Quick wins for a faster PC:
Clear out junk files and repair common Windows errorsFree Scan →Scan for outdated or missing drivers - takes under a minuteDriver Scan →Repair Windows errors before they cause bigger problemsFix Now →At least two major companies outside the artificial-intelligence sector could suffer a critical AI-related security or privacy incident within the next 18 months, according to Michael Scott, chief information security officer at Immuta. In an interview published by Help Net Security on October 15, 2026, Scott tied the forecast to companies deploying increasingly autonomous agents for productivity, competitive advantage and cost reduction before they have adequate controls.
What Scott is predicting—and what the number means
Scott’s statement is a forward-looking forecast, not a count of incidents that have already occurred or a published industry incident rate. He predicts that “at least two major enterprises outside the AI sector” will experience a critical AI-related security or privacy incident over the 18-month period following the interview. The forecast applies to large organizations adopting high-risk autonomous agents, rather than to every business using an AI chatbot.
As an Amazon Associate I earn from qualifying purchases.
The risk arises when an agent can interpret requests, call business systems, retrieve data or trigger actions with limited human intervention. Organizations may move quickly to deploy those capabilities while identity, authorization and governance processes remain designed for human employees and conventional service accounts.
The Tool Desk
Outbyte Driver Updater FREEFix the driver behind crashes, sound loss and screen glitchesFind Drivers →Outbyte PC Repair FREEClear out junk files and repair common Windows errorsFree Scan →Why AI agents create a different permission problem
Scott’s central recommendation is to apply least privilege to non-human identities. He says organizations should “start treating agents as lower-trust identities.” That means an agent should not automatically receive everything the employee who launched it can access.
#1 Best Overall
One agent may act for several people
A human employee usually works within a relatively stable role and set of permissions. An agent can serve multiple employees whose access rights differ. If the agent operates under a broad shared identity, one person’s request can expose data or capabilities intended for another role.
Agents can reach systems the user did not intend to target
An agent may call APIs, databases or connected tools while completing a task. Those systems can be technically available even when the human requester never intentionally sought them. Authorization therefore has to evaluate the specific operation and data needed, not just whether the user was authenticated.
Rank #2
Agents can create more agents
Delegation adds another layer. An agent can create or invoke a sub-agent, potentially extending the original permission set beyond the task the employee approved. Scott’s warning is explicit: “An agent shouldn’t be able to hand off all its permissions just because it’s handing off a task.”
Crashes, No Sound, or Screen Glitches?
Random freezes, missing sound and display glitches usually trace back to one bad driver. Find and replace yours safely.Free scan · under a minutePC Slower Than It Used to Be?
A free scan shows the junk files, broken settings and background clutter dragging Windows down - then fixes them in one click.Free scan · Windows 10 & 11How to limit an agent’s permissions
- Identify the operating identity. Determine whether the agent uses a dedicated identity or inherits the requesting user’s permissions. This is the first audit question because the answer defines the initial trust boundary.
- Grant only task-level access. Specify the minimum systems, records, fields and actions required for the current job. Do not treat a user’s full application access as the agent’s default scope.
- Make access expire. For delegated work, permissions should end when the task ends. Temporary credentials or narrowly scoped authorization grants reduce the chance that an old task leaves behind standing access.
- Constrain sub-agents. Pass only the permissions required for the delegated function. A sub-agent should not inherit the parent agent’s complete authority.
- Preserve the authorization chain. Logs should connect the final action to the sub-agent, parent agent and original employee request, including why the action was authorized. A service-account log that shows only the machine identity cannot establish who approved an action or the purpose behind it.
Authentication does not prove that access is legitimate
An agent can be correctly authenticated and still have no legitimate reason to read sensitive information for the task at hand. Authentication answers “which identity is presenting credentials?” Authorization must answer “is this identity allowed to perform this specific operation with this specific data now?”
Rank #3
Scott advises buyers to ask vendors to demonstrate that unnecessary requests are blocked, rather than merely recorded after the fact. Monitoring can reveal that an agent requested excess data, but prevention stops the disclosure or action before it becomes an incident. As Scott put it, “There’s a big difference between knowing what an agent did and being able to control what it’s allowed to do.”
Controls enterprises should require before deployment
| Control area | What to verify |
|---|---|
| Identity design | Dedicated, lower-trust agent identities instead of automatic inheritance of a user’s entire permission set. |
| Least privilege | Task-specific restrictions on data, tools and actions, with access removed when the task finishes. |
| Delegation | Sub-agents receive only the delegated task’s permissions and cannot pass through the parent’s full authority. |
| Traceability | A reconstructable chain from the final action back to the original employee request and business purpose. |
| Prevention | Controls block unnecessary requests instead of relying solely on after-the-fact alerts or logs. |
| Governance | Review before employee-built agents are published and approval before new integrations are enabled. |
What Immuta says it does internally
Scott described several safeguards used in Immuta’s own environment. The company operates a multi-model AI workspace with internally managed guardrails, reviews and governs employee-built agents before publication, and requires approval before enabling new integrations. It also provides ongoing AI training for employees.
These measures address different failure points. Guardrails constrain model and tool behavior; publication review examines an agent before it reaches users; integration approval limits the systems an agent can call; and training helps employees recognize unsafe delegation and data-access patterns. None replaces task-level authorization, but together they create multiple opportunities to stop an unsafe deployment.
Recommended Free Tools
A practical pre-launch checklist
- Document the agent’s purpose, data sources, tools and permitted actions.
- Assign a dedicated identity or otherwise prove that inherited permissions are narrowly reduced.
- Test requests for data that is irrelevant to the task and confirm they are denied.
- Test whether a sub-agent can obtain permissions it does not need.
- Set an expiry condition for delegated access.
- Verify that logs identify the original requester, every delegation step and the final action.
- Review the agent before publication and approve each new external or internal integration.
- Train employees on what agents may do, what they may not do and how to report unexpected behavior.
Why the forecast matters now
The prediction highlights a governance gap rather than a claim that AI itself guarantees a breach. Enterprises are connecting agents to valuable data and operational systems while many authorization models still assume a person or a fixed service account. Treating agents as lower-trust identities, enforcing least privilege at the task level and proving that unnecessary access is blocked are the controls most directly aligned with the risk Scott describes.
Frequently Asked Questions
Is Scott’s “at least two” figure an incident statistic?
No. It is his 2026 forecast for the next 18 months, not a historical count, survey result or published industry incident rate.
Should an AI agent use the employee’s existing permissions?
Not by default. The organization should first determine the agent’s operating identity and then grant only the data and actions required for the specific task.
What evidence should an agent-security vendor provide?
Ask for a demonstration that unnecessary data requests are prevented, delegated permissions expire, and investigators can trace a final action back through every agent to the original requester.
Free tools Windows power users keep installed
One-click scans. No signup required.
Quick Recap
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
