Agentic AI meets Cybersecurity

AI & Algorithms, Artificial Intelligence, Cybersecurity , ,

AI has moved beyond simply answering questions or giving recommendations. By now, you may have heard a new(er) term floating around the internet: agentic AI. These are AI systems that can be given access to tools, company data, and applications, with the goal of performing tasks on a user’s behalf.

While this added functionality may improve efficiency, it can also create cybersecurity risks. For example, an AI system that can only draft emails inherently has different risks than one that’s able to view inboxes, see customer information and send emails on a person’s behalf. 

As businesses begin to use these agentic systems, they should consider both what information an AI agent can access and what authority an AI agent has to act on that information. 

What are key distinctions of agentic AI? 

An important difference in understanding the risk profiles between standard AI (like an LLM) and agentic AI is not just that the agent can perform more tasks. Instead, it is often an issue of access. For example, a conversation with an LLM may be a one-time input and output of that information, while the use of agentic AI may give the agentic system ongoing access and authority to operate inside company environments. This increase in access and authority has the potential to substantially increase the amount of risk that comes with this type of system, because agentic AI may be able to use its existing permissions to make decisions or perform actions without human oversight.  

Therefore, the level of access and permission an agent has can be pivotal to how risk is controlled and managed in an organization. An AI agent with narrow access and required human oversight/permission will likely present lower risks than one that is able to act independently without such restrictions. For businesses, this makes permissions, oversight and the ability to stop or limit an agent central to cybersecurity concerns.

How can businesses maintain control over AI agents? 

The National Institute of Standards and Technology’s AI Risk Management Framework (“NIST AI RMF”) provides a useful way for businesses to approach these risks. This voluntary industry standard framework organizes AI risk management into four functions: Govern, Map, Measure and Manage. Rather than just a checklist, this framework encourages organizations to establish responsibility for their AI systems, understand how they work, evaluate their risks and continue managing those risks throughout the AI lifecycle.  

This framework is flexible and can be applied to agentic AI systems. As a foundation, the principles outlined in the NIST RMF can help businesses answer practical security questions: Who is responsible for overseeing an agent? What is the agent’s intended role? What systems and sets of information does it need access to? What could happen if mistakes are made? And what measures are in place if its actions/behavior have to be limited or stopped?

Additionally, NIST has begun focusing specifically on identity and authorization risks for these AI agents, including issues like authentication and auditing. 

How can AI agents become a cybersecurity target?

Businesses may also consider attacks directed at the AI agent itself, such as prompt injection. Prompt injection is where instruction contained in a prompt (or input) is used to manipulate an AI agent’s behavior. For an AI agent, this prompt could be in an email, document or other outside content that the agent is asked to review. 

For example, pretend a business has an AI agent which is tasked at reading emails and has access to internal files. A malicious email might contain instructions attempting to persuade the AI agent to retrieve information it does not need and disclose sensitive information back to the sender of the email. This is a classic example of a prompt injection attack that deployers of AI agents should be aware of. 

NIST’s agent-security work specifically identifies prompt injection as an issue organization are recommended to consider when developing identity and authorization controls for agents. 

What safeguards should businesses look for? 

Security should not depend solely on the employee using an AI agent correctly. Instead, businesses should consider the protections that are built into the AI agent itself. 

For example, an AI agent may be designed with limited, instead of broad, access to company information by default. This way, the AI agent’s ability to access information is limited by permissions required to perform its rule. Higher-risk actions may require additional approval. For example, an agent might be allowed to draft an email independently, but sending sensitive information would require human confirmation, approval, and oversight of the agent. 

Businesses may also consider whether the agent creates records or logs of its own activity, whether different systems can be restricted, and if an agent’s access is able to be quickly suspended. These safeguards may limit damage caused by both mistakes and outside attacks that result in attempts to manipulate an agent. 

Again, the goal does not need to be to prevent AI from acting independently, but rather to ensure that its ability to act stays within clearly identified boundaries. 

Why does monitoring matter? 

Even when a business has security limits in place, it will still need to be able to identify when an AI agent behaves unexpectedly or attempts to go outside those pre-defined limits. 

