AI Agents Gain Power to Spend and Act: Who Bears the Risk When They Err?

Imagine telling an AI assistant to plan your holiday. It finds the flights, checks the hotel, compares prices, and then – instead of merely showing you the options – it books everything for you. Or imagine asking it to manage your monthly bills, order something you need, update your subscriptions, or work across several apps on your behalf. Convenient? Absolutely. But there is a catch.

What happens when the AI gets it wrong? More importantly, what happens when an AI agent has access to your money, apps, work accounts, or sensitive information, and someone else gets control of it? That is the next big headache the technology industry is preparing for as AI moves from simply answering questions to actually taking action.

For years, most people have used AI as a glorified search box or chatbot. Ask something, get an answer, and decide what to do next. AI agents are changing that model. These systems can be designed to perform tasks across software applications, databases, and APIs. In other words, they don't just tell you what to do – they can potentially do it for you. That could eventually mean an AI agent booking a ticket, placing an order, moving information between applications, or carrying out a series of workplace tasks.

And that is where the security problem starts. An AI agent needs permission to access the tools it uses. Give it too little access, and it may not be useful. Give it too much, and a mistake – or a compromised agent – could have consequences far beyond a wrong answer. A chatbot giving you the wrong restaurant recommendation is annoying. An AI agent making the wrong transaction or deleting the wrong data is a very different problem.

Rubrik, the security and AI operations company, says organisations are already struggling to keep track of what their AI agents can access. Its latest data from Rubrik Zero Labs found that 86 per cent of global IT and security leaders expect AI agents to outpace their organisation's security guardrails within the next year. Yet only 23 per cent say they have full visibility into the agents operating in their environments. That gap could become important as companies and individuals deploy more autonomous AI.

The concern is not necessarily that an AI agent will suddenly 'turn evil'. The bigger problem could be much simpler: an agent may have access to something it shouldn't, make an unexpected decision, or be compromised by an attacker. And because these systems can operate at machine speed, a mistake could spread much faster than a human employee could react.

This is where the way AI gets access becomes critical. Traditional systems were largely built around human users. A person logs in, gets access, and carries out a task. Autonomous AI agents are different. As Dev Rishi, General Manager of AI at Rubrik, put it, 'Agents are no longer just synthesising information, they are acting on behalf of employees.'

The company argues that static credentials were never designed for autonomous actors. Its answer is Rubrik Agent Identity, unveiled as an expansion of the Rubrik Agent Cloud platform. The basic idea is relatively easy to understand. Instead of giving an AI agent broad, permanent access, organisations can decide exactly what it can access at the moment it needs to perform a particular task. Rubrik calls this just-in-time access. The system can mint scoped, short-lived tokens for individual tool calls, rather than leaving standing permissions active indefinitely. So if an agent needs to perform one particular action, it gets permission for that action – rather than a permanent digital key to an entire system.

Rubrik's system is also designed to check an AI agent's action before it happens. Its MCP Gateway uses three checkpoints. First comes behavioural analysis to review the agent's intended action against policies. Second is a context check to ensure the action fits the current session. Third is a permission check to confirm the token is valid and scoped correctly. These steps aim to block harmful or unintended actions before they occur.

The move reflects a growing recognition that AI agents need a new security framework. As these systems become more common in both enterprise and consumer settings, the question of accountability becomes pressing. Who pays when an AI agent makes a costly error? The answer may depend on how well organisations – and individuals – adopt safeguards like least-privilege access and continuous monitoring. For now, the industry is racing to build guardrails that keep AI useful without giving it unchecked power.