The agent is a user without a license

United Airlines has limited the use of third-party AI agents on its website, app, and through agencies and aggregators due to concerns about sharing credentials and potential violations of FAA and DOT rules. Only humans can declare that luggage contains no explosives, and AI agents cannot perform this task as they lack identity to answer when their actions are incorrect.

Amazon has blocked one AI agent, Meta's, while Walmart has integrated another into its workflow. The issue remains whether AI agents should be permitted or barred from systems they were not designed for.

The debate extends beyond whether to integrate AI agents or close them off, as even authorized agents can pose security risks. Amazon's Muse AI agent was blocked, Meta's AI agent was integrated with conditions, and Walmart faced similar challenges. The lack of a standard for agent authentication means every company must improvise, leading to varying decisions based on size and resources.

Recently, Forescout reported that AI discovery has compressed from months to days, making patching less of a defensive advantage. The focus should shift to who holds the session, with what scope, and who can revoke it. The SCKit campaign against ScreenConnect demonstrates how stolen sessions can be exploited, highlighting the need for per-session tracing and limited agent permissions with expiration dates.

To test an agent's scope, set up a local agent with read-only permissions on a test folder and attempt to write to the folder. If successful, the permission is improperly scoped, indicating a potential security issue. By implementing these measures, organizations can better control AI agents and mitigate risks associated with their use.