Your AI Agents Just Got Keys to the Building. Who Is Watching Them?

Most companies are hiring a new kind of worker. It does not need a desk. It does not sleep. It can read your files, send messages, and make choices on its own. It is called an AI agent. McKinsey says these agents could create $2.6 trillion to $4.4 trillion in value every year. That is a lot of money. But here is the catch. Eight out of ten companies say their agents have already done something risky, like looking at data they should not see. The agents are not evil. They are new workers who got the keys to the building on day one. This article is about how to be a good boss to them.

01 / What Is Changing

The AI stopped talking and started doing

For the last few years, AI was a helper that talked. You asked a question. It gave an answer. Then a person did the work. An AI agent is different. It does the work. It makes a plan, takes a step, looks at what happened, and takes the next step. Nobody has to click “approve” in between.

That is the big change. A chatbot that is wrong gives you a bad answer. An agent that is wrong takes a bad action. It can move money, send a file, or approve a request. Mistakes are no longer just words on a screen. They are things that happened.

McKinsey has a good name for these agents. It calls them digital insiders. Think about a human employee. They have a badge. They can open some doors and not others. They can hurt the company two ways: by accident, because they were trained badly, or on purpose, because someone tricked them. AI agents are exactly the same. Only now there are more of them, they work faster, and they talk to each other all day.

Here is the one piece of good news. Only one percent of companies say their AI is fully grown up. Everyone is early. That means you still have time to set the rules before the building fills up.

02 / The New Risks

Five ways a good agent goes bad

Your security team already knows how to protect servers, passwords, and people. Agents add five new ways for things to break. None of them need a hacker. Most of them just need two agents that trust each other too much.

Look at what these five have in common. In each one, an agent believed another agent, and nobody kept a record. That is the pattern to fix.

An agent that is wrong does not give you a bad answer. It takes a bad action.

03 / Before You Start

Three questions to ask before any agent goes to work

You would not let a new hire start before HR has a file on them. Agents deserve the same care. Ask your technology leaders these three questions. If they cannot answer in a minute, that is your first project.

1. Do our rules cover agents? Your security rules were written for people and software. Agents are a bit of both. Update the rules to say what an agent can touch, who approves it, and how an outside vendor’s agent is allowed to plug in. The law is catching up too. Europe’s AI Act, GDPR, and even New York City’s hiring law already have things to say about automated decisions. Plan for human oversight, data protection, and fairness now. It is cheaper than fixing it later.
2. Is every agent on a list? Pilot projects multiply like rabbits. Teams spin up agents to try things, and six months later nobody knows how many are running. Keep one list for the whole company. For each agent: what it does, what data it can see, which model it runs on, and which human owns it. Simple rule: if it is not on the list, it does not run.
3. Do we have people who know how to check? Agents get tricked in new ways, through the words you feed them. Your security engineers need to learn those tricks before you scale, not after. Find the gap between what you want to build and what your team knows how to protect. Then close it.

04 / While They Work

Four rules for the day the agents are running

Once the agents are live, the job shifts from planning to watching. Four rules cover most of it.

1. Every agent gets its own badge. Its own login. Its own permissions. The smallest set of doors it needs to do its job, and not one more. Vendor agents get the same treatment as your own. And add a filter on what goes in and what comes out, so a clever prompt cannot talk the agent into something unsafe.
2. Write everything down. Not just what the agent did, but why. The request it got, the steps it took, the choices it made along the way. When something goes wrong, you need the whole story. Without it, you are guessing. Review the records on a schedule to make sure each agent is still doing the job you gave it.
3. Watch the hallway. Agents talk to other agents more than they talk to people. Every one of those conversations should be checked, logged, and permissioned. The standards for agent-to-agent talk, like Anthropic’s Model Context Protocol and Google’s Agent2Agent, are still young. Do not wait for them to be perfect. Put your own guards in now and upgrade later.
4. Keep an off switch. Practice the bad day before it comes. What if an agent freezes? Goes off task? Gets hijacked? For each important agent, know how to stop it and what takes over when you do. Run agents in a fenced-off space with clear limits on what network and data they can reach. If one goes bad, you want to pull it out fast without touching the others.

05 / Conclusion

Trust is the floor, not the paint

The agents are coming whether you plan for them or not. The companies that win will not be the ones that move fastest. They will be the ones whose agents can be trusted, by customers, by regulators, and by the people who work there. Trust is not a feature you add at the end. It is the floor you build on.

So ask your team this week: How many agents do we have? What can each one touch? Can we turn one off in a hurry? Those three answers tell you more about your AI readiness than any demo. Nobody wants to be the first company in the agentic AI security case study. Act now, and you will not be.

This article interprets McKinsey & Company’s 2025 analysis of agentic AI safety and security for technology leaders. The examples are theirs. The plain-language reading is mine.