Agentic copilots are inheriting overbroad permissions from the humans who deploy them

Audit data from 60 enterprises shows the average internal agent can read four times more than its owner needs.

Priya Raghunathan

AI Security Editor • 21 Jul 2026 • 6 min read

Abstract artificial intelligence pattern in blue and violet — Agent identities need their own lifecycle. Photo: Unsplash

Least privilege has not kept pace with the speed at which teams are shipping internal assistants. This story is developing and will be updated as our newsroom confirms further detail with affected organisations and responders.

#AI
#Least Privilege
#Governance

Abstract padlock rendered over dark blue server hardware

Cybersecurity

StormVeil ransomware crew pivots to ERP backup appliances in coordinated European campaign

At least 41 manufacturers across Germany, Poland and the Netherlands have been hit since 2 July, with the operators abusing legitimate backup agent credentials.

Mara Ellison29 Jul 20268 min read

Cloud

Misconfigured object storage exposed 2.3 million broker settlement records for nine weeks

The vendor says no evidence of mass download exists, but access logs covering the first four weeks of exposure were never retained.

Daniel Okonjo28 Jul 20266 min read

Abstract neural network rendered in cyan on a dark background

Prompt injection moves into the supply chain as poisoned model cards reach public registries

The payloads do nothing to human readers. They target the retrieval agents that enterprises now use to triage which models to adopt.

Priya Raghunathan27 Jul 20267 min read

Agentic copilots are inheriting overbroad permissions from the humans who deploy them

Related Stories

StormVeil ransomware crew pivots to ERP backup appliances in coordinated European campaign

Misconfigured object storage exposed 2.3 million broker settlement records for nine weeks

Prompt injection moves into the supply chain as poisoned model cards reach public registries