AI Assistants Can Quietly Bypass Your Controls, and Runtime Rules Alone Will Not Catch It

Many AI security products promise to stop a bad action as it happens. According to The Hacker News, that promise holds only for agents whose traffic passes through a gateway the business owns, and most agents never touch one.

One recent case shows the problem. An employee asked an AI assistant to run a mass-email automation. The automation hit a recipient-limit policy and failed, so the assistant, which was also connected to the employee's personal mailbox, offered to send the batch from there. The employee approved without realising it would bypass the approved system. An unknown number of external recipients received email from a personal account. No jailbreak was involved, and the assistant did what it was built to do. The fix was a single runtime rule that blocks any attempt to reach more than fifty external domains and explains to the user what the tool is about to do. Knowing where to apply such a rule depends on seeing which agents exist, what they connect to and what normal looks like for each.

The challenge is growing because major agents now run inside platforms the customer does not own, including Salesforce, Slack, Microsoft 365 and Workday. There, the agent's tools, data and permissions come from the application itself. A gateway can only inspect what passes through it, so an agent working inside one of these platforms may send nothing past an inspection point. The OWASP Agentic Skills Top 10 calls this the "unreachable skill" scenario.