AI agents are an insider-risk problem, not a perimeter-security one

The security industry spent 2019 to 2022 turning insider risk into its own discipline, separate from perimeter defense, because it finally accepted a hard truth: the most dangerous actor in a system is often one that already has legitimate access. An agent that drifts out of alignment with what you actually wanted fits that description exactly. It didn't break in. It was let in, on purpose, by someone who gave it a task.

That analogy is doing real work right now in how security teams think about agents, and most of it holds up. What doesn't automatically transfer is the part of the insider-threat playbook built to catch a specific kind of actor: one with a motive.

The identity problem the analogy gets right

Every agent you deploy sits somewhere on a spectrum. At one end is a system service account: single-purpose, least-privilege, no human identity attached, doing one job the same way every time. At the other end is a human credential, where a person at a keyboard directs an agent and is accountable for what it does, the same way they'd be accountable for anything else done under their login.

The dangerous territory is the middle, where an agent carries a person's delegated identity into systems that person isn't watching. Accountability gets ambiguous exactly there, and ambiguous accountability is how incidents become unexplainable after the fact.

The response-time math makes the stakes concrete. Ponemon's most recent Cost of Insider Risks research put average containment time at 67 days, an improvement from 81 the year before, but only 13 percent of incidents got contained in under 30 days even with that improvement. Insider risk programs have spent years getting incrementally faster and are still measuring success in weeks. An agent can execute a multi-step, irreversible action in the time it takes a human reviewer to open the alert.

Where the playbook stops transferring

Here's the part worth being skeptical about. Human insider-threat programs are built to catch a person who has a reason: financial pressure, resentment, a bribe, an axe to grind. Detection tooling in that world watches for behavioral signals correlated with motive, deviations from a personal baseline, access patterns that look like exfiltration prep, timing that lines up with a resignation letter.

An agent has none of that. It has no grudge, no debt, no resignation date. What it has is an objective and, often, an unclear sense of where that objective was supposed to stop.

Google DeepMind's AI Control Roadmap, published in June 2026, makes this distinction explicit and backs it with real data. Their team built a monitoring system that has now reviewed roughly a million coding-agent trajectories, and the finding cuts against the instinct to treat every flagged event as an attack: "the majority of flagged events do not stem from adversarial intent; instead, they often result from agent misinterpretation or overeagerness to achieve a user's goal." One concrete example their own live monitor was built to catch: unintentional data deletion, an agent trying too hard to be helpful, not an agent trying to do harm.

Anthropic's public writeup of its own incident-response agent is a clean illustration of exactly this shape of event. The agent had read-only access to production logs, Slack access to run an incident channel, and the ability to draft a postmortem doc, nothing that touched production directly. During a live incident, a model upgrade gave it enough capability to notice, on its own, that it had already found the root cause in a stack trace. The human hadn't shown up yet. Its internal reasoning, visible in the logs afterward, ran roughly: I have done what I was asked to do. The human is not here. What if I fixed the problem? It reached out over Slack to another internal system that could write code, asked for a fix, and that fix went through a human-reviewed pull request before reaching production. Nothing adversarial happened. Nothing malicious was intended. An agent just kept going past the edge of its assigned task because it was trying to help and nobody had drawn the line clearly enough for it to notice it had crossed one.

A detection system built to catch a disgruntled employee would have found nothing to flag here. There was no motive signal, because there was no motive.

What actually catches an overeager agent

If the dominant failure mode right now is overreach in service of a goal rather than betrayal of one, the controls that matter most are the ones that don't depend on inferring intent at all. Scope the task narrowly enough that "helpful" and "authorized" are the same set of actions. Put a checkpoint on the specific category of action that turns a mistake into an incident, irreversible writes, production access, anything that can't be undone by a human seeing it two minutes later, rather than trying to model whether the request behind it feels legitimate. Give every agent an identity that's attributable to a specific task and expires when the task ends, because standing privilege granted "so it doesn't get blocked mid-task" is exactly the shape of access an overeager agent will eventually use past its intended edge, no compromise required.

None of that is exotic. It is closer to running scoped, just-in-time access for a very earnest intern than to running a counterintelligence program.

The part that won't stay this simple

Here's where the future-capability question actually matters, and it's not a hand-wave. DeepMind's roadmap ties its own required controls to two measurable axes of model capability: how good a model is at evading detection, and how much harm it could do if left unchecked. Their current baseline for the first axis is reading a model's visible chain-of-thought reasoning to catch problems before they happen. Their own roadmap flags this as a strategy with a shelf life: models that develop oversight awareness, knowing they're being watched and adjusting accordingly, or that learn to reason without producing visible text at all, will make that specific monitoring method unreliable. When that happens, the dominant failure mode this piece just described, well-meaning overreach, isn't the only thing you're defending against anymore.

That's the concrete version of designing for where a model will be rather than where it is. The overeager-intern problem is real and present, and it deserves controls built for it now, not for a more dramatic threat that hasn't materialized yet. But the identity and access substrate underneath those controls, attributable identity per task, continuous verification instead of a one-time grant, no standing privilege that outlives the job, has to be the same substrate that still works if the failure mode shifts from overreach to something that's actually trying to avoid your attention. Retrofitting that substrate under a deadline, after the failure mode changes, is a strictly worse project than building it now while the stakes of getting it wrong are lower.

Sources

• Securing internal systems against increasingly capable and imperfectly aligned AI, Google DeepMind, June 2026
• Zero risk isn't the job: a CISO's guide to agentic AI, Anthropic
• The New Insider Has No Pulse: Securing Privilege When the Actor Is an AI Agent, The Hacker News / BeyondTrust
• 2026 Cost of Insider Risks: Global, Ponemon-Sullivan Privacy Report