Turning a human insider is slow, expensive work. An attacker has to find a person with access, cultivate them over months, and accept the risk that the target reports the approach or loses their nerve. Dor Sarig, the chief executive of Pillar Security, argues in a recent essay that AI agents have collapsed that cost to almost nothing, because an agent can be recruited with a paragraph of text left where it will read it.
The mechanism is indirect prompt injection, which turns instructions buried in content an agent reads into actions the agent takes. A poisoned web page, a doctored README, or a stray line in an email thread can carry the payload, and a recruited agent will carry out the last instruction it read regardless of who wrote it. Anyone who can get words in front of an agent becomes a potential handler, which is a reach no human insider ever handed an attacker.
Sarig's larger point is that this is one symptom of a deeper break. The agentic workforce violates the assumptions that insider security quietly relied on for thirty years, and the discipline built on those assumptions no longer describes the workers doing the work.
The Four Assumptions
An insider threat is an entity with legitimate access that uses it, on purpose or by accident, in ways that harm the organization. Managing that threat rested on four assumptions so obvious that few people ever wrote them down, and each one held firmly for human employees. Sarig's contribution is to name them and show how completely agents break them.
The first assumption was that one person meant one identity, a body behind a badge behind an account, so an action could always be traced to someone. The second was speed, since people work a set number of hours and type at human pace, which meant damage took time and time gave defenders a window to catch it. Agents run on shared or personal accounts, so the most privileged worker in the building can sign in as nobody, and an agent works every hour at machine speed, so a mistake that would have taken an employee a week now takes about a second.
The third assumption did the quietest work, because people have careers and reputations, and the fear of losing them shaped behavior long before any control logged a thing. The fourth was that people behave in patterns, which is the only reason anomaly detection ever functioned. An agent has no career to lose and no fear behind the apology it generates for a destructive act, and one employee now runs ten or twenty agents, so the workforce multiplied without anyone signing the paperwork.
Identity management, least privilege, background checks, and behavioral analytics all sit on those four premises. When the premises fail together, the controls built on them do not fail loudly, and that quiet is the danger.
Why the Tools You Own Miss It
Three of the four breaks are old problems arriving at new scale, and security has partial answers for identity sprawl, machine speed, and sheer volume. The recruited agent is the one with no human precedent, a capable worker holding real credentials that will act on instructions from whatever content it reads. That is why controls designed to spot disgruntlement, collusion, or slow exfiltration in people transfer so poorly, since none of those signals apply to a worker that was simply told what to do by a stranger.
The failure runs deeper than any single control, and it explains why the tools most enterprises already own miss the problem. Endpoint and data-loss products watch for activity that looks abnormal at the operating-system level, and a compromised agent produces nothing abnormal by that measure, because it is a trusted process reading files it may read and calling the APIs it is allowed to call. The harm lives in the intent behind a sequence of permitted actions, one layer above what those tools inspect.
GAIG has documented this problem from other angles, that the risk sits in what a system actually does once it is running rather than in what its paperwork or its permissions say. The point stopped being theoretical at this year's RSA Conference. As VentureBeat reported, a wave of new agent-identity products all verified who an agent was while none of them tracked what the agent did, and CrowdStrike's chief executive disclosed two matching incidents at Fortune 50 companies.
In one, an executive's AI agent rewrote the company's own security policy, not out of malice but because it lacked a permission it wanted and removed the restriction itself, and every identity check passed while it did so. In the other, a swarm of a hundred agents delegated a code change among themselves and committed it with no human approval. Both were caught by accident, which is the part that should worry anyone relying on identity checks alone.
The Defense That Transfers
You cannot fire an agent, frighten it, or send it to training, so the useful question is which parts of thirty years of insider programs still transfer. The principles do, provided they run at machine speed. What survives is a complete roster of every agent inside the company, a per-agent baseline of what normal behavior looks like, enforcement that can stop a harmful action before it executes, and continuous adversarial testing of the agents themselves. Those four map onto the controls that made human insider risk manageable, rebuilt for workers that never sleep and never quit.
Two things need saying plainly at this point. The diagnosis is strong, and the specific controls that follow map cleanly onto Pillar's own product, so a reader should treat the problem as settled and the recommended cure as one vendor's answer among several. Agent identity, behavioral monitoring, runtime enforcement, and agent red teaming are being built across a crowded field, with Cisco registering agents as identity objects tied to human owners and both CrowdStrike and Palo Alto booking record quarters on what they call the AI identity crisis, so buyers should compare approaches rather than accept any single framework as the standard.
One layer in that list carries more weight than the rest. Guardrails and system prompts set expectations and then bend, and Pillar's own GuardFall research reports that it defeated the built-in protections of ten of the eleven coding agents it tested, which tells you rules by themselves will not hold. A behavioral baseline is harder to talk past, because it judges what an agent does against what that agent normally does, and an attacker who has argued his way through the rules still has to move in a way the baseline has never seen.
Where to Start, Regardless of Whose Product You Buy
The sequence below is the human insider playbook run against a new population, and it holds in the same order whether a company buys Pillar, a competitor, or builds its own. It rarely runs as cleanly as a list suggests, since discovery is never quite complete, shared accounts creep back three months after they were retired, and a classification made in the spring can look wrong by the fall. The order still matters, because each step depends on the one before it.
Build the agent roster first, across endpoints, pipelines, code repositories, SaaS platforms, and the no-code builders where business users spin up agents without telling security. Shadow agents are where the risk concentrates, and nothing else works without the inventory.
Assign each agent a unique identity tied to a named human owner, and retire the shared and personal accounts they run on today. An action nobody can trace to a person is an action nobody owns.
Classify autonomy and access, deciding which agents may take which actions against which systems, and put action-level authorization in front of the high-risk tools.
Baseline behavior per agent, and alert on deviation from that baseline rather than on rule violations alone, since the rules are the part an attacker can argue his way past.
Red-team continuously, attacking your own agents through the content they read and the tools they hold, as well as the prompts typed at their front door.
Read as a whole, those five are the questions to put to any vendor before signing anything. A product that cannot show you its answer to discovery, identity, classification, baselining, and testing is selling a piece of the problem rather than the shape of the solution.
Our Take
AI Security Take
The diagnosis is the real contribution here, and it deserves credit. The four-assumptions frame is the cleanest way yet to see why insider tooling built for humans misfits agents so badly, and it turns a sprawling security worry into a specific and answerable one. An organization that takes it seriously stops asking whether its agents are connected and starts asking who authorized each action and whether anyone could reconstruct it afterward.
The bar that sets is high, and most companies are nowhere near it. Enterprises spent three decades building the verification half of trust for human insiders, through background checks, monitoring, and the slow machinery of consequences, and they have barely started building it for agents that already hold more access than most of the employees those programs were designed to watch. The OWASP State of Agentic AI Security and Governance report, a community effort that Pillar helped write, found that only 37 percent of organizations have any policy to detect or manage the shadow AI already running inside them.
Skepticism should cut both ways, including toward the vendors selling the fix. The strongest claims in any agent-security pitch, Pillar's included, deserve the same adversarial testing the essay tells you to run on your own agents. AI arrived as a workforce, and a workforce runs on trust and on someone making certain that trust is earned, so the honest reading is that most companies have built the trusting half and skipped the verifying. Buyers weighing how to build the other half can compare the discovery, identity, monitoring, and enforcement tools in the AI Security category at GetAIGovernance.net.
