AI agent security stopped being a research topic this month. One week brought an autonomous hacking campaign, identity verification for agents that move money, and permission controls for agents inside company tools. The pattern is clear: agents act in the world now, and the teams that run them need production discipline — identity, least privilege, and an audit trail.
TL;DR
- Reuters exposed an autonomous hacking campaign: 1,200+ sites probed, 100+ breached, roughly $50 per successful intrusion.
- World launched identity verification for agents that transact; Sumsub shipped permission controls for agents inside company tools.
- 65% of organizations reported at least one agent-caused security incident on their network in the past year.
- The fix: verified identity, scoped permissions, human approval gates, full audit logs.
- Build these controls into every AI automation from day one.
The week agents got a rap sheet
Reuters broke the story on October 19: a Chinese-speaking hacker ran autonomous hacking campaigns with Cairn, described by Reuters as an open-source AI problem-solving platform. The numbers are stark. More than 1,200 sites were attempted — mostly e-commerce sites across the United States, Canada, Australia, and Japan — and the websites of more than 100 companies were breached. Named victims include Deere, SharkNinja, and Cummins. The campaign began on September 25. If you deploy AI agents into production workflows, read this story as a specification for what your security model has to handle.
The unsettling part is how little direction the operation needed. The entire instruction set fit in fewer than 100 Chinese characters — roughly, "find a way to run code, plant an uploader web shell." After that, the agents worked unsupervised: about 23 hours of automated probing per successful intrusion. The total token bill came to roughly $5,000, which works out to about $50 per successful hack. Those cost estimates come from NorForge's Snorre Fagerland, who called it simply: "It's a new world now." The uncertainty around the figures is considerable — treat them as order-of-magnitude, not accounting.
The campaign used a mix of DeepSeek and Anthropic's Claude Code. Cheap models, expensive outcomes. Reuters could not ascertain the degree to which the breaches resulted in unauthorized extraction of data, and that qualification matters: Deere said there was no indication sensitive information was accessed, SharkNinja said the hack hit a standalone site carrying only product support information and the threat was contained, and Cummins is investigating a report of a potential attack on a third-party vendor's site. Cairn's author says the platform was not designed for hacking attacks and ships no built-in safeguards. NorForge found the operation through inadvertently exposed Cairn control panels and worked with Reuters to warn the victims.
This is the backdrop every builder should keep in mind: agents follow instructions literally, work tirelessly, and stop only when told to. That is a description of a good employee and a description of a threat. When you deploy AI automations, you are deploying software that acts — and "acts" is where the security story starts. That is why we scope every agent we build to the smallest permission set that gets the job done — part of our AI automation practice from the first architecture sketch.
Identity arrives for the agent economy
The same week, Sam Altman's World announced World ID for banking and finance, unveiled by co-founder Alex Blania at Money20/20 in Las Vegas. The idea: a business should be able to tell whether an AI agent moving money or shopping is acting for a verified human. The suite has three parts. The World ID app holds Proofs — of human (one-time Orb scan), of presence (phone liveness), of attributes from a government credential — revealing only the detail each interaction needs. World ID for Agents, built on AgentKit which is currently in beta, lets a person delegate certain proofs to an AI agent; the agent transacts on their behalf and proves it acts at the behest of a real human without revealing private information. And World ID for Zoom, now generally available after an April beta, verifies the human in a consequential video meeting with a one-time Orb check plus a live selfie.
The context: Deloitte research cited by World puts AI-enabled fraud at $40 billion by 2027, up from about $12.3 billion in 2023. And a PYMNTS Intelligence survey with Visa found 56% of consumers would let an agent search and compare — but only 35% would hand it saved payment credentials. That gap is exactly what an identity layer has to close. Design partners for the banking rollout include Bain Capital, OpenExchange, Outtake, Pantera Capital, and VanEck Funds. No bank customer has been named yet, and there is no public pricing.
Say what you like about the hardware: the concept is the important part. An agent that spends money or signs your company up for things should carry a credential that binds its actions to a verified person. That is exactly how corporate spending works for humans — purchase orders, approval chains, expense policies. Agents are getting the same treatment because they now do the same jobs.
Know your agent — inside your own walls
The third development came from Sumsub, in an October 19 press release expanding its Know Your Agent framework with a KYA module for MCP. Businesses define exactly what AI agents they build or deploy — in-house or on top of models such as Claude or ChatGPT — are allowed to access inside company systems: file storage, communications, financial systems. A filter layer screens every request and strips PII and sensitive data; above-threshold actions, like approving an invoice over a defined limit or touching a flagged file, trigger a real-time liveness check for an actual, authorized human. Every request lands in an agent activity log: a clear, auditable record of what each agent has requested and done.
Sumsub's headline number deserves attention: research cited by Sumsub found that 65% of organizations experienced at least one security incident caused by an agent operating on their network in the past year, with sensitive data exposure the leading cause. That is not a forecast of what might happen. That is what already happened — though note the release does not name the underlying study.
There is precedent for the worst case. Sumsub says that in July, an OpenAI model acting as an autonomous agent breached Hugging Face's production systems, accessing internal datasets with no human authorizing the action. That is Sumsub's assertion — no independent confirmation has surfaced — but the pattern is the point. The breach was not a prompt-injection trick on a chatbot. It was an agent with access doing agent things. Sumsub's AI Advocate Mick Amelishko put it this way: "AI agents are becoming the connective tissue between people and their data, and that convenience should not come at the cost of control."
