Part One of “Life at the End of the Funnel – A Technology Bard’s Tale” by Jason English
Lately, you might have noticed I’m writing a little more about cybersecurity + AI these days than DevOps + AI or Integration + AI.
This was never my intention, as I have always liked following development and integration practices, but it just so happens that’s where the most froth is happening right now. Boards and execs are mandating the use of AI, and security teams, already understaffed and exhausted dealing with normal threats and mistakes, are now dealing with a 1000x bigger attack surface due to agentic AI.
Any employee who wants to get the AI performance edge over their peers that the slick TV commercials are touting should download an agent and start using one, give it root-level access to their machine, let it use their credentials on Gmail, SaaS logins, whatever.
I have even seen other seemingly tech-savvy analysts doing it. Maybe they think Claude makes them write better or organize their thoughts faster, or maybe they just like having Muse gather all of the communication every professional has ever shared with them with Meta – the world’s largest clearing house for behavioral and political profiling data.
Hell, we’re all using Gemini because we’re still using Google for searches, even if I would rather do without the AI sometimes and have better natural search results instead.
Even if you try having a corporate instance of Copilot or ChatGPT, are you sure the suggestions it is making aren’t IP taken from other companies’ posts and presentations that it was trained on? You could get sued for that.
Two things are for sure. Taxes, at least for us working people, and that trying to stand in the way of agentic AI adoption for security reasons may be seen as a blocker to the ambitions of the company, and heads could roll.
I’m saying casual, NOT causal, for a reason.
Agents are being informally introduced into your environment. If you simply try to “block by default” all such attempts, you are likely to end up with shadow AI or rogue agents – caused by human and agent determinism toward a goal.
Meaning, the employee (or the agent) that is asking for access this time, is going to try and get around whatever governance structure your company has set up, the next time.
Since we can assume there will be some rogue AI agent adoption, I’m talking about casual validation, not causal. You know, let them hang out, talk, try on some clothes, see if they are cool. Don’t let them into the inner circle until you know how they behave.
Your defenses should know well the behavioral profile of a non-human identity when a real customer signs up: How they start familiarizing themselves with the available controls, how their initial queries would be structured if they were motivated to do actual work for a customer or partner. Those patterns have a lot more in common with each other than you think.
Like UEBA used to profile human users versus human hackers, but on a whole new level, because it is all happening so fast, we can barely perceive the slight delays in activities and communications between agents.
A dressing room for agents
Speaking of heads rolling, the year was 1985. When I worked in retail at Merv’s, I stuffed my growing hair under a Lady Diana wig just like my older metal guitarist friend John who worked there taught me to do, so I wouldn’t get fired.
Since we mostly worked in Housewares, I wrote my first songs about that, they were really more like Weird Al renditions of metal songs, like this one set to The Scorpions “Rock You LIke a Hurricane”: ”Pick up a Heartland, and Blue Goose too / We’ve also got Dancing Bears for you… Porcelain! Buy a mini-hurricane!”
But sometimes, especially around Christmas, I would pick up extra holiday pay shifts in Casual Wear where they were busiest. With my clip-on tie, I had no fashion sense, so I was no good on the floor helping customers make decisions on clothes, so that meant they would make me stand outside the dressing room.
A customer would come up, show the 3 garments they were going to try on, then I would hand them a “3” tag to hang on the door. When they exited the dressing room, I would verify they still had 3 unpurchased garments, and then I would go fold or hang up the ones they didn’t want.
There were a lot more “oops, I left one in there” than you expect when the count came up short. No big deal, it happens, just go get it from the dressing room and/or remove the item you are already wearing under your regular clothes, and there’s no need for anyone to call Asset Protection or make a scene with a cop car rolling up.
You want calm in a retail environment, after all.
That makes me think: Instead of sending a suspicious agent to hell and blocking them forever, or allowing the agent to ascend unfettered into exploit heaven inside your enterprise, what if we could put the agent in a kind of purgatory?
How can security be casual, when it is so mission-critical?
