Why This AI Security Story Matters to Your Business
AI agents are moving beyond chat. They can read invoices, update customer records, reconcile transactions, prepare reports, answer staff questions and trigger actions across your business systems. For a Malaysian SME with a small team, this sounds practical: one digital worker could handle repetitive work while your people focus on customers and operations.
But a successful login does not prove that an AI agent should be trusted with every action. The agent may use a valid employee token, access more data than its task requires, follow instructions hidden in an untrusted document, or continue making mistakes after its purpose has changed. The source article warns that authentication is only one layer of control, especially when an AI agent acts across several connected tools. Read the original analysis in VentureBeat.
For you, the issue is not only cybersecurity. It is also accountability. If an AI agent changes a customer’s details, sends an incorrect quotation, exposes payroll information or deletes a record, you need to know exactly which agent acted, who authorised it, what task it was performing and which systems it touched.
What Happened
The article describes a recurring weakness in enterprise AI deployments: organisations often begin with an AI gateway that checks traffic, tokens and policy rules. However, a gateway cannot make a sensible decision if it does not know which agent is acting, who delegated the work, what the task is and whether the requested action fits that task.
A valid credential may allow an action technically, while the action is still inappropriate. For example, a finance-reconciliation agent could use an employee’s valid access token to alter a production record. The system may see a permitted user and a permitted API request, but fail to recognise that the agent was only supposed to read transaction data and prepare a reconciliation report.
The article also refers to a LiteLLM vulnerability added to the United States Cybersecurity and Infrastructure Security Agency’s Known Exploited Vulnerabilities catalogue. According to the source, attackers abused the flaw to run commands on a host through the gateway, and a second flaw enabled exploitation without credentials. The article states that seven CVEs were disclosed in that AI gateway in one month. These details are reported by VentureBeat and should be checked against current vendor and CISA advisories before making technical decisions.
The proposed answer is a sequence of six dependency gates. Each gate supplies context required by the next one. In simple terms, you should first know what agents exist and who owns them, then give each agent a distinct identity, restrict its authority, record its activity, enforce rules at runtime and create a way to stop it across connected systems.
Why This Matters for Malaysian SMEs
Many Malaysian SMEs operate with a compact technology stack: cloud accounting software, a CRM, WhatsApp or messaging tools, online banking, e-commerce platforms, payroll applications and shared cloud storage. Connecting an AI agent to these systems can save time, but it also creates a chain of access. If one agent uses a shared administrator account, an error in one system may spread to several others.
Consider an agent that processes supplier invoices. Its legitimate job may be to read invoices from a designated folder, compare them with purchase orders and prepare a payment batch for human approval. It should not be able to modify supplier bank details, approve a payment, access employee salary files or delete accounting records. If all these permissions come from one broad employee account, the agent’s practical authority becomes much wider than its business purpose.
A similar risk applies to sales and customer service. An AI assistant may be allowed to draft replies and update contact notes, but not export your entire customer list or change credit terms. If a customer email contains malicious instructions or an attached document attempts to manipulate the agent, the system needs enough context to reject actions outside the assigned task.
Malaysia’s Personal Data Protection Act 2010 regulates the processing of personal data in commercial transactions. You can read the law and related materials through the Personal Data Protection Commissioner. The practical lesson is straightforward: if your AI agent handles customer, employee or supplier information, you should know what it can access, why it accesses it and how activity can be reviewed.
The Six Controls You Can Apply
| Control | What You Should Be Able to Prove | Example for Your Business |
|---|---|---|
| Agent inventory | Every production agent has an owner, purpose, tools and status. | You can list every bot used for invoices, sales, support and reporting. |
| Distinct identity | The system identifies the agent and the person or process that delegated the task. | An invoice agent is not hidden behind a shared finance login. |
| Task-scoped credentials | Access is limited to the resources needed for a specific task and period. | The agent can read one invoice folder but cannot change bank details. |
| Attributable logs | You can reconstruct the request, tool calls, data accessed and outcome. | You can see who started a reconciliation run and what records it changed. |
| Runtime enforcement | Rules consider the agent, principal, task, action and resource. | A report-writing agent is blocked from approving a payment. |
| Kill path and behaviour monitoring | You can stop the agent wherever it has access. | One emergency action disables its accounting, storage and CRM connections. |
Start With Agents You Can Actually Name
Your first step is not buying another security product. Create a simple register of every AI feature, automation bot and connected assistant used in your business. Include tools provided by SaaS platforms, accounting applications, CRM systems, workflow software, developer tools and open-source frameworks.
For each one, record its business owner, technical owner, purpose, approved tools, data categories, connected accounts, current lifecycle stage and emergency contact. If nobody can explain why an agent exists, treat that as a review item. An unused automation should not retain access simply because it was useful six months ago.
This register also improves incident response. If a staff member reports unusual changes in your system, you can quickly identify which agents were active, what they were intended to do and who can disable them.
Use Separate Identity and Limited Authority
Do not bury an AI agent inside a developer token, shared service account or human session where every action appears to come from an employee. The agent should have its own identity, while retaining a clear link to the person or business process that authorised its task.
Use the access features already available in your technology environment, such as role-based permissions, workload identities, token exchange, conditional access and time-limited entitlements. The exact implementation depends on your platform, but the operating principle is the same: each transfer of responsibility should preserve or reduce authority, never increase it.
Ask one question before connecting an AI agent: “What is the smallest set of data and actions this agent needs to complete this task safely?”
For an SME, this may mean starting with read-only access. Let an agent identify overdue invoices, draft a customer reply or flag unusual transactions before allowing it to write records. Keep payments, user-permission changes, data exports, deletions and supplier-bank-detail changes behind human approval.
The Bigger Picture
The important shift is from “Can this user log in?” to “Is this agent authorised to perform this action, for this person, during this task, on this resource?” Authentication remains necessary, but it is not sufficient.
This matters because AI agents can drift from their original purpose. They may receive new instructions, encounter misleading content, reuse information from previous tasks or trigger a tool chain that nobody expected. A well-designed system therefore needs identity, delegation, limited access and traceable activity before advanced enforcement can work properly.
You do not need to automate every process immediately. Choose one contained workflow, such as invoice matching or internal report preparation. Inventory the agent, create a separate identity, restrict its permissions, log every action and define a manual stop procedure. Test unusual cases before expanding access.
For Malaysian SME owners, responsible AI adoption is not about slowing technology down. It is about ensuring that automation remains useful when something goes wrong. The businesses that benefit most from AI will not simply connect agents to more systems. They will make each agent accountable, limited and stoppable.
Before your next AI rollout, check whether you can answer four questions: Which agent acted? Who delegated the task? What authority did it have? Can you stop it everywhere? If any answer is unclear, improve that foundation before adding more automation.
Ready to Streamline Your Operations?
Technology moves fast. Your operations should keep up. AutoRunBiz builds AI systems that run your daily workflows — from WhatsApp order capture to accounting. Book a free 15-min ops audit →