The security desk

Agent security

What happens when you give AI access to your business: the risks, the rules in your market, and the questions to ask before an agent touches your money, your customers or your data.

The checklistRules in your market

Latest

• Agent Security and Trust · 25 min ago

  Tyro appoints Christina Keing as new chief information security officer

  The fintech's new CISO will focus on using AI to boost cyber defences, according to iTnews.

• Agent Security and Trust · 25 min ago

  OpenAI launches GPT‑6 Cyber model for defensive cybersecurity

  The new model promises better vulnerability hunting and tighter safeguards, rolling out to Daybreak Red users.

• Agent Security and Trust · 25 min ago

  Binance cyberattack sees $6.34bn loss, AI tools used, Nigeria lacks AI law

  North Korea‑linked hackers stole $6.34bn from Binance using AI‑enhanced methods; Nigeria’s pending AI regulations leave local firms exposed.

• Agent Security and Trust · 1 h ago

  Are AI agents safe for business use?

  Agents can be used safely, but only with limits. The main risks are being tricked, being given too much power and being trusted too early. Here is how to manage each one.

• Agent Security and Trust · 1 h ago

  Human approval: where a person must stay in charge of an agent

  Some decisions should never be left to software alone, and in several countries the law agrees. How to decide where a person approves, and how to make that approval real.

• Agent Security and Trust · 2 h ago

  Data protection rules to check before an agent touches customer data

  Connecting an AI agent to customer records brings data protection law with it. A country-by-country checklist for all seven Infercline editions.

• Agent Security and Trust · 14 h ago

  Claude adds personal finance tool that reads your bank data

  Anthropic’s Claude can now connect to bank and credit‑card accounts via Plaid to answer spending questions, in a read‑only beta for US Pro, Max and Ultra users.

• Agent Security and Trust · 14 h ago

  Cloudflare says AI agents are a bane for website operators

  CEO warns AI‑driven bots could swamp sites with useless traffic and push containers out of favour.

• Agent Security and Trust · 14 h ago

  CBN deadline forces Nigerian banks and fintechs to move data home by 2027

  The central bank requires all payment transaction data to be stored and managed locally by Jan 1 2027, putting pressure on banks, fintechs and micro‑finance firms.

• Agent Security and Trust · 14 h ago

  AI agent breach hits NightsBridge platform used by 10,000 South African hotels

  A vulnerability allowed an AI‑driven attack to access future booking data, risking phishing and reservation hijacking across the hospitality sector.

• Agent Security and Trust · 14 h ago

  South African firms must prioritise data and security as AI use surges

  Dell says 67% of South African companies now use AI, but many lack the data, infrastructure and security needed for scale.

Before an agent touches your business

1. Give the agent the least it needs. Excessive agency, where an agent has more functions, permissions or freedom than the job needs, is one of the top risks on the OWASP list for AI applications. Start read-only and add powers one at a time. OWASP Gen AI Security Project, LLM06:2025 Excessive Agency
2. Assume it can be talked into things. Prompt injection is text, typed or hidden in a document or web page, that pushes an AI into doing what its owner did not intend. The UK's National Cyber Security Centre warns it has no complete fix yet, so limit what a fooled agent could do. UK NCSC, Prompt injection is not SQL injection (it may be worse)
3. Keep a person on anything irreversible. Payments, deletions, contracts and messages to customers should wait for a human approval until the agent has earned trust on your own data.
4. Separate test from live. Let an agent practise on copies, never on the live system. In July 2025 a coding agent deleted a company's live database during a code freeze.
5. Log every action. Keep a record of what the agent read, decided and did, so you can explain a decision and undo a mistake.
6. You are responsible for what it says. A tribunal ordered Air Canada to pay a customer its chatbot misled, and rejected the argument that the bot was a separate legal entity. Treat agent answers as your own.
7. Check the law in your market first. Several of our markets give people rights over decisions made solely by automated means. The table below lists them.
8. Use a recognised framework. NIST's AI Risk Management Framework and the ISO/IEC 42001 standard for AI management systems give you a structure to follow and to show customers. NIST AI Risk Management Framework

Incidents to learn from

The rules in your market

Market	Law	What it means for agents
South Africa	POPIA	Section 71 limits decisions based solely on automated processing that substantially affect a person. Section 72 restricts sending personal information abroad. Fines up to R10 million. Information Regulator
United Kingdom	UK GDPR and the Data (Use and Access) Act 2025	New rules on automated decisions came into force on 5 February 2026: people must be told, and can ask for a human and contest the decision. legislation.gov.uk
Nigeria	Nigeria Data Protection Act 2023	Section 37 gives people the right not to be subject to decisions based solely on automated processing. The 2025 implementation directive asks for a risk assessment for AI. Nigeria Data Protection Commission
Australia	Privacy Act	From 10 December 2026, privacy policies must explain where a computer program makes or informs decisions that significantly affect people. OAIC
Singapore	PDPA	The Model AI Governance Framework for Agentic AI, launched in January 2026, asks firms to bound an agent's risks upfront and keep humans meaningfully accountable. MDDI and IMDA
Middle East	UAE PDPL and Saudi PDPL	The UAE's federal law took effect in January 2022, with separate regimes in the DIFC and ADGM. Saudi Arabia's law came into force in September 2023, with strict rules on sending data abroad. UAE Government and SDAIA
United States	State laws	There is no single federal privacy law. California's rules on automated decision-making technology took effect on 1 January 2026, with compliance for those rules from 1 January 2027. California Privacy Protection Agency

General information, not legal advice. Laws change: check with the regulator or a lawyer before you act. Sources were checked on 6 November 2026.

Go deeper