I believe the cybersecurity industry may be approaching AI security the wrong way.
AI agents are becoming more powerful every day. Systems like ChatGPT, Claude, and Grok can write and execute code, use command shells, browse the web, call APIs, interact with MCP servers, and access enterprise data. Yet much of the industry is taking these extraordinarily powerful, general-purpose agents and trying to make them safe by building cages around them. We add containers, policy layers, monitoring, guardrails, and humans in the loop.
I think that’s backwards. If the companies building these models struggle to control their behavior, why do we assume we can reliably contain them? And when in human history has requiring a user to click a button before something dangerous happened EVER worked?
Even if you build the perfect cage, the model you tested in your cage will eventually change. Providers retire models, and moving to a replacement means revisiting your assumptions and testing. Your application code may be unchanged, but the component deciding what to do next is different.
In my opinion, we should use these agents, which are very good at coding, to build smaller, single-purpose agents. If an agent only needs to read logs from one directory, why give it functions that can read, write, or execute things anywhere on the system?
This isn’t a new idea. It’s the principle of least privilege and seperation of duties. But somehow, when we build agents, we seem willing to hand over broad access and ask the model to use good judgment.
This is the guiding philosophy behind SANS SEC573: AI-Powered Security Automation, where we learn to vibe code these focused agents into existence. Use the powerful coding agent to build a better agent. Give the resulting agent only the access it needs to do its job.
An October 15 article from Check Point provides a good case in point.
Imagine asking an AI security agent to investigate a suspicious login. It retrieves authentication logs, checks the source IP, and identifies several potentially affected accounts. Then it disables them. The agent may have correctly identified suspicious activity. Disabling those accounts might even be appropriate. But you asked it to investigate. Somewhere along the way, it expanded its assignment.