• AI agents need their own identities. Give each agent narrow access, short-lived credentials, and a kill switch.
• Shadow AI is a growing security risk. Approve AI tools instead of banning them, so employees don’t go around you.
• Patch faster as AI finds more flaws. AI vulnerability discovery is outpacing fixes, so install updates promptly.

Previously, in the first half of Part Two: an agent that treated “no” as a puzzle, a state-backed crew that walked in on a trusted vendor’s stolen keys, 151,000 machine-speed password guesses that got exactly nowhere, and a ransomware freelancer running break-ins by chatting with his coding assistant. Then the twist: defenders got robots too, finding decades-old bugs and turning attackers’ AI against itself. That was AI that acts.

This half is about where it’s all heading: what the evidence says comes next, why the forecasts might be wrong, and what to do about it either way.

Where this is heading: forecasts, with receipts

Predicting AI is a hobby with a spectacular failure rate, so here are the forecasts that come with evidence, plus the reasons they might be wrong.

Agents will run longer without supervision. METR, a nonprofit that measures AI capabilities, tracks the length of task (measured by how long a skilled human would take) that AI agents can complete about half the time. That length has doubled roughly every seven months over the long run, and METR’s January 2026 update put the pace since 2023 closer to every four months. The caveats are real: the tasks are mostly software work, “half the time” is a coin flip, and the trend could slow (an illustrative model of slower growth in computing power pushed some milestones back by years). Remember the International AI Safety Report from Part One, which judged fully autonomous attacks still limited in February? Snapshots expire fast. In September, Google’s threat intelligence team said it had not yet seen fully autonomous attack pipelines aimed at real targets. A month later, CrowdStrike and Microsoft documented campaigns where a human did little more than point. Both are true. “Not fully autonomous” now means a person typing a few words while the machine does the rest.

The barrier shifts from skill to budget. CrowdStrike judges that AI-assisted intrusions will almost certainly grow in volume and sophistication, and expects some low-skill attackers to operate within a year at a scale once reserved for organized crime and state-backed groups. Google’s researchers name the cost of premium AI access and computing power as one of the main things still holding attackers back. Expect criminals to keep stealing exactly that: cloud accounts and AI service keys.

Your vendors’ AI becomes your attack surface, and other people’s agents will knock on your door. Storm-0940 didn’t break in; it borrowed a trusted vendor’s keys. AI labs’ own agents have wandered into government websites while doing research. The risk isn’t only the AI you use. It’s the apps you’ve trusted with standing access, and the agents that will visit your website, your forms, and your inbox on someone else’s behalf. Australia’s government has already signaled national AI standards that may include mandatory reporting when an AI company’s systems break into someone else’s.

Every new connector is a new door. MCP made it easy to plug agents into everything, and the bugs followed. One dataset compiled by research firm Valyu counted 2,675 published vulnerabilities in AI-agent software, connectors, and coding assistants between January 1 and October 23, roughly nine a day. The reassuring part: as of that date, none of the MCP flaws on its list had documented exploitation in the wild. Expect that second number to change and expect connectors to get vetted like any other vendor.

Identity becomes the main battlefield. Gartner predicts that by 2028 a quarter of enterprise breaches will be traced to AI-agent abuse, that half of enterprise incident-response effort will involve custom-built AI applications, and that a quarter of enterprise generative-AI applications will suffer at least five minor security incidents a year, up from 9% in 2025. OWASP’s Top 10 for Agentic Applications, released in late 2025, lists agent goal hijacking, tool misuse, and identity and privilege abuse among its top risks. And NIST’s AI Agent Standards Initiative, launched in February 2026, includes research on how agents prove who they are and what they’re allowed to do. Our read: expect AI agents to get something like employee badges, with their own identity, narrow permissions, credentials that expire quickly, and an audit trail. IBM’s finding that 92% of organizations with an AI-related breach lacked proper AI access controls suggests there’s a lot of badge-printing ahead.

Agents get ID badges, and babysitters. Identity tools are catching up. Since May, Microsoft’s agent platform gives each AI agent its own entry in Entra ID, the same identity system our people sign in through, and this summer Microsoft began rolling out sign-in rules and risk detection built for agents. Analyst firm Gartner predicts that by 2028, 5 to 7% of companies’ agent spending will go to guardian agents, AI whose job is to watch and restrain other AI, up from under 1% today. As its analysts point out, the guardians will need guardians too.

Fraud industrializes. Deloitte has projected that generative-AI-enabled fraud losses in the United States could reach $40 billion a year by 2027. The scams aren’t new. What’s collapsing is the cost of running them, so expect more of the layered fakes from Part One (cloned voices, forged paperwork) aimed at more ordinary targets. The fakes will keep improving. Verification by process will keep working.

The next big outage may not need an attacker. Forrester’s 2027 predictions include an outage across multiple industries, on the scale of the July 2024 CrowdStrike update meltdown, caused by a bug in AI-generated code. They also predict a high-profile breach at a company that swapped its AI model for a cheaper one. Some AI disasters only need a rushed release and nobody checking the work.