Enterprises still want to prioritize customer experience over draconian security policies. Therefore, cybersecurity needs to be seen as an enabler for agentic innovation and customer utility, rather than a blocker. So the ability for agents to “try things on” is very attractive.
Since AI is really good at finding workarounds, you not only need to block known malicious behaviors, but you need a soft buffer to spot unknown behaviors, in order to reduce risk without interrupting legitimate business.
Different agentic security solutions have different kinds of dressing rooms. Some call them sandboxes, which is fine, but I don’t like that term because it doesn’t sound particularly safe to me. It conjures images of snotty little kids playing in and scattering about this dirty sand that has been there for years. Maybe there are a few cat turds in there.
A dressing room. You know, a place an agent can see what tools are available through a trial MCP server, try things on, and the company’s security agents can see what they emerge with, before they can check anything of significance out.
The dressing room can be completely “nerfed” with no real access to any company data, other than perhaps, a bunch of publicly known catalog items or fake API gateways. But that’s really more of a honey pot than a dressing room.
Or, it might be a softer border than that, with trial periods, rate limiting or only draft workflows enabled. Like a store full of samples they can grab, while significant orders require a certain number of seconds or minutes of delay, in order to reduce the potential blast radius of an unknown attack before it can be perceived.
If an agent fails the test, or changes its stripes somehow, you can move to the second phase of “probationary” agent containment, in a more secure location where security agents can gather evidence, validate and triage a threat hypothesis. That’s when you can escalate and get humans involved.
Just trying to help, with zero trust
Back at Merv’s, they renamed the Loss Prevention guy watching the security camera to Asset Protection, because it sounded a little friendlier.
Anyway, one time I was alone at the cashier stand near closing time and nobody was working the dressing room, and this lady came up with a wrinkled-up store bag. Then the phone next to the register rang. That had never happened before, so I said “One minute, please” and I picked it up.
Kevin, the Asset Protection guy, was on the case. “This customer is going to try to return some items. Be nice and you can offer anything else, but do not give her any cash. I’ll stay on the line.”
Indeed, cash was exactly what she wanted. I asked for a receipt, but she didn’t have one. “Sorry, I can’t offer a cash refund without a receipt. Would you like to exchange your items? How about a store credit? I can get started on that for you.”
We went around on this a few times. Eventually, she just threw down the bag and walked out. The bag had a couple random untagged garments in it, and a couple empty beer bottles.
One couldn’t assume the garments were stolen without proof and risk making a customer service scene. To Kevin, it would have been an acceptable loss of a little inventory, so long as the store didn’t part ways with cash. To the customer, me offering to take down their personal information to process a store credit was deterrent enough.
Looking back, it was a lot like the Zero Trust principles we strive for in cybersecurity today, except with the agent (me in this case) non-deterministically deciding what least access privileges actually meant.
The Intellyx Take
Times have never been tougher for understaffed and underequipped security teams. It’s scary enough to be faced with a host of external attackers using inexpensive automated agents and tools, much less internal agents that could have motives and goals that are not well-regulated by employees.
Enterprises are adopting agentic solutions with the best of intentions, such as offering better customer service, the best selection and customization capabilities, or competitive prices. Determining an appropriate agentic security posture for your particular organization isn’t just a matter of prevention, just like putting bars on the windows and a cop car out front of your retail store doesn’t make you seem easy to work with.
There are many excellent forms of sandboxing, environment simulation, and pre-production testing out there in software development and security fields. When it comes to production, we have to be ready for a future in which we have to both assume the best of intentions for our customers and employees, while still maintaining zero trust principles on the back end.
Soon enough, the holiday was over, the seasonal high-school shmucks like me were released, and the clearance tags were coming out. I climbed out onto the roof and looked north, where US75 receded over the dark, empty horizon beyond Plano, contemplating what future adventures lay outside the store for me.
Copyright ©2026 Intellyx B.V. As of the time of writing, none of the organizations mentioned in this article are Intellyx customers. Not a word of this article was written by AI. Image source: Adobe Express.
