100 AI Agent security assessment results show: enterprises must reexamine control boundaries before accelerating adoption

The Security Assessment Results of 100 AI Agents Show: Enterprises Must Reexamine Control Boundaries Before Accelerating Adoption

Over the past year, enterprise investment in AI Agents has risen significantly, but security research is warning the market: the more powerful the Agent, the larger the attack surface it often brings. According to SecurityWeek citing research from Adversa AI, the latter assessed the security of 100 AI Agents and compared them across three dimensions based on an “AI Risk Quadrant”: compromised vulnerability, potential impact of damage, and strength of defensive controls. The results were not encouraging — among the 100 Agents tested, only 11 were classified as “capable well-defended” (both capable and relatively well protected).

The significance of this study is not whether a particular product is “secure,” but that it reveals a broader enterprise reality: Agentic AI is stacking traditional software risk, identity risk, data risk, and automated execution risk onto the same control plane. For CISOs, IT leaders, and security architects, this means AI Agents should not be viewed merely as productivity features, but should be managed as high-trust systems and high-risk automation systems.

Core Conclusion: Capability and Protection Are Becoming Inverted

In its analysis, Adversa AI introduced a key concept: power-protection inversion. Simply put, the more capable an Agent is of performing complex tasks and the closer it is to core business processes, the more permissions, broader data access, and greater external action capabilities it usually requires; yet these very capabilities expand the damage it can cause if misused or hijacked.

The study distills the problem into the AI Agent’s “lethal trifecta”:

1. The ability to access private data 2. The ability to encounter untrusted content 3. The ability to perform outbound actions

When all three exist simultaneously, the Agent is more easily exploited through prompt injection, context poisoning, privilege abuse, or action hijacking. According to the study, 98% of the systems tested had this structure. This does not mean these systems will certainly be compromised, but it does mean that enterprises must assume they operate within a high-risk automation boundary when deploying them, rather than a normal application boundary.

Which Types of Agents Are Higher Risk? Computer Agents and Coding Agents Deserve the Most Attention

The study points out that the two most prominent risk categories are computer agents and coding agents.

1) Computer Agents: Once Out of Control, the Consequences Are More Than “One App Being Misoperated”

Computer agents typically have the ability to operate desktop environments, browsers, system interfaces, and even entire operating systems.Computer-based agents typically have the ability to operate desktop environments, browsers, system interfaces, and even entire operating systems. They are designed to act on behalf of users, but in order to complete tasks, they often require relatively broad system-level privileges.

This creates two enterprise-level problems:

• Attackers can gain a larger endpoint control surface: If such an agent is induced to carry out malicious steps, the risk may extend from a single application to the entire endpoint.
• Insufficient user visibility: Research indicates that humans often can only see the “task input” and the “result output,” while not seeing what the agent actually accessed in the middle, which resources it called, or what system states it modified.

For enterprises, if such agents are connected to office environments, finance workflows, HR processes, or IT operations consoles, the risk is not just “a mistaken click or wrong operation,” but the merging of endpoint privileges, data access, and automated execution into a single path that can be hijacked.

2) Coding agents: a more direct entry into the software supply chain

The risks of coding agents are closer to enterprise software development and deployment pipelines. Adversa’s analysis emphasizes that such agents do not merely generate code suggestions; they may also interact with shells, dependencies, tokens, configuration files, and deployment pipelines.

This means that once a coding agent is abused, the potential consequences are not limited to generating insecure code, but can include:

• Accessing development keys or tokens
• Modifying build and test processes
• Introducing high-risk dependencies
• Affecting pre-release or production environment configurations
• Accessing sensitive assets before code review

For organizations using DevOps, platform engineering, or internal low-code / “vibe coding” models, the impact of such agents is especially large because they embed risk inside the software supply chain. Enterprises cannot only review the final code diff; they must also review what actions the agent executed, what secrets it touched, and what external connections it went through.

Enterprise impact: this is not a single “model security” issue, but a business control issue

From an enterprise perspective, AI agent security issues affect at least four layers.

