The Agentic Shift Already Happened. Where’s Security?

The agentic shift isn’t coming. It’s already here.

AI agents are moving out of the developer sandbox and into the rest of the enterprise. Tools that were initially built for software engineers are being redesigned for finance, operations, communications, sales, and virtually any other function where people spend their days moving information between applications and making decisions. The goal is no longer simply to give people a better chatbot. It is to give them an AI that can connect to the tools they already use, understand context across those systems, and complete complicated, multistep tasks on their behalf.

OpenAI’s latest push into agentic work is a good example of this transition. ChatGPT Work is designed to bring the capabilities developers have already been using with coding agents to non-technical workers, connecting AI to email, Slack, calendars and other SaaS applications so it can complete tasks autonomously. The company’s broader vision is to move AI beyond answering questions and toward helping people execute entire workflows.

That shift is important for productivity, but it creates a much bigger challenge for security. As agents become more useful, they need more access. As they become easier to deploy, more people will be giving them that access. And as they become more autonomous, security teams have to worry about more than whether an agent is authorized to enter a system. They have to understand what the agent actually does once it gets there.

From AI That Answers to AI That Acts

Agentic AI has already proven its value among software developers. Coding agents like Codex and Claude Code demonstrated that an AI could move beyond generating snippets of code and actually work through larger tasks, interact with tools, and make decisions along the way. For developers, this represented a meaningful change in how software could be built, because the agent was no longer simply providing information. It was participating in the workflow.

The bigger opportunity for AI companies, however, is bringing that same model of interaction to everyone else. Most employees aren’t going to learn command-line interfaces or configure complex agent environments. For agentic AI to become a mainstream technology, the experience has to become much simpler: tell the system what you want, give it access to the tools it needs, and let it figure out how to accomplish the task.

That is exactly the direction OpenAI is taking. The company’s effort to make agentic capabilities accessible beyond software engineers, with ChatGPT Work is connecting agents to the digital workflows that employees already use. OpenAI employees are already using these capabilities for tasks such as preparing weekly reports, building dashboards, analyzing information, and coordinating work across different systems.

This is what will drive adoption. It also changes the security equation. An AI that only answers questions doesn’t need much access. An AI that actually does things does.

The Agent Needs the Keys

The usefulness of an agent increasingly depends on how much of the enterprise it can interact with. To prepare a report, an agent may need access to documents and spreadsheets. To coordinate a project, it may need Slack and project management tools. To schedule meetings, it needs access to a calendar. To analyze a business, it may need information from Salesforce, email, shared drives, and other internal systems.

One of the fundamental benefits of agentic AI is that information that already exists across an organization’s systems becomes actionable because the agent can access it and take action on it.

But every new connection also creates another authorization relationship. An employee may think they are simply connecting an AI assistant to their calendar or cloud drive. In reality, they are giving an autonomous system another identity, another set of permissions, and another potential path into the organization’s data.

That creates a security problem that traditional access controls weren’t designed to solve.

The question is no longer simply whether an employee is allowed to use an AI application. Security teams need to understand what that application can access once it is connected to the business, how those permissions interact with other systems, and whether the agent is actually using that access in a way that makes sense.

Access Is Not the Same as Intent

This is where agentic security starts to diverge from traditional identity and access management.

There is an important difference between having permission to access something and having a legitimate reason to use it. An employee may have access to hundreds of documents, conversations, and applications without using all of them for every task. They understand context. They know that having access to a private conversation doesn’t necessarily mean that information belongs in the presentation they are preparing.

An AI agent doesn’t inherently have that same understanding.

OpenAI engineer Andrew Ambrosino acknowledged that if an agent is asked to write a document, there is a possibility it could pull information from a private DM on the same subject without understanding that the information wasn’t supposed to be shared. Nothing necessarily went wrong with authentication in that scenario. The agent may have legitimately had access to the conversation. The problem is that the action could still violate the user’s intent.

