberesearch.com%2F&esheet=54119777&newsitemid=20240910506833&lan=en-US&anchor=theCUBE+Research&index=11&md5=7bb33676722925eb57d588ec343e4f6f),\n\n[CUBE365](https://cts.businesswire.com/ct/CT?id=smartlink&url=https%3A%2F%2Fwww.cube365.net%2F&esheet=54119777&newsitemid=20240910506833&lan=en-US&anchor=CUBE365&index=12&md5=d310fb35919714e66ad8d42c9c0c1bc6),\n\n[theCUBE AI](https://cts.businesswire.com/ct/CT?id=smartlink&url=https%3A%2F%2Fwww.thecubeai.com%2F&esheet=54119777&newsitemid=20240910506833&lan=en-US&anchor=theCUBE+AI&index=13&md5=b8b98472f8071b23ebb10ab9a8dd0683)and theCUBE SuperStudios — with flagship locations in Silicon Valley and the New York Stock Exchange — SiliconANGLE Media operates at the intersection of media, technology and AI.\n\nFounded by tech visionaries John Furrier and Dave Vellante, SiliconANGLE Media has built a dynamic ecosystem of industry-leading digital media brands that reach 15+ million elite tech professionals. Our new proprietary theCUBE AI Video Cloud is breaking ground in audience interaction, leveraging theCUBEai.com neural network to help technology companies make data-driven decisions and stay at the forefront of industry conversations.", "url": "https://wpnews.pro/news/palo-alto-networks-tackles-the-risks-of-autonomous-ai-agents", "canonical_source": "https://siliconangle.com/2026/09/24/ai-agent-security-palo-alto-networks-googlecloudaiagentsinaction/", "published_at": "2026-09-24 17:06:36+00:00", "updated_at": "2026-09-24 17:32:26.383266+00:00", "lang": "en", "topics": ["ai-agents", "ai-safety", "ai-products", "ai-infrastructure"], "entities": ["Palo Alto Networks Inc.", "Prisma AIRS", "Google Cloud", "Agent Gateway", "Gemini Enterprise Agent Platform", "Spencer Thellmann", "John Furrier", "theCUBE"], "also_reported_by": [], "alternates": {"html": "https://wpnews.pro/news/palo-alto-networks-tackles-the-risks-of-autonomous-ai-agents", "markdown": "https://wpnews.pro/news/palo-alto-networks-tackles-the-risks-of-autonomous-ai-agents.md", "text": "https://wpnews.pro/news/palo-alto-networks-tackles-the-risks-of-autonomous-ai-agents.txt", "jsonld": "https://wpnews.pro/news/palo-alto-networks-tackles-the-risks-of-autonomous-ai-agents.jsonld"}}