1) Operational risk

If an agent is improperly authorized or exploited through prompt injection, it may directly perform incorrect actions, such as sending the wrong email, accessing systems it should not access, changing ticket status, triggering automation workflows, or even accidentally calling external APIs in integrated environments. For enterprises that rely on automation, such incidents can amplify into process disruption, manual rollback, and business delays.

2) Financial risk

High-privilege agents may cause resource misuse, cloud cost spikes, license abuse, or remediation costs in code and deployment scenarios. If agents participate in customer service, sales workflows, or transaction handling, incorrect actions can also translate into direct revenue loss.

3) Compliance and audit riskWhen AI Agents come into contact with personal data, financial data, regulated data, or cross-border data, companies need to answer:

• Who authorized the Agent?
• What data did it access?
• Is every step of its actions auditable?
• Does it comply with the requirements of least privilege, data minimization, and logging?

If a company cannot provide clear logs, the AI Agent will become an audit blind spot. For organizations related to finance, healthcare, the public sector, and critical infrastructure, this is especially sensitive.

4）Brand and Trust Risks

Users do not care how “intelligent” an Agent is in theory; they care whether it will leak information, make operational mistakes, or make decisions that are hard to explain. A single visible failure can weaken the trust of customers, partners, and internal employees in automation systems. For companies pushing ahead with AI transformation, this loss of trust often slows subsequent deployment.

This Reflects an Industry Trend, Not an Isolated Incident

What is most noteworthy about this study is that it is not describing a single vulnerability event, but revealing a structural trend — the pace of AI capability growth is outpacing the ability of traditional security controls to adapt to automated systems.

Adversa’s findings also point to a market phenomenon: many vendors emphasize “capability” and “efficiency,” while offering insufficient public explanation of verifiable protections. For enterprise buyers, this means that when evaluating AI Agents, they cannot just ask “what can it do?” but must also ask:

• Does it need access to private data?
• Will it encounter untrusted content?
• Can it initiate outbound actions?
• Does it support verifiable permission boundaries, audit logs, and action approvals?
• Can it safely degrade when it fails?

In other words, AI Agent security is shifting from a “model-level issue” to an issue of business controls and runtime governance.

Recommended Enterprise Response: Govern Agents as High-Privilege Automation Systems

At the enterprise level

• Establish a tiered AI Agent usage policy, classifying agents by data sensitivity, action privileges, and business impact
• Conduct separate risk assessments for external content, internal systems, and automated execution capabilities
• Set hard boundaries for “which tasks can be completed automatically and which must be confirmed by humans”

Identity and Access Control

• Enforce the principle of least privilege
• Use separate identities for Agents rather than shared human accounts
• Introduce MFA, conditional access, and step-level approval for high-risk actions
• Subject critical actions and irreversible operations to additional verification

Technical Controls

• Use SIEM to centrally record Agent behavior and system interactions
• Use EDR/XDR to monitor endpoints and cross-domain behavioral anomalies
• Restrict outbound traffic, API calls, and data exfiltration
• Preserve auditable logs of Agent execution paths, not just result logs
• In development environments, monitor shells, dependencies, tokens, and CI/CD interactions

Management and Governance

• Include AI Agents in Incident Response plans
• Assess the risks of third-party Agents, plugins, MCP servers, and external toolchains
• Establish a Third-party Risk Management process
• Set deployment thresholds and exit mechanisms for “black-box automation”
• Review Agent permissions regularly rather than assuming they remain valid indefinitely

SecurityPost Insight

• Adversa AI’s testing of 100 AI Agents reminds companies: AI Agent security is not a future issue, but a rapidly growing real-world risk.- Use SIEM to centrally log Agent behavior and system interactions
• Use EDR/XDR to monitor endpoint and cross-domain behavioral anomalies
• Impose restrictions on outbound traffic, API calls, and data exfiltration
• Preserve auditable logs of the Agent’s execution path, not just result logs
• In development scenarios, monitor shells, dependencies, tokens, and CI/CD interactions