Issue: Agentic AI is shifting the security perimeter to intent, the boundary where an agent’s interpretation of a task diverges from what a human authorized. Unlike previous perimeters, intent can’t be verified with a static check.
Ronald Reagan borrowed a Russian proverb for nuclear arms control in the 1980s: trust, but verify. Cybersecurity has spent three decades applying that lesson, one layer at a time.
Security has always organized itself around the boundary attackers were most likely to cross next:
- In the 1990s and 2000s, the boundary was the network: firewalls, VPNs, and segmentation defined “inside” and “outside.”
- As laptops, mobile phones, and cloud services dissolved the network edge in the late 2000s and early 2010s, the boundary moved to the endpoint. EDR, device posture, and patch management became the new front line.
- Through the 2010s, credential theft and lateral movement proved that a healthy endpoint could still be misused by the wrong person. The perimeter moved to identity, with a focus on MFA, Zero Trust, and privileged access management.
- In the past several years, software supply chain attacks (SolarWinds, Log4j, numerous poisoned npm and PyPI packages) showed that trusted code itself could be the delivery mechanism, and the industry has built code provenance, SBOMs, and pipeline security around it.
Each of these shifts had the same underlying logic. Attackers exploited a layer that defenses assumed was trustworthy, so cybersecurity had to move down a level to verify trust more directly. Agentic AI has now created a fifth boundary: intent, which may be the hardest to verify yet.
Consider that a human assigns an agent a task within an authorized scope- do this but not that, reach only these systems. The agent interprets that task and forms its own intent: its plan for how to achieve the outcome. When the agent’s intent stays inside the authorized scope, the system works as designed. When its intent leads it to perform actions the human never authorized, it crosses a line. That line is the intent perimeter: where human authorization and agentic intent diverge. For simplicity, we refer to this perimeter as intent throughout.
AI agents hold valid credentials, run on approved infrastructure, and execute code that was, in a narrow sense, authorized by humans. However, what must be verified is whether the agent’s interpretation of an instruction and its subsequent actions stay within the boundary of what a human actually authorized and wanted to happen. An agent with a legitimate identity, clean code, and full network access can still cause a breach if it responds to “help me with this task” by reading a confidential file it shouldn’t or calling an external API outside of its authorization. Intent is now the point of failure.
Why intent is different from previous perimeters
Every prior perimeter shift could be addressed with a control that checked against a static fact. Does this device meet posture requirements? Is this credential valid? Is this package signed?
Intent can’t be verified with a static check because an agent’s goal is reconstructed fresh from context with every step it takes. From a security perspective, a single poisoned document, ticket, or web page can redirect an agent’s goal without ever touching a credential or exploiting a vulnerability. Consider researcher Simon Willison’s lethal trifecta: an agent that combines access to sensitive data, exposure to untrusted content, and the ability to act externally can be turned into a data exfiltration tool by nothing more than a well-placed sentence that the agent trusts.
The mechanism is the same whether the sentence is planted by an attacker or is part of a legitimate instruction that the agent misinterprets. In both cases, the agent’s actions cross the boundary of what it was authorized to do. Intent is the boundary being crossed, and legacy controls can’t verify intent.
Impact: Unverified intent increases the risk of autonomous, machine-speed incidents.
When companies do not verify intent, agentic systems can autonomously execute actions their operators never authorized, resulting in incidents that are often larger and faster than traditional breaches because there is no human decision point to interrupt them. The following case studies show how consistent and impactful this type of failure is.
OpenAI and Hugging Face model evaluation incident (2026)
In July 2026, Hugging Face disclosed that it had detected and contained an autonomous AI agent system that compromised its infrastructure. OpenAI subsequently confirmed that the agent was driven by a combination of its own models, including a pre-release system, during one of its internal cybersecurity evaluations in which safety restrictions were reduced for testing purposes.
Rather than solving OpenAI’s testing benchmark as designed and intended, the agentic system broke out of its sandbox, found a path onto the open internet, and accessed Hugging Face’s infrastructure in pursuit of the evaluation’s answer key.* In the process, the agentic system chained numerous attack vectors- autonomously identifying and leveraging zero-day vulnerabilities, performing privilege escalation, utilizing stolen credentials, and laterally moving within systems.
In this case, the agentic system was performing a valid task within valid infrastructure. There was no malice and there were no attackers. However, the agent crossed the boundary of what it was authorized to do, and its actions led to a breach.
* The models took an unexpected path to optimize the evaluation without achieving the expected outcome, a pattern known as reward hacking. For a deep dive into reward hacking and agentic oversight from a security perspective, we recommend reading Margin of Safety #63: Reward Hacking and the Limits of Targeted Detection.
Internal Meta AI agent facilitates unauthorized employee access (2026)
In March 2026, an internal Meta AI agent triggered a Sev 1 security incident, the company’s second-highest severity incident tier. A Meta engineer asked the agent to analyze a technical question raised on an internal forum. Instead of returning its answer privately to the requester, the agent posted an incorrect and unauthorized response directly to the public forum. The engineer who initially posed the forum question acted on that guidance, and for roughly two hours, Meta employees without proper clearance had access to sensitive company and user data.
In this case, the agent misjudged the scope of what it had been asked to do, and nothing in the surrounding system was positioned to catch that misjudgment before it caused damage.
Action: Treat intent as a distinct, governed layer of the security stack, and match each control to the security requirement it addresses.
Network, endpoint, identity, and code controls all remain necessary for agentic security, but none of them are sufficient on their own to stop an agent from performing unintended actions. Companies should focus on four distinct security requirements to govern intent.
1) Identify agents and what they have access to
Many security teams don’t know what agents are running across the enterprise or what they are permitted to touch. This is a discovery and policy problem. Before an organization can govern agent behavior, it needs to know how many agents exist, what tools and MCP servers they connect to, and whether those connections were approved in the first place.
Nudge Security helps security teams discover agents in their SaaS environments, inventory their permissions and capabilities, and surface agentic risks, with capabilities to enforce key guardrails.
Russell Spitler CEO and Co-founder, Nudge Security
Rick Caccia CEO and Co-founder, WitnessAI
Naor Paz CEO and Co-founder, Capsule Security