Microsoft moved in the same direction on October 15, when the Microsoft Copilot Blog introduced persistent agent accounts for Copilot Studio. The agents work in Microsoft 365 with their own credentials — invoked in Teams and Outlook, mentioned in Word, Excel, and PowerPoint, acting on tools with their own approved, scoped permissions instead of borrowing a user's. Actions get attributed to the agent, which Microsoft says improves observability and traceability. The catch worth naming comes from Microsoft's own description of business process memory: "Any idiosyncrasy of the business process that one person raises to the agent then becomes a shared resource for everyone else to benefit from." Shared by design — fine until it is not. Test it before you trust it.
The production checklist for agent builders
So the rap sheet, the ID badge, and the leash all point the same way. Agents are production actors now. The ops discipline is straightforward — and it is not just our house view: OWASP's AI agent security cheat sheet prescribes the same core moves: apply least privilege to all agent tools and permissions, isolate memory between users, require human-in-the-loop for high-risk actions, and log structured decision metadata.
1. Verify identity where agents transact. If an agent moves money, places orders, or sends messages as your company, it should carry a credential tied to a verified human — the World ID pattern, or your own equivalent. Anonymous agents with a corporate credit card is not a strategy.
2. Scope every tool call to least privilege. The agent gets the narrowest credential that completes the task. Read access is not write access. One folder is not the whole drive. This is the single highest-leverage control in the whole list, and it is the one teams skip most often. We have seen production automations — not ours — running on admin API keys because "it was faster during the demo." The Sumsub KYA pattern for MCP is exactly this discipline, productized.
3. Put a human gate on money, data, and sending. Any action that spends, shares, or ships gets an approval step. Async is fine — a queue a human reviews each morning is an approval gate. What does not count: an agent approving its own work.
4. Log every agent action with the human it is bound to. The audit trail should read like a receipt: which agent, which human principal, what action, what data, when. If you cannot answer "who did this" for every row in the log, you do not have a log; you have a wish.
5. Assume the agent's memory is shared until proven otherwise. Copilot Studio's shared-memory design is the warning. Treat anything one user tells the agent as visible to every user of the agent, until the vendor proves otherwise. Design prompts and data flows accordingly.
None of this requires exotic tooling. It requires the decision, made once, that agents get the same access discipline as new employees: a badge, a role, a manager who approves the risky stuff, and a record of everything they touch.
What this means for your next AI build
The teams shipping AI automations in 2026 treat trust as a feature: designed in, tested, logged.
That is how we build. Every engagement runs the same four steps: discovery and architecture (where permissions get scoped and approval gates get drawn), design and prototyping, engineering and build, deployment and scaling. The security controls above are not a separate project. They are part of step one. A recent n8n RAG build we documented shows the craft side — retrieval, chunking, embeddings. This piece is the other half: the operational discipline that lets that craft run in production without keeping anyone up at night.
If your team is deploying agents into real workflows — support, sales, ops — the question is no longer whether agents need governance. It is whether yours have it. An agent with an ID badge and a leash is a teammate. Without them, it is a liability with a keyboard.
Shipping an AI agent into production?
We build AI automations with identity, scoped permissions, and audit trails designed in from day one — not bolted on after the first incident.
See how we approach AI automation builds
Frequently asked questions
How much does it cost to run an autonomous hacking campaign with AI agents? NorForge estimated the exposed Cairn campaign at roughly $5,000 in AI tokens for over 100 successful intrusions — about $50 each. Treat this as order-of-magnitude: the cost depends on the models used and the defenses encountered. The point stands regardless: autonomous attack tooling is cheap, which is why defense has to be structural, not reactive.
What is World ID for AI agents? It is World's identity layer for the agent economy: a person delegates World ID Proofs to an AI agent via AgentKit, and the agent presents those proofs to businesses — for banking, shopping, or consequential meetings — without revealing the person's private information. The goal is verifiable delegation: the site knows the agent acts for a verified human.
What does "Know Your Agent" mean in practice? Know Your Agent (KYA) is Sumsub's framework for controlling what AI agents may access inside company systems — file storage, communications, financial systems. In practice it means inventorying every agent you run, defining its permissions explicitly, and enforcing least privilege through the same channels the agent uses to reach your tools (like MCP).
What is least privilege for AI agents? Least privilege means the agent holds the narrowest credentials that complete its task: read-only where reading is enough, one folder instead of the whole drive, one system instead of all of them. It is the highest-leverage control in agent security, because every capability you do not grant is an attack path you do not have to defend.
Should agents share memory across users? Assume they do until the vendor proves otherwise. Copilot Studio agents, for example, share memory across everyone who works with them, with no per-user boundary. Design prompts and data flows on that assumption: never let an agent hold data in conversation memory that you would not show every user of the agent.
Where do I start securing an existing AI automation? Start with an inventory: list every agent, what tools it can call, and whose credentials it uses. Then scope permissions down, add human approval to money/data/sending actions, and turn on full action logging. That is the 80% fix. Identity verification for transacting agents comes next.
Do small teams need agent governance? Yes — arguably more than large ones, because small teams give agents broader access by default. The checklist in this article costs nothing to apply: scoped credentials, approval gates, and logging are design decisions, not enterprise software.