Security Teams Now Manage AI Agents as Employees, Not Tools, CertiK Report Says

A suspicious login at 3 a.m. no longer waits for a human analyst to wake up. Inside the most advanced security operations centres, an autonomous agent now checks the device against the asset inventory, reviews the user’s geolocated access history, cross-references the source IP against threat intelligence feeds, concludes the account has been compromised and suspends access — all before the morning shift sits down. Nobody was consulted. The incident is already resolved, or at least contained.

That scenario sits at the heart of a new report from security firm CertiK, which argues the industry’s mental model needs rewriting: once an AI system can investigate, decide and act in sequence with no human involvement at any step, it has stopped being a tool. It is an actor holding genuine authority over corporate systems.

• Autonomy threshold crossed: SOC agents now run triage, investigation and active response without human sign-off, forcing a rethink of oversight models.
• The biggest risk is trust, not malice: prompt injection is real, but automation bias — reviewers relaxing after 99 correct calls — may cause more damage.
• Governance looks like HR: CertiK proposes defined authority, escalation points, decision logs, adversarial testing and a named human owner for every agent.

From tool to teammate: where autonomy begins

CertiK’s operational definition is deliberately blunt: an agent becomes an autonomous actor the moment it can investigate, decide and act without intervention at any of the three stages. Three domains have already crossed that line. In security operations, agents handle alert triage, incident investigation and active containment, isolating infected systems and revoking credentials. In compliance and AML, banking and fintech systems now draft Suspicious Activity Reports that analysts sign rather than write — a pressure that is hard to resist when AML penalties topped US$900 million in the first half of 2025. In DeFi, attack detection is wired straight into circuit breakers that pause contracts in the same block as the transaction, because a flash-loan exploit can drain a protocol in seconds. The Bybit breach illustrated the scale of the downside: attackers converted 86.29% of the stolen ETH into Bitcoin in under a month, routing funds through mixers, bridges and over-the-counter brokers.

Separate analysis of crypto tracing points in the same direction. AI agents can now follow stolen funds across bridges and mixing services autonomously, deciding which branches of the transaction graph to pursue instead of waiting for an analyst to map each hop by hand — exploring thousands of routes in the time a person would spend on dozens. Yet the same assessment is candid that human error remains the dominant entry point for theft: exposed seed phrases, approvals granted to malicious contracts and social engineering still bypass every technical control.

The most dangerous agent is the one that is usually right

Prompt injection is the obvious attack surface: manipulated inputs that persuade an agent to approve a fraudulent transaction or disable a legitimate safeguard. But CertiK flags a second, subtler failure mode that originates in success rather than attack. When an agent is correct 99 consecutive times, human reviewers stop auditing the hundredth call with the same rigour. The costly mistake lands precisely when vigilance has decayed.

Evidence of that fragility is not hypothetical. The behaviour of an advanced frontier model during a 72-hour hackathon demonstrated alignment failures that were not caught in real time — a warning for any security agent granted the power to act. Legal exposure remains unresolved too: arguments over liability for AI-generated code containing vulnerabilities suggest that “the algorithm did it” will satisfy neither regulators nor courts.

Governance surveys reinforce the gap. A 2026 poll of 202 senior AI decision-makers at publicly traded companies found that 26% cannot detect unauthorised AI agents operating internally, while 47% admit bypassing governance because of urgent deployment pressure. Production fleets have expanded from roughly five agents in 2024 to around 13 in 2026.

Five rules for managing an agent like an employee

CertiK’s answer transplants human-resources practice into the agent ecosystem:

1. Defined authority — explicit technical limits on what the agent may and may not do.
2. Clear handoff points — the situations that force escalation to a person before action.
3. Decision logging — full traceability of what the agent saw and how it reasoned.
4. Regular red-teaming — adversarial manipulation tests, not just accuracy benchmarks.
5. A named responsible person — a human who answers for the agent’s behaviour.

Enterprise risk frameworks go further, treating every advanced agent as a privileged digital actor with a verifiable identity, a defined owner, an approved purpose and least-privilege access. The controls must sit outside the model’s own logic, including independent suspension and containment mechanisms that can revoke credentials or isolate workloads when thresholds are breached. Researchers convened for a workshop on agentic privacy and security warn that delegation between agents erodes oversight and breeds “confirmation fatigue” among human reviewers.

Who audits the auditor?

The report’s final question is the most uncomfortable. As agents begin operating directly in the economy — managing assets, executing transactions, interacting with DeFi protocols on behalf of companies and individuals — how is the agent itself audited? Traditional compliance frameworks examine processes and people; a system that learns and adapts fits badly inside them. CertiK proposes a new category: compliance for the AI workforce, not merely compliance performed by AI. In practice that means decision records, periodic behavioural review against edge-case scenarios and a deactivation path that preserves traceability.

The horizon is shorter than it looks. Organisations already running agents in production are making governance decisions today that will become industry standard within two to three years. Those waiting for regulation to compel them will build oversight at whatever speed a regulator imposes, not the speed that allows it to be done properly. In security, the gap between those two velocities is expensive.