It’s easy to picture an AI agent as one thing you switched on. It isn’t. On its own, an agent can only talk. Everything useful — and everything dangerous — comes from what you plug into it: the tools it can call, the systems it can reach, and the data it can read. You didn’t deploy one agent. You deployed everything it touches, wired together and handed to something that does what it’s told.
Those connections come in many forms, but three matter most — and each brings its own risk.
The tools it can call
Agents act through tools — increasingly delivered as MCP servers: a file tool, a “run a command” tool, a deploy tool, a search tool. These are the agent’s hands, and it’s where “helpful” turns into “dangerous” fastest. A tool that can run commands hands a hijacked agent code execution. A tool that can send mail becomes an exfiltration channel. And the agent trusts a tool’s own description as much as it trusts you — so a poisoned tool, or a compromised one pulled from a public registry, can feed instructions straight into the model. The tools are the agent’s power, and power is exactly what an attacker wants to borrow.
The systems it can reach
To be useful in your business, an agent connects to your systems — email, SharePoint, a CRM, a ticketing queue, internal APIs. Each connector is an identity with permissions, and here the common mistake is quiet but severe: the agent gets wired with broad access, often the builder’s own, “so it just works.” Now it can reach far more than any single task needs — and if it’s turned, it acts with all of it. That’s the confused deputy: a trusted component using privileges on behalf of someone who should never have had them.
The data it can read
Finally, the agent reads — documents, tickets, web pages, a knowledge base, a customer’s message. This is the most underestimated surface, because an AI agent cannot reliably tell the difference between information and instructions. Everything it reads is a potential command. A line hidden in a support ticket, a shared document, a web page it summarises — any of them can carry an instruction, and the agent will follow it using the tools and connectors above. The data is where the attack gets in; the tools and connectors are what make it hurt.
Three connections, one weakness that ties them together: the agent can’t tell data from instructions — so anything it reads can become a command, executed with everything it’s wired to.
The fix starts with least access
Most of this collapses under one discipline you already know: least privilege. Give every agent, tool and connector only the access its task genuinely needs — not the access its builder happened to have. A support agent that reads tickets has no reason to hold write access to your codebase. A tool that reads files should never be able to delete them. A connector should run with a scoped, dedicated identity, not a person’s broad one. Then treat everything the agent reads as untrusted data rather than instructions, and vet the tools you connect the way you’d vet any third-party code. None of this is exotic — it’s the security you already practise, pointed at a new kind of system.
You can’t secure what you can’t see
The catch is that no one can hold all of this in their head. A single agent might touch a dozen tools, several connectors and multiple data sources — each added by a different person on a different day. That’s why we’re building a scanner. Point it at an agent and it maps everything the agent is connected to — its tools, its connectors, the permissions it holds, the data it reads — and surfaces where the risk sits: the over-powered tool, the over-privileged connector, the untrusted source feeding straight into the model. It turns an invisible web of connections into a list you can actually fix.
That’s the work we do at Vantisec — make the whole surface of an agent visible, so least access is something you enforce instead of hope for.
If you’re putting AI agents into production and want to be sure they’re secure, reach out to us — AI and agent security is what we do.
Do you know everything your agents are connected to?
Vantisec maps the tools, connectors, permissions and data behind your AI agents — and shows you where to lock them down.
Talk to us