As AI Agents Gain More Control, Cybersecurity Rules Are Being Rewritten

AI Agents Are Gaining More Autonomy. Security Rules Are Struggling to Keep Up

AI agents can increasingly access files, browse websites and take actions inside connected services. That is forcing cybersecurity agencies to decide how much authority these systems should actually have.

South Korea’s internet-security agency is developing updated guidance specifically for agentic AI, while NIST and security groups are examining how agents should be identified, authorised and restricted. The emerging principle is simple: an AI agent should not receive more access than it needs to complete its task.

AI agents are moving from answering questions to acting inside the systems people and businesses already use. That shift is forcing cybersecurity agencies to rethink a basic question: not only whether an AI is safe, but what it should be allowed to access and do.

On 15 September, South Korea’s Korea Internet & Security Agency (KISA) said it is developing an updated version of its AI Security Guide for agentic AI services. Reuters reports that the revised guide will focus on risks created by greater autonomy, include a security checklist and may extend common controls to “physical AI” systems that interact with real-world devices and machinery. The guidance is still being developed. It is not yet a binding law or final technical standard.

The security problem changes when AI can take action

A conventional chatbot can give a bad answer. An agent connected to email, cloud storage, workplace software or a browser may be able to read files, send messages, change records or trigger actions. If that agent is manipulated, confused or given excessive access, the consequences can move beyond inaccurate text.

The US National Institute of Standards and Technology has been studying the same problem. Its 2026 work on AI-agent identity and authorisation says organisations need ways to identify software agents, control what they can access and audit what they do.

This is where least privilege becomes important: an agent should receive only the permissions required for the task. TechView Africa previously explained why high-impact actions such as payments, account-security changes and sensitive communications should remain supervised when using AI agents.

Prompt injection turns permissions into a security issue

A malicious instruction can be hidden inside a webpage, email or document that an AI agent reads. If the agent follows it, the system may be pushed toward an action the user never requested.

OpenAI describes prompt injection as an evolving industry-wide security problem and recommends limiting agent access, reviewing consequential actions before approval and giving agents specific rather than overly broad instructions.

OWASP makes a similar recommendation in its AI Agent Security guidance: minimise tool permissions, separate read-only and write access, require explicit authorisation for sensitive operations and keep humans involved in high-risk actions.

An agent asked to summarise a folder, for example, should not automatically have permission to delete files or send them externally. That builds on TechView Africa’s guide to checking AI permissions before connecting email, files or photos. The more an assistant can act, the more important those permissions become.

Why African organisations should care now

African banks, telecoms, governments and businesses are beginning to use AI for customer service, coding, research and internal workflows. As those systems become more autonomous, they may be connected to customer records, company email, cloud services and administrative tools.

The important questions are practical: Which agents are connected? What data can they read? Which actions can they take without approval? Can administrators see what happened afterwards?

NIST’s May 2026 analysis of industry responses on AI-agent security found broad agreement that traditional cybersecurity principles still matter but need adaptation for agentic systems.

South Korea’s work is significant because it moves the conversation from abstract AI safety to operational controls.

The final KISA checklist has not yet been published, so specific requirements should not be assumed. But identity, permissions, logging, human approval and limits on autonomy are increasingly becoming part of AI cybersecurity. For African organisations, the safest approach is not to wait for a local incident or regulation before asking those questions.

Our Recommendation

African organisations should begin agent deployments with low-risk, reversible tasks and only the permissions each agent genuinely needs. Payments, sensitive records, account-security changes and irreversible actions should continue to require human approval, with clear logs showing what the agent accessed and changed.