New research from BeyondTrust Phantom Labs highlights the expanding security risks associated with autonomous AI agents, revealing that individual prompts can trigger multiple system commands while connections to external services increase the potential attack surface for organisations.
The growing adoption of Agentic AI is creating new challenges for enterprise security teams as autonomous agents gain access to systems, execute commands and interact with external services using permissions associated with human users.
New research from BeyondTrust Phantom Labs reveals the scale of activity generated by AI coding agents and highlights the potential security implications of allowing these systems to operate across enterprise environments without sufficient visibility or control.
The findings, drawn from endpoint telemetry collected through BeyondTrust’s True Privilege Graph, show that AI agents can generate substantial volumes of activity from relatively small numbers of user prompts.
Over a four-week period, researchers observed approximately 1.28 million shell commands requested by AI coding agents from around 132,000 prompts.
This represents an average of almost 10 command requests per prompt, demonstrating how a single instruction can result in multiple downstream actions.
The findings highlight an important distinction between what a user asks an AI agent to accomplish and the individual operations the agent subsequently attempts.
Although these figures do not establish that the commands were malicious or exceeded user intentions, they demonstrate why security teams need visibility into the actions performed by autonomous systems.
AI agents expand the enterprise attack surface
The research also identified widespread use of Model Context Protocol (MCP) servers, which allow AI agents to interact with external tools, services and data sources.
Among observed users with coding agents configured, 85% had at least one MCP server connection.
Connected users averaged 4.35 unique servers, while one user had connections to 36 servers.
These connections can extend an agent’s capabilities beyond its immediate operating environment, potentially allowing it to access multiple platforms and perform actions using permissions delegated by a human user.
However, this increased connectivity also introduces security considerations.
If attackers compromise an AI account, they may be able to exploit the agent’s existing connections to access other services without separately obtaining credentials for each platform.
MCP servers can also receive user prompts and influence agent behaviour through their responses.
BeyondTrust warns that insufficient visibility into these interactions could expose organisations to privacy and compliance risks, including the possibility of sensitive information being accessed or transferred through malicious or compromised servers.
For CISOs, the findings highlight the importance of understanding not only which AI agents are operating within an organisation but also which systems, services and information those agents can access.
Agent skills introduce additional risks
Another area examined by Phantom Labs involves the use of agent skills, which extend the capabilities of AI systems by providing additional instructions, workflows and executable code.
The research found that approximately half of agent skill installations were bundled within code repositories.
In one mid-sized enterprise environment, 60% of AI-active devices were running a coding agent.
Users with agent skills typically had approximately two dozen installed, while at least one in seven installed skills was used during the four-week observation period.
These findings demonstrate how AI agents can acquire additional capabilities through components that may not have been individually reviewed by security teams.
Because agent skills can contain embedded code and influence how agents interpret instructions, they can also introduce risks if compromised or malicious components are installed.
BeyondTrust warns that attackers are increasingly distributing malicious skills or attempting to compromise legitimate ones.
Without appropriate auditing and policy enforcement, organisations may struggle to determine whether installed skills are trustworthy or whether they could cause agents to perform unauthorised actions.
The findings reinforce the need to extend software governance and security assessment processes to the components used by AI agents.
Separating human permissions from AI agent permissions
Alongside the research, BeyondTrust has announced the general availability of AI Agent Security on its Pathfinder Platform.
The technology is designed to distinguish between actions performed by human users and those initiated by AI agents, enabling organisations to apply separate security policies to each.
This addresses a challenge associated with Agentic AI adoption: an employee may legitimately require access to sensitive systems or privileged operations, but an AI agent acting on that employee’s behalf may not need the same level of access.
BeyondTrust’s approach involves evaluating individual agent actions against security policies before those actions are executed.
This is intended to allow organisations to control AI agent activity without unnecessarily restricting the permissions employees need to perform their jobs.
Marc Maiffret, CTO at BeyondTrust, said: “AI agents are increasingly acting on behalf of employees, often with the same access as the humans using them. That dramatically expands who and what can exercise privilege, and when those agents operate autonomously and at machine speed, organizations need to control that privilege before an action is taken. AI Agent Security separates what the human is permitted to do from what the AI agent is permitted to do, so organizations can embrace the power of AI without assuming that everything a human is permitted to do should also be permitted for their AI agent.”
Visibility and control over autonomous actions
The new security capabilities are organised around three areas: visibility, intelligence and protection.
The visibility component is designed to identify AI agents operating across enterprise endpoints, including commercially available AI tools, internally hosted models, shadow AI deployments and temporary sub-agents.
This provides security teams with an inventory of agent activity across their environments.
The intelligence component distinguishes between human and AI-generated activity while collecting contextual information about agent operations.
This includes the identity of the human user associated with an agent, the device involved, the agent session, installed skills and MCP connections.
The protection component applies security policies to individual agent actions at runtime.
Where an agent requires additional privileges, the system can invoke just-in-time access controls or request human approval before allowing the action to proceed.
The approach is intended to help organisations establish more granular controls over autonomous activity rather than relying exclusively on detecting suspicious behaviour after it occurs.
Extending privileged access management to AI
BeyondTrust AI Agent Security is now generally available for Windows and macOS endpoints through the company’s Pathfinder Platform.
The technology was jointly developed by Phantom Labs and the team responsible for BeyondTrust Endpoint Privilege Management.
Its introduction reflects the increasing need to extend identity security and privileged access management beyond human employees and conventional machine identities.
As organisations deploy AI agents to automate software development, administration and other business processes, these systems may require access to sensitive information and privileged functions.
However, granting agents unrestricted use of human permissions can introduce risks, particularly when agents interact with external services or execute commands autonomously.
For CISOs, the Phantom Labs findings highlight the importance of establishing clear boundaries around AI agent capabilities.
This includes identifying where agents are deployed, understanding their access permissions, reviewing external connections and installed skills, and ensuring that privileged actions are subject to appropriate controls.
The research also suggests that conventional approaches to monitoring user activity may need to evolve to distinguish between actions initiated directly by employees and those performed by autonomous systems.
As Agentic AI becomes more deeply integrated into enterprise operations, maintaining visibility into individual agent actions and enforcing appropriate access restrictions will become increasingly important to managing cyber-risk.
The challenge for security leaders will be enabling organisations to benefit from AI-driven automation while ensuring that autonomous agents cannot exercise privileges beyond those required for their assigned tasks.
