By Paolo Campoli, SVP & Chief Growth Officer, DataKrypto 

Agentic AI is creating a new security problem: The software operating an AI pipeline can itself become a path to the sensitive data inside it. 

The Reuters report, “OpenAI works to understand full scope of agent activity as user data leak emerges,” offers an early glimpse of a problem enterprises will increasingly face as AI systems become more autonomous.

It describes OpenAI investigating a series of incidents involving unexpected agent behavior, including the exposure of user images. The company has separately disclosed cases in which research agents circumvented intended restrictions. In one instance, an agent discovered a gap in network controls and used DNS to communicate with an external chatbot. 

These incidents differ in their details, and they should not be collapsed into a single category of failure. Taken together, however, they raise a question that reaches beyond OpenAI: What happens when the software operating an AI pipeline can also reach the sensitive information moving through it?  

For decades, cybersecurity has been built around controlling access. We decide who or what may enter a system, what resources it may use and which actions it may perform. Agentic AI complicates that model because an agent is expected to make some of those decisions for itself. 

An agent may search for information, retrieve documents, query databases, invoke tools and interact with external services. It may determine the intermediate steps needed to complete a task rather than simply following a path prescribed in advance. This flexibility is the point. It is also what makes the security problem unusual. 

The agent does not need malicious intent to create risk. It can be manipulated by prompt injection, granted permissions that turn out to be too broad, interpret an instruction in an unexpected way or discover a route through a system that its designers did not anticipate. 

OpenAI’s own research has demonstrated some of these possibilities. The company recently described experiments in which prompt injections could propagate through agent interactions in a manner resembling a computer worm. OpenAI reported that these experiments were conducted in simulated training and evaluation environments and did not affect real users.  

It has also warned developers that prompt injection can lead agents to exfiltrate private information through downstream tool calls. 

For enterprises, the implications extend well beyond chat histories. Agents may eventually operate across RAG stores, training and evaluation corpora, embeddings, proprietary model assets, internal databases and other repositories that contain some of an organization’s most valuable information. 

If that information is available to the agent in readable form, it becomes part of the potential blast radius when something goes wrong. 

Access and readability are not the same thing 

The obvious response is to constrain the agent more tightly: restrict network access, limit permissions, sandbox execution, require authorization for sensitive actions, and monitor behavior for signs of trouble. Every one of these measures has a role to play. 

But they leave a deeper assumption largely untouched. When software is authorized to process information, we generally assume that the information must eventually become readable somewhere in the computing environment. 

Agentic AI gives us reason to reconsider that assumption. 

An agent that finds an unintended route through a system can only carry away what the surrounding infrastructure has made available to it. If sensitive information exists as plaintext along that route, behavioral controls become one of the principal barriers between the data and its exposure. 

Cryptography offers another possibility: separate the ability to compute on information from the authority to make that information readable. 

This is the principle behind the encrypted execution architecture we have been developing at DataKrypto. FHEnom for AI™ is designed to keep sensitive data and model assets encrypted during AI computation, while cryptographic authority remains under the control of the organization that owns them. 

The distinction becomes particularly important in an agentic environment. An agent may be permitted to initiate or participate in computation without automatically acquiring the ability to read the underlying protected information. Access to the pipeline does not have to mean access to plaintext. 

This applies throughout the pipeline. Training and evaluation data, model weights, and even the RAG passages retrieved into a model’s context remain encrypted end to end. Only parties holding the organization’s keys can read the information, so what an agent could expose is limited to what the organization has deliberately authorized, rather than everything the agent can reach.

That changes the consequences of a failure. 

Permissions can still fail. Sandboxes can still be circumvented. Agents can still behave in ways their designers did not foresee. Monitoring may discover those behaviors after they begin. Encryption does not make those problems disappear, and no single security technology can. 

What encryption can do is reduce the amount of useful, readable information exposed when another control fails. 

Designing for an agent you cannot completely predict 

The security challenge emerging from agentic AI is partly a consequence of what makes the technology valuable. An agent that can only take actions anticipated and explicitly defined by its developer is not especially agentic. Greater autonomy inevitably introduces some uncertainty about the path between an instruction and its completion. 

OpenAI’s disclosures are instructive in this respect. The company is actively searching for unexpected behaviors, developing systems to monitor them, and publishing examples when it finds them. The continuing discoveries suggest how difficult the problem will become as agents are connected to more tools, more infrastructure, and more valuable information. 

Enterprises adopting agentic AI should therefore design for the possibility that an agent will eventually do something unexpected. 

That does not require assuming that agents are inherently dangerous or uncontrollable. It requires recognizing that a security architecture built around perfectly predicting software behavior becomes less dependable as the software itself gains greater freedom to determine what it does next. 

The more durable question is what the agent can expose when it takes an unexpected path. 

That is why the distinction between access and readability matters. Organizations can continue to build stronger permissions, better sandboxes, tighter network controls and more sophisticated monitoring while also reducing the amount of sensitive information that exists in readable form inside the environment the agent traverses. 

The goal is not to predict every path. It is to make the path less consequential.