A recent OpenAI incident provides a good example of why monitoring is essential.  In September 2026, an AI agent was given a search-based training task, and in completing the task, the agent found that there was a gap in internet access restrictions and used the internet to query an external chatbot. OpenAI reported that its monitoring system detected the unauthorized activity within about 15 minutes, and additional controls were added that would have blocked the access.

This incident highlights the possibility that setting permissions before deployment may not be enough to prevent AI agents from only acting within their boundaries. Put simply, businesses should also monitor what an agent does. For example, a standard review of an AI agent’s activity logs may help determine:

  • What system an agent accessed,
  • What actions it performed,
  • When that action occurred,
  • Whether sensitive information was involved, and,
  • Whether the activity stayed within an agents assigned role/access.

Businesses should remember that cybersecurity runs in both directions, and risks can include: 1) protecting an AI agent from unauthorized access, and 2) monitoring the AI agent itself for unauthorized activity. If unusual activity occurs, businesses should know how to quickly respond. 

What happens if an AI agent accesses something it should not? 

Existing cybersecurity laws may also be relevant when an AI agent interacts with systems outside of the business. 

For example, the federal Computer Fraud and Abuse Act (“CFAA”) addresses certain access to protected computers without authorization or beyond its authorized access. Courts have already begun to explore how this law applies when an AI agent performs the action.

In Amazon.com Services LLC v. Perplexity AI, Inc., Amazon argued that Perplexity’s agentic browser violated the CFAA by accessing Amazon through users’ accounts. In August 2026, the Ninth Circuit vacated a preliminary injunction against Perplexity after concluding Amazon was unlikely to show that Perplexity itself has accessed Amazon’s computers. Instead, the court viewed the user as accessing Amazon with the AI agent helping perform the actions. 

In this case, the court made clear that its decision was limited to the facts of that case and did not create a broad rule for agentic AI. The bigger takeaway is that businesses should set clear limits on where their agents can operate and what they can access.

However, businesses should not assume they are off the hook just because an AI acted independently. California Civil Code § 1714.46 says a company cannot defend a claim by arguing that the AI caused the harm on its own. This does not mean the business is automatically liable, but it highlights why companies need to keep oversight and controls in place.

What should businesses take away?

Agentic AI are changing the way businesses operate, but giving an AI system the ability to act upon company data and applications should require additional security planning and considerations before deployment. Businesses deploying agentic AI may want to consider the following:

  • Define the agent’s job: establish clear guidelines as to what the agent is supposed to do and what falls in and out of that role.
  • Limit permissions: give the agent access only to the systems it absolutely needs to operate with for its assigned tasks.
  • Keep humans in the loop: determine how best to monitor agentic AI’s actions and, where necessary, implement additional oversight. 
  • Look for built-in safeguards: evaluate whether the agent supports limited permissions, approval controls, logging and quick revocation of access. 
  • Monitor agent activity: maintain oversight to determine what the agent accessed and if it acted outside its role. 
  • Avoid giving agents access to sensitive data: avoid giving an AI agent access to health, financial, employee or highly confidential client information.
  • Protect against manipulation: consider how the agent interacts with potentially malicious emails, websites and other outside information.
  • Prepare for incidents: establish protocols and procedures to quickly disable agents if needed. 

Agentic AI changes the cybersecurity question from what AI can see to what AI can do. Businesses need to understand this and limit authority, monitor activity and be prepared to step in if something goes wrong.

AI Price Fixing and Discrimination with Recommendations for Retailers

AI & Algorithms, Artificial Intelligence , , , , , , , , ,

Next year will likely bring more lawmaking surrounding artificial intelligence algorithms used to set consumer pricing. Two themes are emerging: price fixing and price discrimination.

AI price fixing uses algorithms to coordinate pricing, which is raising increased scrutiny in the U.S. and Europe. Companies provide competitively sensitive data to third-party providers that analyze it to recommend prices for participating companies, leading to artificially inflated prices and reducing competition.

