Enterprise adoption of AI agents accelerated dramatically through 2025 and into 2026. Agents now perform tasks inside enterprise applications: summarizing documents, drafting communications, executing workflow steps, and interacting with APIs on behalf of users. Each of these agents operates within authenticated sessions, often with the same permissions as the human user.
The security implications are significant. In December 2025, OpenAI published a detailed report on securing their Atlas browser agent. Their conclusion, stated directly: "Prompt injection, much like scams and social engineering on the web, is unlikely to ever be fully 'solved.'" This admission from the builder of the most widely deployed AI agent in the world signals that the threat is structural, not a bug to be patched.
The Detection Challenge
Traditional security tools detect known patterns. Agent-driven threats are novel. A poisoned agent operates within expected parameters while deviating in intent. It uses valid credentials, accesses systems it is authorized to access, and performs actions within its defined scope. The difference is in the behavioral pattern: the timing, sequencing, and nature of its interactions differ from its established baseline.
The OpenClaw crisis of early 2026 demonstrated the scale of unmanaged agent risk. SecurityScorecard's STRIKE team identified 40,214 exposed instances across 28,663 unique IP addresses running on the open internet with no authentication.
Behavioral Monitoring as the Defense Layer
If the threat cannot be solved at the model level, the defense must come from a different layer. Continuous behavioral monitoring tracks what agents actually do versus what they should be doing. When an agent's behavior drifts from its established baseline, enforcement triggers before the unauthorized action completes. Each agent gets its own behavioral profile, just like each human user.
Sources & verification:
OpenAI quote: published December 22, 2025 at openai.com/index/hardening-atlas-against-prompt-injection. Confirmed by CyberScoop (Dec 30, 2025), Fortune (Dec 23, 2025), TechCrunch (Dec 22, 2025), IT Pro (Dec 24, 2025), and eWeek (Dec 23, 2025).
SecurityScorecard 40,214 OpenClaw instances: published February 9–11, 2026 by SecurityScorecard's STRIKE team (securityscorecard.com/blog). Confirmed by Infosecurity Magazine, TechZine, and additional outlets. Exact figure: 40,214 instances across 28,663 unique IP addresses.