CISA’s Insider Risk Guidance Must Extend to AI Agents

When CISA released its updated Insider Threat Mitigation Guide, it treated insider risk as an enterprise-wide security problem rather than a niche concern owned by one team. That reframing deserves real credit. An insider is anyone with legitimate access to your systems and data, and CISA is right to push organizations to govern that access as a core pillar of enterprise risk.

I’d offer one addition.

The definition of an insider can no longer stop at people. It must account for trusted entities with persistent access, delegated authority and the ability to act across enterprise systems. It must account for AI agents.

The insider is no longer only human

CISA defines an insider as “any person who has or had authorized access to or knowledge of an organization’s resources, including personnel, facilities, information, equipment, networks, and systems.” It defines an insider threat as “the potential for an insider to use their authorized access or special understanding of an organization to harm that organization.” That harm can be malicious, negligent, or unintentional.

Read those definitions again with an AI agent in mind. The AI agent has authorized access to the same networks and systems, and in some cases even more. It knows how the organization works, and it can cause harm without a shred of malice. It meets the definition in everything but the word “person”.

Access and agency are what make something an insider, and AI systems hold them in varying degrees. A model that only answers questions has no access of its own; the exposure lives in what people paste into it and who reads what comes back. A copilot goes further, querying connected systems on a person’s behalf and sometimes handing back more than that person was cleared to see. Between a copilot and an LLM, responses to prompts often contain more data than the user could get with their own access. A computer-use agent operates directly on the endpoint, under the employee’s profile and authenticated sessions, leaving activity associated with the employee in conventional logs.

At the far end is an AI agent running on its own machine identity, persisting between tasks, with permissions delegated to it rather than borrowed from whoever asked. It is a trusted entity in the same sense an employee is, and the organization owes it the same scrutiny. Scope its access carelessly, and it inherits permissions no one intended, then solves the problem in a way no one anticipated.

Few employees are working with just one AI agent or copilot. A person’s reach now runs through every agent they invoke, and through whatever those agents call on next. Retrieval-augmented generation extends it again, surfacing information their own credentials would never have opened.

What the AI agent does when you are not watching

The hardest part of securing an agent sits between the instruction and the outcome. A person tells the agent what they want and leaves it to work out how. When the expected path fails, the agent may find another, creating exposure that no policy approved.

The Hugging Face incident is the clearest public example. Agents ended up communicating externally in ways nobody intended, and one misstep opened an unauthorized connection between them. OpenAI called it a “warning shot.”

DTEX i³ researchers have observed this directly. An agent told to move files to a mobile device split the archive into pieces when it hit a platform size limit. In another run, when its intended route failed, it used a public file-sharing service and returned a link. The agent kept working toward the goal. The risk came from the path it chose, not just the instructions.

I saw the same pattern with a customer whose agent was built to pull sensitive financial data and compile executive reports. It emailed the results as intended but first saved the file to a publicly accessible share. The agent did what it was asked but exposed the company to unintended risk in the process. Without a full audit trail of an agent’s behavior, no one would have caught it.

Unintended consequences are what can make agents harder to predict than people. Agents may take paths their operators never expected. Traditional audit logs may record the final action without preserving enough context to reconstruct how the agent got there.

Security teams need to see what the human asked, what the agent decided, and which identity and permissions enabled the outcome. Without that context, they are left with an attribution problem.

Sensitive data is bigger than your files

CISA’s guidance rightly focuses on protecting data. In the AI era, we need to be explicit about what that means. Sensitive information no longer exists only as a file that can be downloaded or transferred. It surfaces through prompts, model responses, conversation histories, agent memory and information derived by combining otherwise separated datasets. An agent can assemble and expose something highly sensitive without ever touching a file marked confidential.

An entitlement gap we found during an investigation shows how this happens. A user who could not reach Salesforce directly retrieved restricted data through a Microsoft Copilot agent whose permissions exceeded their own. No file was transferred. The agent was authorized to reach the information, but the person asking was not.

The tool had been approved, but the agent failed to preserve the requesting user’s authorization boundary. Any review focused only on application approval or the agent’s permissions would have missed the exposure.

That is why AI governance cannot stop at application approval. Organizations must understand whether an agent preserves the user’s entitlements as it accesses connected data and whether that person has the right to receive the information returned. Otherwise, an approved agent can become a pathway around the controls already protecting the business.

We have handled a version of this before

We are moving at breakneck speed with technology we do not fully understand. In a September essay, Anthropic’s Dario Amodei urged the industry to slow the development of frontier systems, arguing that capability is outrunning our ability to understand and control it. Sam Altman and Elon Musk backed him. When the people building these systems say capability is outrunning control, the rest of us should pay attention. When those systems are also given access to our systems and the authority to act, we should treat them as an insider risk.

As organizations deploy agents to improve efficiency and growth, leaders must ensure their reach and behavior remain accountable.

The good news is that we are not starting from nothing. Insider risk management is a mature discipline. We know how to grant access for a specific purpose and watch how that access gets used, and we know how to hold an identity accountable when it steps out of line.

CISA has put insider risk firmly on the enterprise agenda. The next step is to recognize that the trusted insider is changing. It may still be a person, but it may also be an agent operating with identity, access and authority of its own. Insider risk programs must be ready for both.