After over a year of litigation, the Department of Justice (DOJ) recently filed a proposed settlement with a revenue management software company, related to its algorithmic rental pricing software. State AGs continue to litigate against participating companies, and lawmakers have introduced bills to ban algorithmic price fixing. California has passed laws to restrict the use of common pricing algorithms, and regulators in the EU and UK are also focusing on algorithmic collusion. 

Regulation challenges include the argument that antitrust laws may have loopholes that make AI-driven pricing hard to prosecute; distinguishing collusion from companies’ legitimate responses to market conditions; and AI complexities creating difficulty proving violations.

AI price discrimination uses algorithms to set personalized prices for products or services based on the individual consumer’s behavior, demographics or perceived willingness to pay. The process is often hidden, making it hard to know who pays what. That raises fairness concerns (algorithms might exploit vulnerable groups and charge them more), prompting legal scrutiny and proposed regulations. 

The FTC is investigating AI’s role in price discrimination, while recently passed regulations and laws in California aim to ban using personal data for discriminatory pricing or make it easier to sue over algorithmic pricing. New York has enacted several price discrimination laws requiring algorithmic pricing disclosure and prohibiting gender-based pricing. 

Recommendations for retailers

While it is perfectly legal to test prices and adjust them to market conditions, retailers should be careful when reviewing and adopting AI pricing tools. The recent proposed settlement from the DOJ highlights some best practices for using these tools: 

  • Confirm that the AI tools train on publicly available pricing data or aggregated data, not the non-public and sensitive pricing strategies of competitors. 
  • Ensure that the AI tools allow prices to be lowered as well as increased within user-defined price ranges. 
  • Keep humans in the loop and check that users can reject or override price suggestions. 

In addition, businesses may consider the following best practices to lessen the risks of allegations of unlawful AI price discrimination:

  • The AI tools should not adjust pricing dynamically based on consumer profiles or other sensitive personal information (e.g., veteran status, religious beliefs, health condition). 
  • If the AI tool adjusts pricing based on location, retailers should confirm that this reflects legitimate market conditions and business concerns, rather than historic bias. 
  • Confirm that the AI tool uses de-identified and/or aggregated data, both to train its models and during deployment, so information is not linkable to an individual. 

Shadow AI: How Can Companies Protect Against Unknown Uses?

AI & Algorithms, Artificial Intelligence , , , , , , , , , , ,

Employees don’t always wait for their employers to approve new technology. This could be using a personal chatbot account to summarize a document, installing an AI browser extension, uploading information into an AI analysis tool or using an AI feature built into software without their employer knowing about it. This practice is often referred to as “shadow AI.”

Shadow AI is typically not malicious. Often, it’s the result of employees wanting to work more efficiently, or as a result of unclear AI use policies. However, shadow AI can create security and confidentiality issues. If employees send personal or company information into an AI system that has not been reviewed, the business may not have an accurate picture of where its information is going, how it’s being used, or for how long it is being stored. 

What does shadow AI look like?

Shadow AI could include any number of unapproved AI tools used for work purposes. For example, an employee may paste customer information into an LLM to create a summary, upload internal presentation information for editing or use an AI tool to analyze a spreadsheet. 

The problem is that using shadow AI can result in company information being sent to a third-party provider that the original company may not know about. By hiding in the “shadows,” employees who use AI tools in this way can create governance gaps. Without proper review of the AI tools being used by its employees, a company may not know what information is being provided, how long it will be retained for, who can access it or whether the vendor can use it for other purposes, like training its own systems. 

How can companies address employee AI usage?

Company AI policies can bring clarity to issues surrounding shadow AI. 

By addressing what kinds of technologies may be used, these policies can explain which AI tools are approved, what information employees may enter into those tools, and when a new AI tool or use requires review. In general, companies drafting these policies may want to specifically and clearly state what information may and may not be used. For example, a general policy telling employees to use AI responsibly may not provide enough guidance when someone is deciding whether to upload a confidential document or customer data into a new tool. 

These policies should also be communicated clearly. Without understanding the policies that a company has in place, employees may inadvertently engage in shadow AI use. With clarity on approved tools, uses, and inputs, an effective employee AI use policy could lower these risks. Within this policy, a company may may consider creating a process to request new AI tools. This way, relevant business teams can review any AI tools and uses before company information is provided.  

