Artificial intelligence is becoming part of everyday work in more and more organisations. Employees use AI to gather information, draft documents and complete tasks more quickly. The possibilities become considerably broader, however, when an AI application can do more than provide answers and can independently open and edit files and execute commands. This changes not only how employees work, but also what the access rights and security measures an organisation has put in place mean in practice.
That was precisely the situation at one of our clients. An employee had started using an AI agent on his workstation. The application ran under a business account, and more colleagues were expected to use it in future. The organisation wanted to make use of AI, but had not yet established what this would mean for the security of its business information and systems. For Malenco, this was a reason to reassess the existing IT environment, this time in light of the capabilities of an AI agent that can act independently.
An employee has access. Their AI agent may have it too.
A conventional AI chat application generally processes information that a user deliberately enters or uploads. An AI agent on a workstation can go much further. Depending on the available features and settings, such an application can search files, edit documents, run scripts and access other systems. In doing so, the agent uses the permissions and connections available on the workstation. In many cases, a file server cannot distinguish between a file opened by an employee and the same file read by an AI agent acting on that employee's behalf.
This distinction matters more than it may initially appear. In many businesses, employees have accumulated access to a range of network folders over the years. Sometimes those permissions are broader than their current work requires. While employees mainly navigate files manually, such access rights often receive little attention. An AI agent, however, can gather and combine large amounts of information in a short time. An existing weakness in access management that has largely gone unnoticed can therefore suddenly have much greater consequences.
For this client, another consideration was that the IT environment extended beyond office systems. Process automation and camera surveillance systems were also present, protected through separate network segments and specific access groups. Some workstations had access to these systems for day-to-day tasks. When an AI agent is used on such a workstation, it is necessary to investigate whether it can use the same connections. The existing network security may function correctly from a technical perspective, while an application on an authorised workstation can still reach further than originally anticipated.
It therefore became clear that the assessment could not be limited to whether the chosen AI application was trustworthy. The workstation configuration, the user's permissions and access to other business systems also had to be considered.
The risks extend beyond information disclosure
Many discussions about AI security focus on confidential data reaching an external AI provider. This is an important concern, particularly when employees work with personal data, financial information or customer and supplier data. AI agents introduce a second risk, however: the application can also make changes to the environment in which it operates.
An agent with write access to a shared folder can, for example, overwrite documents or delete files. A command executed incorrectly can affect an entire folder structure. Where files are synchronised through a collaboration platform, unwanted changes can also spread quickly. This does not have to result from malicious behaviour. A misinterpreted instruction or an error in a generated script can be enough to disrupt business processes.
An AI agent can also be influenced by information it encounters while carrying out its work. A document, email or web page may contain hidden instructions intended to change the agent's behaviour. This technique, known as prompt injection, illustrates why an instruction that appears to come from a trusted user does not automatically lead to safe actions. The agent may, after all, process information whose content that user has not checked.
Extensions and integrations also deserve attention. AI agents can use additional software and external services to perform more tasks. This creates a dependency on software components that may fall outside existing application management arrangements. An employee who installs an extension independently may inadvertently enable new access to files, accounts or business information.
For the client, Malenco brought these risks together in an assessment covering confidentiality, availability, permissions, software integrations and the reliability of results. The aim was not to address every conceivable risk through a separate technical solution, but to establish which existing security measures provided sufficient protection and where additional agreements or restrictions were needed.
Set the boundaries before expanding use
As the use of AI agents was still limited to one workstation, the organisation had a relatively manageable starting point for putting security arrangements in place. Malenco recommended giving the agent access only to a designated local working folder and restricting direct access to network drives. This would prevent the application from searching or modifying large amounts of business information without a clear need. Malenco also recommended disabling features for executing code and using unapproved extensions.
Another important principle was that AI agents should not be used under accounts with administrative privileges or on workstations with access to sensitive process automation systems. The existing network segmentation would therefore remain part of the security approach. Malenco also recommended allowing only approved business AI accounts, requiring strong authentication and, where necessary, restricting other AI applications through the existing endpoint and network security controls.
The assessment also made clear that technical settings are only part of the solution. The organisation needed to define which information could be processed using AI, who could approve new applications or integrations, and how employees should check results before using them. This also requires attention to personal data processing, agreements with AI providers and the ability to establish retrospectively which actions have been carried out.
Malenco therefore proposed assessing the identified risks with the client in terms of likelihood and impact. The most important measures could then be prioritised and developed within the existing IT environment. The advice thus described both a proposed technical configuration and a way for the organisation to develop its use of AI in a controlled manner. Whether all the proposed measures have since been implemented falls outside the scope of this case.
New technology calls for a fresh assessment of existing security
This practical experience shows that introducing an AI agent does not necessarily require an entirely new IT infrastructure. The client already had network segmentation, endpoint protection, access management and data recovery provisions. These measures provided a useful foundation, but needed to be reconsidered in light of software that can act independently on a user's behalf.
This differs significantly from the usual introduction of a new office application. With an AI agent, what matters is not only which features the software offers, but above all which data, permissions and systems it can access from its workstation. An organisation that investigates this only after dozens of employees are working with different agents risks finding that access rights, data processing and application management have already developed beyond IT's oversight.
In this situation, Malenco was able to assess the risks before use was rolled out widely. This created room to explore the possibilities of AI while retaining existing security principles. The approach was to establish in advance the boundaries within which the technology could be used responsibly, rather than blocking it from the outset.
The main lesson therefore extends beyond AI. Any technological change can affect how existing access rights and security measures work in practice. Good IT management does not end with securing the environment as it is configured today. It also requires recognising in good time what new applications may make possible within that same environment tomorrow.
