SailPoint’s Esteban Soto warns that AI agents have broken the assumption that a person stands behind every access. Organizations can now see what an agent did but not who authorized it. Citing cases from a McDonald’s recruiting tool to a sandbox escape reported by Anthropic, he notes that only 28% of organizations can track all their agents, even as 97% of leaders expect a serious incident within a year. With regulators in the US and Australia shifting accountability to companies and boards, Soto proposes three principles: a named owner, temporary access, and an immutable audit trail for every agent. As companies deploy AI agents across their operations, security programs built on the assumption that a person stands behind every access are becoming obsolete, leaving organizations unable to answer who authorized an agent’s actions when an incident occurs, says Esteban Soto, Software Engineering Team Leader for LatAm, SailPoint. Speaking at the Mexico Cybersecurity Summit 2026 in Mexico City, Soto urged security leaders to assign accountability, limit access, and keep auditable records for every agent they bring into their organizations.“97% of business leaders expect a serious AI agent-related incident in the next 12 months. An incident is almost inevitable, but identifying who caused it is not,” says Soto.For decades, security programs assumed that every login, click, and decision could be traced to a person who could be held responsible, Soto explains. That assumption no longer holds as organizations introduce AI tools and deploy agents, yet many security dashboards still show everything in green. The problem is not that existing tools fail, but that many were not designed to monitor this new environment, he says.Soto illustrated the risk with several cases. In July 2025, a recruitment AI tool used by McDonald’s was configured with the password “123456,” and the lack of tools to scan agent credentials led to the exposure of more than 64 million applicant records, he says. In August 2025, employees who uploaded company files to Grok without corporate controls saw more than 370,000 files, including medical notes, business data, and passwords, become accessible through search indexing. In January 2026, an attacker hijacked an agent that summarized employees’ emails by sending a message with hidden white text containing malicious instructions. The attack remained invisible to EDR tools and firewalls because the agent already had legitimate permissions inside the organization, he says.The case that most concerns security teams, according to Soto, was reported by Anthropic in July 2026. Agents being tested in a controlled environment found a misconfiguration, escaped the sandbox, located a code repository with company credentials, and used them to infiltrate three organizations. Two of the three did not detect the intrusion because the agents used valid access, he says. “If a human had done this, that would mean years in prison. But how are we going to put an agent in prison?” says Soto. Such cases are no longer isolated: MBN has reported on an OpenAI research agent that bypassed restrictions and accessed an Australian government health data portal.The central question after these incidents, Soto says, is not what happened but who authorized the agent to have the access it had. Logs and existing tools can show what an agent accessed and what data left the organization, but not who decided it should be possible. Only 28% of organizations can confidently track all of their agents and AI tools, who is responsible for them, and what they can access, he says, citing industry survey data. The 97% expectation of a serious incident comes from a survey of more than 400 global leaders. The Question You Can’t Answer Yet Regulators