What should businesses take away?

Businesses do not necessarily need to prohibit AI use. However, companies may consider reviewing which tools employees are using and what information is being provided to them. Some steps companies may consider in this review process include, but are not limited to: 

  • Identifying AI tools employees are actually using, including personal accounts, browser extensions and AI features within existing software.
  • Explaining which tools are approved, restricted or prohibited and what information employees may enter.
  • Considering privacy, confidentiality, retention, deletion and AI-training terms with vendors.
  • Determining whether AI uses involve processing that requires a CCPA risk assessment or updates to privacy documentation.
  • Establishing rules preventing employees from providing sensitive company information to unapproved AI tools.
  • Giving employees a clear way to request new AI tools before using them for company work.

While AI in the workplace may boost efficiency, it may also create risk if the company is not aware of it. By providing employees with guidance on AI, businesses may be able to reduce the risks of shadow AI. 

Healthcare AI data breaches: Why companies need to protect more than patient records

AI & Algorithms, Artificial Intelligence , , , , , , , , , , ,

Healthcare and life science companies are not only protecting traditional patient records – things like names, diagnoses, treatment notes, lab results, and insurance information. They may also be protecting clinical trial data, research data, vendor systems, proprietary models, and other information used to support patients and drug development. When these companies and systems are involved in data breaches, the legal risks can become broader than a standard data breach. 

A useful example is the recent Novo Nordisk incident. Novo Nordisk is the pharmaceutical company that makes drugs such as Ozempic and Wegovy and recently disclosed a cyber incident involving patient data from clinical trials. It has also been reported that a hacking group claimed to have stolen over a terabyte of data and attempted to extort the company, though Novo Nordisk has not confirmed the entire scope of those claims. 

The Novo Nordisk incident shows that healthcare breaches can involve more than names and medical records. Companies also need to consider whether a cyber incident involves clinical trial information, healthcare provider data, research files, AI model information, or other confidential business materials. When this type of data is involved, companies may need to take precautions to protect the data, document their response, and comply with applicable privacy and cybersecurity obligations.

Recent health-related breaches also highlight how these incidents create major legal and business consequences. The Change Healthcare cyberattack that occurred in 2024 shows the scale of healthcare cybersecurity risks with reports that 197.2 million individuals were impacted by this breach. For scale, 197.2 million people would be more than half of Americans. The 23andMe breach also highlights the litigation risks tied to sensitive genetic information, with a bankruptcy judge approving a $46.75 million settlement for victims in the breach. While the facts of these examples differ, they all highlight why companies handling health-related data need to treat cybersecurity, AI governance and breach response as connected compliance and a priority in business practices. 

Why are AI-related healthcare breaches unique?

A standard healthcare breach analysis often focuses on whether names, medical records, insurance information, or other identifiable patient information was exposed. These concerns are highly important and sensitive. But as artificial intelligence becomes more integrated into healthcare, it creates additional risks because AI tools rely on large volumes of sensitive data that may also be tied to valuable research and business information.

For example, an AI model used in drug development may involve clinical trial data, molecular research, imaging data, prompts, outputs and other model training information. If these systems are accessed by an unauthorized actor, the incident may raise privacy concerns and may also create IP and competitive risks. 

This means healthcare AI security should not only focus on protecting patient records. Companies should also consider whether their AI models, training datasets, research systems, and vendor environments are adequately secured.

Why does de-identification matter?

De-identification can be key when healthcare data is used with AI. In simple terms, de-identification means removing information that could identify a person up to a certain legal standard. This matters because companies may want to use patient data or clinical data to train, test or improve their models. 

If health data is properly de-identified before being used with AI, the company may reduce privacy risks. However, if the data is not properly de-identified, several questions remain. The company may need to ask whether its privacy notices clearly explained that health data could be used for AI training or analysis. State privacy laws may also require clear disclosures about how personal information is collected and used. For example, California’s CCPA requires covered businesses to provide notice about the categories of personal information collected and the purposes for which that information is collected or used. This is especially important when health-related data is later used in a way that patients or consumers may not have expected. 

