# Security Experts Flag AI Agent Risks

A discussion about security in a post-AGI environment identifies agent authorization, prompt-injection resistance, rapid access revocation, limits on irreversible actions, and independent verification as key challenges as AI agents become more capable. Commenters frame these concerns as established identity- and access-management problems applied to a larger attack surface, emphasizing least privilege and tested security tools. The discussion names no government agency, solicitation, contract, or vendor, so it is a technical market signal rather than a specific procurement opportunity.

- For acquisitions involving AI agents, procurement teams can use these concerns to shape security evaluation criteria around authorization, least privilege, access revocation, prompt-injection defenses, and controls on consequential actions.
- Contractors offering agentic AI should be prepared to explain how permissions are controlled when agents delegate work, how access can be revoked quickly, and how important actions are independently verified.
- The discussion points to identity and access management as a relevant capability area, but does not establish a specific government requirement or compliance deadline.

**Jurisdictions:** federal
**Industries:** Information Technology
**Topics:** Cybersecurity, Artificial Intelligence
**Published:** November 07, 2026

### Key Quotes
> Mostly all answers are the same as before AI the tech is different but it's all about securing an API authn and authz.
> — Commenter (username not provided)

> When one agent hands work to another, how do we make sure permissions only shrink, never grow?
> — Original poster

### Sources
- [cybersecurity in post agi era](https://www.reddit.com/r/cybersecurity/comments/1xqe7hn/cybersecurity_in_post_agi_era) - reddit-cybersecurity