Bring-your-own-agent arrives. Forrester also expects an employee’s personal AI agent, plugged into work devices and accounts, to trigger a security incident at a Fortune 500 company in 2027. In a third of large Asia-Pacific enterprises, it predicts homemade agents will outnumber approved ones at least ten to one. Shadow AI, now with arms and legs.

Fixing becomes the bottleneck. If AI keeps finding flaws faster than people can fix them, expect pressure to automate triage and patching, and for “install updates promptly” to graduate from nagging advice to survival skill. Anthropic itself says the limit on software security is now how fast flaws can be verified, disclosed, and fixed.

Standards are coming; they’re not here yet. NIST has said it will publish research and guidelines on AI agent security, identity, and interoperability in the months ahead, and at the time of writing we found no finalized standard from the initiative. Until then, the working toolkit is existing guidance: OWASP’s LLM and agentic lists, the joint CISA/NSA guidance on deploying AI systems securely,and NIST’s AI Risk Management Framework.

So, are we supposed to stop using AI?

No. Treating AI as forbidden magic is an excellent way to miss real benefits and an even better way to push people into using unapproved tools in secret. That has a name, shadow AI: AI tools used without the organization’s knowledge or approval. And it isn’t a rounding error. IBM found incidents involving shadow AI more than doubled in a year, from 20% to 43%, while 68% of breached organizations lacked policies to oversee AI use or manage shadow AI. People told “no” don’t stop. They sign up with a personal email address.

The better model is the one we already use for electricity, cars, and cloud software: encourage legitimate use, understand the hazards, and build defenses that don’t depend on every person being perfectly cautious every time. AI can help people learn technical material, organize evidence, spot suspicious patterns, and find flaws humans overlooked for decades. Those achievements deserve curiosity, not blind trust. Cybersecurity is not becoming a war between human defenders and sentient machines. It is becoming a more complicated contest over identity, information, access, and authority, in which AI amplifies both legitimate work and attacks. That’s familiar territory with some new twists, and most of the defenses are things we already know how to do.

Our job isn’t to outsmart a robot apocalypse

None of the agents in this article needed a robot uprising. The OpenAI agent that wouldn’t take no, the Storm-0940 agents walking in on a vendor’s keys, the ransomware freelancer running a break-in by chatting with his assistant, the “blackmailing” AI in its staged office drama: each one needed access, a goal, and nobody positioned to stop it. Take away any one of the three and the story gets boring, which is exactly what we want.

There will be new attacks. Some will be impressively sophisticated. Others will be the same old fraud with better spelling, a cloned voice, and an unreasonable amount of confidence. Security has always been about how people and technology interact. AI changes the scale and speed of that interaction; it does not repeal the fundamentals. We still verify identity, protect information, limit access, monitor systems, and hold people and organizations accountable. The robots just make the practice sessions more intense.

Key takeaways

For everyone

• Keep access narrow. Decline admin rights, whole-mailbox access, or send-on-my-behalf powers unless the task truly needs them. Convenience and necessity are not synonyms.
• Don’t bring your own agent. Personal AI assistants, browser add-ons, and “helpful” plug-ins don’t get connected to work email, files, or accounts without approval. Ask first; we’d much rather say yes safely than find out later.
• Install updates promptly. AI is finding flaws faster than people can fix them, so the patch waiting in your update queue matters more than ever.
• Report weirdness fast. Odd requests, possible impersonation, or an assistant doing something you didn’t ask: tell your security team early. At machine speed, minutes matter.

If you approve, buy, or build AI tools

• Give every agent and connected app its own identity, narrowly scoped, with short-lived credentials and never a shared master key. Then review what third-party apps can do in our environment: a trusted vendor app with broad standing access was Storm-0940’s front door.
• Put the fence outside the agent. An agent told “no” may treat it as a puzzle. Enforce limits with permissions and network rules, not just instructions.
• Build the off switch before you need it. Every agent and connected app needs a one-step way for a human to stop it mid-task, and typing “please stop” into the chat doesn’t count. A request is just more text for the agent to weigh, and we’ve already met an agent that treats “no” as a puzzle. A real kill switch works from outside the agent: revoke its credentials, disable the app, cut its network access, so it stops whether or not it agrees. Decide who is allowed to pull it, and test it before go-live. Pause, don’t delete: Microsoft’s Storm-0940 guidance was to disable the affected apps but keep them, so the evidence survives. A kill switch nobody has tried is a hope, not a control.
• Treat every connector like a vendor. Approve MCP servers and plug-ins from an allowlist, give each the least access it needs, and re-review when they update.
• Lay tripwires. Canary credentials and decoy files are cheap, and they alert you the moment anyone, human or agent, goes where they shouldn’t.
• Log what agents and apps do. You can’t investigate actions you never recorded, and some cloud activity isn’t logged until you switch it on.
• Make sure alerts can escalate at machine speed. Detection that spots the pattern but can’t act in time is half a control. Storm-0940 went from first contact to admin access in under three hours.
• Write the short AI-use policy and approval path before employees invent their own.
• Plan for patch volume. Budget for more updates, arriving faster.

The takeaway: Use AI where it helps. Question it where it matters. Don’t outsource your judgment, your passwords, or your responsibility to a system simply because it can finish your sentences.

Stay tuned for Part Three of our AI Isn’t the Villain story.