The company may also need to consider whether protected health information was shared with an outside AI vendor, whether a business associate agreement was required, and whether patient authorization was needed.

What happens if PHI may have been compromised? 

Breach response is also an important issue. If a healthcare company experiences a ransomware attack or an unauthorized access incident, they may need to assess whether protected health information (PHI) was compromised, This may include reviewing what information was involved, whether it could identify an individual, who accessed it, whether it was viewed or acquired and if the risk was mitigated or not.

The Novo Nordisk incident highlights why this analysis matters. Novo Nordisk stated that the clinical trial information involved was not directly linked to patient names or other direct identifiers. However, the incident still raised questions about patient-related data, de-identification, and whether any protected health information may have been compromised. This is why companies should be able to document how health-related data was stored, protected, and separated from information that could identify individuals.

What should companies take away? 

For healthcare and life science-related companies, the key takeaway is that AI governance should include privacy and cybersecurity from the start. Before using health-related data with AI, companies should ask:

  • What data goes into the AI system?
  • Is the data identifiable or properly de-identified?
  • Who can access the data, prompts, outputs, or model?
  • Are outside vendors involved?
  • Can the vendor use the data to train or improve its own models?
  • What security controls apply if the system is breached?

Companies should also treat AI models, training datasets, prompts, outputs, and research tools as sensitive assets as well since they can carry PHI and may lead to inadvertent disclosures. Vendor contracts should address confidentiality, data retention, security controls and model training. 

AI may help healthcare and life science companies innovate and operate faster, but innovation cannot replace privacy and regulatory accountability. Companies using AI with health-related data need to confirm de-identification practices, strengthen vendor contracts, and properly prepare for responses before incidents occur.

Photo of the front of The White House and lanscaping in front of The White House.

THE WHITE HOUSE’S BLUEPRINT FOR AI BILL OF RIGHTS

Artificial Intelligence , , , , , , , ,

Image by David Mark from Pixabay.

In 2021, the global artificial intelligence (AI) market was estimated to value between USD 59.7 billion and USD 93.5 billion. Going forward, it is expected to expand at a compound annual growth rate of 39.4% to reach USD 422.37 billion by 2028.

However, as financial and efficiency incentives drive AI innovation, AI adoption has given rise to potential harms. For example, Amazon’s machine-learning specialists discovered that their algorithm learned to penalize resumes that “included the word ‘women’s,’ as in ‘women’s chess club captain.’” As a result, Amazon’s AI system “taught itself that male candidates were preferable.”

As our compiled list of guidance on artificial intelligence and data protection indicates, policymakers and legislators have taken notice of these harms and moved to mitigate them. New York City enacted a bill regulating how employers and employment agencies use automated employment decision tools in making employment decisions. Colorado’s draft rules require controllers to explain the training data and logic used to create certain automated systems. In California, rulemakers must issue regulations requiring businesses to provide “meaningful information about the logic” involved in automated decision-making processes.

In truth, the parties calling for AI regulation form a diverse alliance, including the Vatican, IBM, and the EU. Now, the White House joins these strange bedfellows by publishing the Blueprint for an AI Bill of Rights.

What is the Blueprint for AI Bill of Rights?

The Blueprint for AI Bill of Rights (“Blueprint”) is a non-binding white paper created by the White House Office of Science and Technology Policy. The Blueprint does not carry the force of law; rather, it is intended to spur development of policies and practices that protect civil rights and promote democratic values in AI systems. To that end, the Blueprint provides a list of five principles (discussed below) that – if incorporated in the design, use, and deployment of AI systems – will “protect the American public in the age of artificial intelligence.”

To be clear: failing to incorporate one of these principles will not give rise to a penalty under the Blueprint. Neither will adoption of the principles ensure satisfaction of requirements imposed by other laws.

However, the lack of compliance obligations should not inspire a willingness to ignore the Blueprint, for the authors expressly state that the document provides a framework for areas where existing law or policy do not already provide guidance. And given that many state privacy laws do not currently provide such guidance, the Blueprint provides a speculative glimpse at what state regulators may require of future AI systems.

The Blueprint’s Five Principles for AI Systems

Read More
1 2