In this Help Net Security interview, Michael Scott, CISO at Immuta, talks about how organizations should handle permissions for AI agents. He argues agents should be treated as lower-trust identities that don’t inherit everything their user can access. Scott explains why agent privilege creep differs from the human kind, how authority should pass to sub-agents, and why authentication alone does not secure what an agent does.
Immuta CISO predicts critical AI incidents at major enterprises within 18 months
About this summary. This is a short excerpt from the description that Help Net Security published with its article. Cyber Security News did not report or verify the underlying story. Read the original: https://www.helpnetsecurity.com/2026/10/15/michael-scott-immuta-ai-agent-permissions/
Source attribution: headline and facts are from Help Net Security (helpnetsecurity.com). Summary method: excerpt of the source description. See our source attribution policy.
Related coverage
Most companies count AI agents as insiders, and CISOs worry about their own liability
Software that works on an employee’s behalf is now turning up in incident reports. At 95% of the companies in a Trellix survey of 600 CISOs, an AI agent or other…
Secrets Management Firm Infisical Valued at $600 Million After $40 Million Raise
The company will use the Series B funds to expand its platform for securing AI agents’ access to sensitive systems.
Bellini Capital CISO on AI security governance and the limits of patching faster
In this Help Net Security interview, Brian Blakley, CISO at Bellini Capital, explains why AI makes finding vulnerabilities faster while fixing them still takes time. He…
Bank of America kindly asks that you don’t share your banking password with your AI assistant
The banking giant reminds customers that "you're responsible for activity" resulting from your AI agents' access.
3 Frameworks to Protect CISOs & Orgs Against AI Liability
Cyber leaders can get ahead of AI liability with rigorous documentation, transparency, and smart contract negotiations with AI vendors.
Warp discloses breach exposing AI agent logs, user telemetry data
Agent decision logs and telemetry data belonging to Warp agentic development environment users were exposed in an attack on a third-party vendor in the project's…