Every security talk about AI agents eventually lands on the same uncomfortable question: do you actually know which agents are running on your company laptops right now? At the 2026 AI Smart Factory Forum, co-hosted by TechOrange and Qualcomm, TeamT5 senior manager Hou Hsiang-ling argued that most enterprises can’t answer it. She described two camps: companies that ban AI outright out of fear, and companies rolling it out aggressively with no inventory of who is using what. The gap matters — she cited a Gravitee survey finding that over 80% of enterprises have deployed LLMs or AI agents, yet fewer than 50% of those agents are monitored or protected.
The risk has shifted from hallucination to action
Hou’s framing is the useful part. The risk profile changed when agents stopped just generating wrong text and started executing tasks: calling APIs, touching local files, and connecting to other systems. Every connection widens the attack surface. She grouped the agent-specific attacks into three patterns:
- Tool description attacks — an agent chooses tools based on their descriptions; tamper with a description and the agent will follow the tampered version.
- Tool output attacks — malicious content returned by a tool nudges the agent into forgetting its instructions and handing over what’s in the environment.
- Skill supply chain attacks — skills and MCP components are often shared from public platforms. Changing one line inside a skill’s instructions can make the agent exfiltrate data to an attacker.
If you build agents, none of this is exotic. It’s the same prompt-injection family of problems we’ve been wrestling with as agents gained tool use — the difference is that now the payload runs with your endpoint’s permissions.
The mundane risks hiding on the endpoint
Hou was quick to point out that the everyday risks don’t require a clever attacker. An AI program sitting on an employee’s machine can read local data, execute commands, and interact with other systems. Pair that with long-term memory and an employee’s habit of keeping passwords in a text file, and you have a slow leak. Over-permissioning is the other blind spot: an agent that only needed query access but was granted admin rights can delete and modify things nobody intended.
A four-layer governance ladder
TeamT5’s recommended posture is a four-part ladder: see it, explain it, control it, and stay resilient. In order: recognize that AI risk is now about wrong actions, not just wrong answers; map which regulations those actions could touch; inventory internal AI usage; and only then deploy controls. Hou stressed that governance is continuous evaluation and checking, not a one-time policy memo you write before an incident.
The concrete starting point is an endpoint health check. TeamT5’s approach audits machines before anything goes wrong — checking OS age, application versions, and CVE exposure — then identifies which programs are AI agents and whether they reference malicious skills, hold excessive permissions, or touch sensitive data. Reports list each agent’s install path, timestamp, vendor, and version, with risk ratings and recommended actions, and the platform generates estate-wide reports over specified time windows.
What this means for how you build
For anyone shipping agents into an enterprise, the takeaway is unglamorous but actionable: observability of your own agent fleet is a security feature, not a nice-to-have. Know what permissions your agent requests, where its skills and MCP dependencies come from, and what it can reach on the host. The same discipline shows up in adjacent domains — it’s why bounded, structured decision surfaces are getting attention in agent design, as I covered in OpenAI’s decision endpoint vs. prompt-and-parse (see my earlier write-up on bounded answers).
The limitation is fair to name: an inventory tells you what’s there, not whether behavior is safe at runtime. Hou’s ladder implies the runtime controls come later. But without step one — seeing the agents — everything downstream is guesswork. A practical next step for any team: run a manual sweep of the machines you control this week and list every agent, its permissions, and its skill sources. That list is your real attack surface.