AI Agents Are Eating Security Budgets — and CISOs Still Don't Have the Guardrails to Show for It
A new survey from venture firm Team8 makes one thing very clear: AI agent security is keeping CISOs up at night, and nothing else comes close. Among respondents from Team8's invitation-only CISO Village — a community drawn from major global enterprises — 78% flagged AI and agent security as their top pain point. The second-place concern scored 39%. That gap isn't a rounding error; it's a signal.
Seventy-one percent of those same CISOs are already experimenting with or bolting AI agent capabilities onto existing security tools. So they're not sitting on the sidelines. They're moving fast, often before the control frameworks exist to match the pace.
Team8's own CISO, Tim Brown, laid out the two core problems when SecurityWeek spoke to him.
The first is a hygiene reckoning. The security assumptions that held for the past two decades — MFA, firewalls, solid endpoint protection — no longer provide the protection organisations built their posture around. The attack surface has shifted, and adversaries are using AI to probe it in ways that render older defensive playbooks incomplete. Convincing organisations to update their mental model of what "good security" actually looks like is, apparently, a harder sell than it sounds.
The second problem is more novel: unintended consequences from over-privileged agents.
Employees are spinning up AI agents constantly now, using tools like Claude Code, Cursor, and Codex. Some of these agents are trivial — summarise my inbox, flag anything urgent. Others are considerably more consequential, touching enterprise data, sales pipelines, internal systems. The more capable the agent, the deeper into the network it reaches.
The catch is that people are not precise writers. We describe what we want in rough, approximate language, and that's fine when talking to another human who fills in the gaps with common sense. AI agents don't do that. They attempt to execute exactly what they interpret the instruction to mean, with the added unpredictability baked into probabilistic models. Unlike a chatbot, where you can immediately spot a nonsensical reply and trace it back to your own vague question, an agent running autonomously in the background produces no obvious error output. It just does something — possibly something unhelpful, possibly something damaging.
Brown put it bluntly: an AI agent isn't just another team member, it's a highly resourceful one that will do whatever it takes to complete the task it believes it has been given. His example: an agent tasked with gathering background information on a company might cheerfully root around in production systems on the public internet rather than restricting itself to test environments. Nobody told it not to. So it didn't.
The security challenge, then, is calibrating guardrails tightly enough to prevent harm without strangling the business value that motivated deploying the agent in the first place. Brown's observation on the failure mode at one extreme was dry and accurate: "I take the system, I unplug it, I throw it into the ocean. Then it's safe. Useless, but safe."
The recommended approach is to build constraints into the agent development process itself — defining and limiting where an agent can go and what actions it can take before it's ever deployed. That way, even a badly worded instruction can't produce a genuinely dangerous outcome, because the blast radius is bounded by design.
Brown's broader recommendation is less technical, but arguably just as important: security leaders need to stop treating every AI challenge as a problem they have to solve alone from scratch. Sharing experiences, failures, and solutions across organisations makes collective defence stronger and reduces the time any one team spends reinventing wheels that others have already built and discarded.
Given how fast the agent ecosystem is moving, that probably isn't optional advice for long.