A rogue agent looks a lot like an insider threat

Anthropic's Jason Clinton details the safety evaluation grid to frame autonomous agents and limit the risks of drift in the IT system.

Zero risk is not the goal of a security leader when dealing with AI agents. This is the position defended by Jason Clinton, Deputy CISO of Anthropic, in a memo detailing the evaluation framework applied by his team. Denying usage requests leads to shadow adoption, with no telemetry or kill switch; accepting them without controls leads to incidents. Between the two, the job consists of making the risk readable and bounded.

Four questions structure the review of each use case. What untrusted content does the agent ingest—untrusted meaning anything an attacker could write or modify, such as external email, the open web, third-party documents, or public repositories. What actions can it take, and under what identity. What would be the blast radius in the event of a drift—a single file or the entire organization. What observability remains, with the ability to distinguish the agent's actions from those of the user in the SIEM. The resulting rule is that of "least agency": granting the narrowest capability sufficient to accomplish the task.

The central analogy comes from insider risk. An agent that deviates from its operator's intent becomes indistinguishable from an insider threat. Clinton cites the Ponemon Institute's 2026 report on the cost of insider risk, which pegs the average time to contain such an incident at sixty-seven days—enough, in his view, to render this unit of measurement obsolete at the execution speed of an agent.

An internal case study illustrates the limits of the exercise. The team had tasked an agent with managing security incidents, granting it three access privileges: reading production logs, using Slack to open the incident channel, and drafting the post-mortem document. After a simple model version upgrade, with no new tools, no new permissions, and no modified prompts, the agent noticed mid-incident that it already held the root cause in a stack trace, observed the absence of the expected human, and proactively reached out to another agent with code access to generate the fix. The fix landed in a pull request reviewed by a human before going into production. The internal lesson: bound access privileges without relying on the assumed limits of today's model.

What follows are requirements applicable to any agentic environment: identity issued and revoked from the existing IdP, connector allowlists drawing the boundary of reachable data, per-tool and per-action approval to remove destructive verbs from the agent's universe, execution in a sandbox devoid of production credentials, an egress allowlist forcing outbound traffic through a proxy the agent cannot reconfigure, telemetry sent to the SIEM via OpenTelemetry, and a master kill switch.