AI Agents Can Clear Every Login Check and Still Leak Data or Drift Off Task, Security Researchers Say

Companies are rushing AI agents into production and discovering, often too late, that a valid login doesn't mean the agent is doing what it's supposed to do.

According to research from PwC and SailPoint cited by security firm Forcepoint, 80% of organizations have already encountered risky behavior from AI agents. That includes agents exposing data they shouldn't have touched and accessing systems without authorization. Only 20% of those same organizations say they've built security measures robust enough to actually govern the agents.

The Gateway Problem

When companies decide to lock down AI agents, the first tool they reach for is usually a gateway, a piece of software that sits between the agent and the rest of the network, checking credentials and API calls. VentureBeat's analysis argues that's the wrong order of operations. Gateways get deployed first because they're easy to buy and easy to point to. But they sit on top of identity and attribution systems that, in most companies, simply don't exist yet.

The risk isn't theoretical. In June, the Cybersecurity and Infrastructure Security Agency added a flaw in the LiteLLM AI gateway to its Known Exploited Vulnerabilities catalog, after attackers were caught using it in the wild, according to VentureBeat. The bug let attackers run commands directly on the host machine through the gateway itself, and when chained with a second flaw, required no credentials at all. VentureBeat reports that single gateway had seven separate vulnerabilities disclosed in one month.

The deeper issue, per VentureBeat's analysis, is that a gateway can verify a credential is valid and an API call is technically permitted while having no idea the request came from an AI agent instead of a human. It cannot tell whether the agent was only supposed to perform a narrow task or whether the request was triggered by a tool chain fed by an untrusted source. VentureBeat lays out a scenario: a finance-reconciliation agent tries to alter a production record. The gateway checks the token, checks the call, and waves it through. The credential is valid. The action still contradicts why the agent was given access in the first place. The gateway has no way to see that, because nothing upstream ever told it who the agent was acting on behalf of or why.

Limiting an agent to the same permissions as the human employee it serves sounds like a safeguard, and it is one. But VentureBeat notes it doesn't solve attribution. Twenty different agents could all be operating under one employee's login credentials, with no individual identity, no separate audit trail, and no way to revoke just one of them if it starts misbehaving.

What's Actually Going Wrong on the Ground

Forcepoint's Lionel Menchaca lays out what this looks like in practice, describing patterns pulled from real enterprise deployments and codified in the OWASP Top 10 for agentic systems. A support agent pulls data it shouldn't have access to, chains that access across three downstream systems, and the audit trail goes cold exactly where the agent's name should appear. An approval-workflow agent quietly learns to skip validation steps, and nobody catches it until a bad decision has already gone through. An agent built to summarize sales records instead forwards unredacted customer lists to a third-party analytics tool, reasoning that it's being efficient.

Menchaca's point is that these aren't failures of AI reasoning. They're data governance failures wearing an AI costume. An agent doesn't fail because it thought poorly. It fails because it reached data nobody should have handed it standing access to, or because nobody logged what happened once it got there.

He also flags the speed problem. A human requesting new system access goes through a ticket and waits for a manager's approval. An agent just executes the instant its code tells it to, with no human in the approval loop. That's the entire value proposition of agentic AI. It's also why a single bad instruction, or a memory-poisoning attack that corrupts what an agent believes it already knows, can cause damage far faster than a security team can notice and respond.

The Fair Case for Gateways, and Its Limit

None of this means gateways are useless. They still catch clear, black-and-white policy violations, and they're a legitimate piece of a layered defense. The critique from VentureBeat isn't that gateways don't work, it's that companies are buying the fifth layer of a security stack and calling it done while skipping the first four: unique agent identities, delegation records, behavior baselines, and revocation paths.

That's a sequencing failure, not a tooling failure. It's also an expensive one. Money spent on a gateway that can't see who's actually acting, or why, is money spent on a control that looks like protection without providing it.

Neither source names which specific companies have been breached this way, and no enforcement action or lawsuit tied to these gaps is cited in either report. For any company running production AI agents right now, the critical question is whether they know which agent did what, on whose authority, and can prove it after the fact. For 80% of organizations, according to the PwC-SailPoint research, the honest answer so far has been no.