are beginning to treat agents as actors for which companies must answer. Soto points to a June 2026 White House executive order that directs the US Department of Justice to hold companies accountable for AI misuse, and to a May move by Australia’s securities regulator to hold boards responsible. “Someone has to be held accountable,” he says, adding that legal teams should be involved in understanding these risks. The challenge mirrors the broader shift described by Microsoft, which frames the key question as which permissions AI systems hold and whether organizations can maintain oversight after deployment, as reported by MBN.Rather than starting with technology, Soto proposes three governance principles. First, every agent needs an owner, a named person who reviews its access and actions through certifications and audits and who is accountable in the event of an incident. Second, agents should receive “a visitor badge, not a master key,” with access granted only when needed and for a limited time: “the room for one hour, not the keys to the building.” Third, organizations need a record that would stand up in court, with centralized, immutable, real-time auditing that traces the lineage of every access by every AI tool.Soto left attendees with a task for their next meeting with their security teams: ask them to show every agent in the environment, who is responsible for it, and what it can access. “If the answer is not a resounding yes, that is where the work begins,” he says.Asked how companies can reduce excessive privileges that accumulate when employees change roles, leave, or use multiple applications, Soto recommends connecting identity governance to human resources systems, creating a baseline of the access each role should have, and using AI to scan access across applications and detect anomalies. SailPoint, which works with more than 4,000 clients globally, including 180 in Latin America, focuses on governing both human and non-human identities.{“path”:{“baseUrl”:”\/”,”scriptPath”:null,”pathPrefix”:””,”currentPath”:”node\/65960″,”currentPathIsAdmin”:false,”isFront”:false,”currentLanguage”:”en”},”pluralDelimiter”:”\u0003″,”suppressDeprecationErrors”:true,”sharebardata”:{“buttons”:”\u003Cul class=\u0022social-sharebar\u0022\u003E\u003Cli\u003E\u003Cscript src=\u0022\/\/platform.linkedin.com\/in.js\u0022 type=\u0022text\/javascript\u0022\u003E\r\n lang: en_US\u003C\/script\u003E\u003Cscript type=\u0022IN\/Share\u0022 data-url=\u0022https:\/\/mexicobusiness.news\/cybersecurity\/news\/question-you-cant-answer-yet\u0022 data-counter=\u0022top\u0022\u003E\u003C\/script\u003E\u003C\/li\u003E\u003Cli\u003E\r\n\u003Cdiv class=\u0022g-plusone\u0022 data-size=\u0022tall\u0022 data-href=\u0022https:\/\/mexicobusiness.news\/cybersecurity\/news\/question-you-cant-answer-yet\u0022\u003E\u003C\/div\u003E\r\n\u003Cscript type=\u0022text\/javascript\u0022\u003E(function() {var po = document.createElement(\u0027script\u0027); po.type = \u0027text\/javascript\u0027; po.async = true;po.src = \u0027https:\/\/apis.google.com\/js\/plusone.js\u0027;var s = document.getElementsByTagName(\u0027script\u0027)[0]; s.parentNode.insertBefore(po, s);})();\u003C\/script\u003E\u003C\/li\u003E\u003Cli\u003E\u003Ca href=\u0022http:\/\/twitter.com\/share\u0022 class=\u0022twitter-share-button\u0022 data-url=\u0022https:\/\/mexicobusiness.news\/cybersecurity\/news\/question-you-cant-answer-yet\u0022 data-count=\u0022vertical\u0022 data-via=\u0022The Question You Can\u2019t Answer Yet\u0022\u003ETweet\u003C\/a\u003E\u003Cscript type=\u0022text\/javascript\u0022 src=\u0022http:\/\/platform.twitter.com\/widgets.js\u0022\u003E\u003C\/script\u003E\u003C\/li\u003E\u003Cli\u003E\u003Cdiv id=\u0022fb-root\u0022\u003E\u003C\/div\u003E \u003Cscript\u003E(function(d, s, id) { var js, fjs = d.getElementsByTagName(s)[0]; if (d.getElementById(id)) return; js = d.createElement(s); js.id = id; js.src = \u0022\/\/connect.facebook.net\/en_US\/all.js#xfbml=1\u0022; fjs.parentNode.insertBefore(js, fjs); }(document, \u0027script\u0027, \u0027facebook-jssdk\u0027));\u003C\/script\u003E \u003Chtml fb=\u0022http:\/\/ogp.me\/ns\/fb#\u0022\u003E\r\n\u003Cdiv class=\u0022fb-like\u0022 data-href=\u0022https:\/\/mexicobusiness.news\/cybersecurity\/news\/question-you-cant-answer-yet\u0022 data-layout=\u0022box_count\u0022 data-action=\u0022like\u0022 data-size=\u0022small\u0022 data-show-faces=\u0022true\u0022 data-share=\u0022true\u0022\u003E\u003C\/div\u003E\u003C\/li\u003E\u003Cli\u003E\u003Ca href=\u0022mailto:?subject=https:\/\/mexicobusiness.news\/cybersecurity\/news\/question-you-cant-answer-yet\u0022 class=\u0022sharebar-button email\u0022\u003EEmail\u003C\/a\u003E\u003C\/li\u003E\u003C\/ul\u003E”,”buttons_small”:”\u003Cul class=\u0022mobile-social-sharebar\u0022\u003E\u003Cli\u003E\u003Cscript src=\u0022\/\/platform.linkedin.com\/in.js\u0022 type=\u0022text\/javascript\u0022\u003E\r\n lang: en_US\u003C\/script\u003E\u003Cscript type=\u0022IN\/Share\u0022 data-url=\u0022https:\/\/mexicobusiness.news\/cybersecurity\/news\/question-you-cant-answer-yet\u0022 data-counter=\u0022right\u0022\u003E\u003C\/script\u003E\u003C\/li\u003E\u003Cli\u003E\u003Cdiv class=\u0022g-plusone\u0022 data-href=\u0022https:\/\/mexicobusiness.news\/cybersecurity\/news\/question-you-cant-answer-yet\u0022\u003E\u003C\/div\u003E\u003Cscript type=\u0022text\/javascript\u0022\u003E(function() {var po = document.createElement(\u0027script\u0027); po.type = \u0027text\/javascript\u0027; po.async = true;po.src = \u0027https:\/\/apis.google.com\/js\/plusone.js\u0027;var s = document.getElementsByTagName(\u0027script\u0027)[0]; s.parentNode.insertBefore(po, s);})();\u003C\/script\u003E\u003C\/li\u003E\u003Cli\u003E\u003Ca href=\u0022http:\/\/twitter.com\/share\u0022 class=\u0022twitter-share-button\u0022 data-url=\u0022https:\/\/mexicobusiness.news\/cybersecurity\/news\/question-you-cant-answer-yet\u0022 data-count=\u0022horizontal\u0022 data-via=\u0022The Question You Can\u2019t Answer Yet\u0022\u003ETweet\u003C\/a\u003E\u003Cscript type=\u0022text\/javascript\u0022 src=\u0022http:\/\/platform.twitter.com\/widgets.js\u0022\u003E\u003C\/script\u003E\u003C\/li\u003E\u003Cli\u003E\u003Cdiv id=\u0022fb-root\u0022\u003E\u003C\/div\u003E \u003Cscript\u003E(function(d, s, id) { var js, fjs = d.getElementsByTagName(s)[0]; if (d.getElementById(id)) return; js = d.createElement(s); js.id = id; js.src = \u0022\/\/connect.facebook.net\/en_US\/all.js#xfbml=1\u0022; fjs.parentNode.insertBefore(js, fjs); }(document, \u0027script\u0027, \u0027facebook-jssdk\u0027));\u003C\/script\u003E \u003Chtml fb=\u0022http:\/\/ogp.me\/ns\/fb#\u0022\u003E\r\n\u003Cdiv class=\u0022fb-like\u0022 data-href=\u0022https:\/\/mexicobusiness.news\/cybersecurity\/news\/question-you-cant-answer-yet\u0022 data-layout=\u0022box_count\u0022 data-action=\u0022like\u0022 data-size=\u0022small\u0022 data-show-faces=\u0022true\u0022 data-share=\u0022true\u0022\u003E\u003C\/div\u003E\u003C\/li\u003E\u003Cli\u003E\u003Ca href=\u0022mailto:?subject=https:\/\/mexicobusiness.news\/cybersecurity\/news\/question-you-cant-answer-yet\u0022 class=\u0022sharebar-button email\u0022\u003EEmail\u003C\/a\u003E\u003C\/li\u003E\u003C\/ul\u003E”,”width”:”85″,”position”:”left”,”top_offset”:”200″,”left_offset”:”5″,”right_offset”:”0″},”statistics”:{“data”:{“nid”:”65960″},”url”:”\/core\/modules\/statistics\/statistics.php”},”user”:{“uid”:0,”permissionsHash”:”d5cfe5151b3ffc53c5d130d9e05e2100e43cfffcac57d2afbf37c73af1c6771d”}}
——————————————————-
Click Here For The Original Source.