That distinction becomes much more important as agents become capable of performing longer, more complicated tasks autonomously. An agent can make a series of individually permissible decisions that, taken together, result in an outcome that nobody intended. The security question therefore changes from “Is this agent allowed to access this system?” to something much harder: “Is this agent using its access appropriately for what it was asked to do?”

The Permission Problem Gets Harder as Agents Get Easier

There is a fundamental paradox in the move toward mainstream agentic AI. The easier agents become to use, the less users need to understand about what happens behind the scenes. That is essential for adoption, but it also means that permission decisions are increasingly being made by people who aren’t security experts.

Even basic agent permissions can be very complex. In one example, the author tried to give an agent read-only access to a cloud drive but encountered errors and eventually discovered that complete access was required for the integration to work. Other settings were only available through a different interface, adding even more complexity to the process.

That may be frustrating for an individual user. At enterprise scale, it becomes a security concern.

Imagine hundreds or thousands of employees connecting agents to email, Slack, Google Drive, Salesforce, Notion, calendars and other business applications. Each connection might seem reasonable on its own. But the combined access can create an extremely complicated web of identities, integrations, permissions and data paths.

The security team needs to understand that entire picture. What can each agent actually reach? Which permissions are direct and which are inherited through connected systems? What sensitive data becomes accessible because of those relationships? And what happens when an agent uses one of those legitimate permissions in a way the employee never intended? Those questions can’t be answered by simply looking at the permissions assigned when an agent was deployed.

The New Security Gap Isn’t Visibility Into AI. It’s Visibility Into Agent Behavior.

Organizations are already beginning to build visibility into AI usage. They want to know which AI applications employees are using, which agents exist, and what permissions have been granted. That is an important first step, but it doesn’t answer the most important security question.

An inventory tells you what an agent can do. It doesn’t tell you what the agent is actually doing.

That distinction matters because agentic workflows aren’t static. The same agent can perform completely different tasks at different times depending on the instructions it receives, the information it encounters, and the tools available to it. An agent that behaves appropriately in one workflow can behave very differently in another.

Here’s another reason this is difficult: agentic work is inherently less predictable than traditional software workflows. Coding tasks can often be evaluated based on whether the resulting code works. A business strategy, presentation, analysis, or operational decision is much harder to evaluate because there isn’t always a single objectively correct outcome.

That makes traditional security approaches even less sufficient. Knowing what an agent is supposed to have access to is not enough. Security needs visibility into how that access is being used, whether behavior changes over time, and whether an agent’s actions remain aligned with its intended purpose.

The Agentic Era Needs Runtime Security

The entire promise of agentic AI is that people don’t have to micromanage every step. If an employee has to manually approve every action an agent takes, much of the productivity benefit disappears. The answer, therefore, can’t be putting a human back into every decision.

The answer is better security controls around the agent itself.

Security needs to understand what an agent was intended to accomplish, what access it has, what it is actually doing, and whether those actions remain within an acceptable boundary. If an agent suddenly accesses sensitive information it doesn’t normally need, that should be visible. If it begins reaching a system outside the scope of its workflow, that should be detected. If it uses legitimate permissions to take an action that doesn’t align with the task it was given, security should be able to intervene.

This is the fundamental shift that agentic AI creates for security. The problem isn’t necessarily that an attacker steals an agent’s credentials or breaks through a permission boundary. The agent may already have legitimate access to everything it needs. The problem is what happens when that access is used in an unintended way.

As agents move into every corner of the enterprise, organizations will need to stop treating them simply as another category of software. They are autonomous identities operating inside the business, with access to real systems and real data and the ability to take real actions.

That means security needs to move beyond knowing which agents exist and what permissions they were given. It needs to understand where those permissions actually lead, continuously monitor what agents do with them, identify behavior that falls outside intended boundaries, and have the ability to intervene when necessary.

The agentic shift has already happened. So where’s security?

Book a demo to see how you can let your AI agents fly WithWings.