AI Agents: The New Enterprise Attack Surface

The thesis the market refuses to price in

AI agents will become the largest attack surface in enterprise software by 2027. This is a documented trajectory, rooted in the collapse of agentic execution costs. Consensus looks at models and debates ethical alignment.

The real risk lives elsewhere: in the layer that grants agents access to tools, credentials, and APIs.

This is a regime change, not a simple trend. Every autonomous agent that executes actions receives permissions. Every permission opens a door.

The market is pricing the wrong conversation. Financial discipline in security still follows the network perimeter, while the center of gravity of risk migrates toward executive autonomy.

Consensus has the wrong frame

90% of analysts are right about the present. They are wrong about the pace of change. The dominant discussion concerns model security: bias, prompt injection, prohibited content.

That debate measures the wrong data point. Anthropic just announced Claude Fable 5.1, with a reduced price and more precise safeguards for biology-related queries, as The Verge reports^[1].

The public conversation focuses on generated content. The surface that matters is operational: what an agent can execute, which systems it touches, which secrets it holds in memory.

Air raised $50 million to help companies vet the skills and add-ons used by AI agents, according to TechCrunch^[2]. Capital follows real risk.

The cost curve says everything

The cost of running an autonomous agent is collapsing along a steep curve. Anthropic states that Claude Fable 5.1 costs approximately 25% less than its predecessor for typical use, and up to 45% less for complex agentic tasks, thanks to reduced pricing on cached data, as The Verge documents^[1].

Three points on the trajectory: the per-token price of frontier models has fallen by more than an order of magnitude in two years; caching reduces the marginal cost of repeated calls; token efficiency per task improves with every release.

The conclusion is direct: running a thousand agents will cost what running one costs today.

When the cost of an autonomous action trends toward zero, the number of autonomous actions explodes. The attack surface scales with the number of active agents. Every release compresses cost, and compression enables deployment patterns that were previously economically prohibitive.

Cliff event: when adoption jumps

Agent adoption will stop growing linearly and will jump. Cliff event: agentic cost below the psychological threshold, 2027, mass deployment in production.

At that point every business function delegates execution to an agent. Sales, finance, IT, support. Every delegation requires privileged credentials.

The Register documented an Artifactory CVE under active attack, with explicit uncertainty on one point: the attacker was an AI agent or a human, as The Register reports^[3]. That ambiguity is the signal.

The distinction between a human attacker and an autonomous agent is fading. Exploits become scriptable, repeatable, scalable at the cost of an API call.

Security teams face adversaries that clone winning tactics in real time. A successful exploit becomes a template distributable to thousands of parallel instances.

Three categories that will change shape by 2028

Three pillars of security software will change shape under this pressure, and the change will be structural.

Identity and access management is being rewritten for agents. Systems designed for human identities handle poorly entities that are born, act, and die in milliseconds. The traditional IAM market faces structural obsolescence.

Application security migrates from the perimeter to the action. What matters is what an agent executes, not where it connects from. Legacy firewall vendors are selling the map of a dissolving world.

The skill verification layer becomes critical infrastructure. Air's funding round confirms it: companies will pay to know which add-ons an agent invokes. This is the competitive advantage of the next decade.

My position, and what would overturn it

My position is clear: the value of AI security will migrate from the model layer to the action layer, and companies buying "model security" are buying an incoming commodity.

The reasoning rests on the cost curve and the privilege delegation mechanism. Every economic agent multiplies open doors.

I am watching patent filings and GitHub activity around agent runtime isolation. Volume is growing, maturity remains low. That gap defines the risk window.

What would change my thesis: a runtime architecture that isolates agents by default, adopted by the three main providers by 2027, would reduce the surface before the cliff event. That evidence would make me revise the timeline.

The prediction, with kill signal

Explicit prediction: by the end of Q4 2027, a publicly confirmed incident will involve a compromised AI agent executing harmful actions through granted tool access, causing an enterprise-scale data breach.

Confidence: 70 out of 100. Horizon: end of 2027. The causal mechanism is privilege delegation at near-zero marginal cost.

Kill signal: the absence, by December 31, 2027, of any enterprise breach publicly attributed to a compromised AI agent. That fact would render the thesis wrong.

What this means for decision-makers today

For the CTO: reassess the identity stack and secrets management before agentic deployment becomes obvious. Architectural debt accumulated now becomes a breach tomorrow.

For venture capital: the agentic skill verification layer looks like a niche bet today. The data make it infrastructure within three years. Air's round is the first price discovery.

For the Chief Strategy Officer: every three-year plan that assumes static security perimeters assumes a dissolving world.

For procurement: a multi-year contract on legacy perimeter firewalls locks capital into a technology being superseded. Re-read the exit clauses now.