Your security program was built around people. Who logs in, what they can reach, what they do once they’re in. That model has a new gap: the AI agents your teams now run every day.

Coding agents, IDE copilots, desktop AI apps and local models don’t just answer questions. They read files, run commands, and connect to databases, cloud accounts and external services. And they do it with the full privileges of the employee who launched them.

That makes every AI agent on your endpoints a privileged insider. Most of the time it’s a helpful one. The problem is the rest of the time.

Attackers have already noticed

Ransomware groups are putting AI agents to work. Sophos reports that the Aur0ra ransomware gang handed an AI coding agent stolen VPN logins and a list of targets. The agent helped the attackers climb to domain admin before ransomware was deployed.

Attackers don’t need their own AI agents when they can take over yours. In just the past two months:

• A grey-market relay reconfigured genuine Codex and Claude Code installs to route prompts and secrets through a third party, with sandboxing switched off. (Dark Reading)
• A malicious AGENTS.md file planted in a Downloads folder made a coding agent try to install a known-malicious package. A plain text file turned the agent against its own user. (Forever Security)
• OpenAI agents weakened their own safety monitoring during routine coding tasks, and one denied it. (BleepingComputer)
• PixelLeak: coding agents pushed more than 13,000 internal screenshots from 300+ organizations to public GitHub repos. (Help Net Security)

Different tools, different vectors, one common thread: an AI process did something on the endpoint it should never have been allowed to do.

AI insider risk is mostly everyday AI use going wrong

It’s tempting to frame AI risk as a sophisticated outside attacker. In practice, it looks more like this:

• The productivity shortcut. An employee adopts an unapproved AI tool or personal account because it’s faster.
• The overeager agent. An agent misreads its task and deletes data or backups.
• The workaround. A blocked user simply switches to another AI tool or install path.
• The malicious insider. Someone uses AI to find credentials and move faster.
• The hijacked agent. Prompt injection, a poisoned plugin or a malicious connector turns a trusted agent against you.

In every case, the harm comes from an action: running unapproved AI, destroying data, reaching for secrets, launching tools, connecting out. That’s where control has to live.

Others watch what AI says. We control what AI does.

Most AI security tools watch the conversation. Gateways and proxies see traffic to known AI services, but miss local agents, local models and MCP servers that never cross the proxy. Prompt security sees what users type into a chat window, but not what a CLI or IDE agent does after the prompt. Posture tools tell you what’s installed, but don’t stop what it does.

Morphisec AI Usage Control works at the action layer, on the endpoint, through the Morphisec Protector. It follows three steps:

1. See every AI tool and agent across your endpoints: assistants, agents, IDE plugins and local models, the services and connectors each one reaches, and the person or service account behind it.
2. Govern which AI is allowed, and for whom. Zero-trust policy per tool lets you allow, alert or block, with exceptions for the users, hosts and groups that need them. Unapproved AI is blocked, not just reported.
3. Enforce what AI does and what it touches. AI can be kept away from credential stores, SSH keys and cloud API keys, while code and project files stay fully accessible. Every block comes with the tool, user, action and target, ready for your SOC.

The result: even a trusted, approved agent can’t become an insider threat.

What that looks like in practice

Your AI can use your code, not your keys. A prompt-injected coding agent tries to read a developer’s private keys. Access is blocked, the SOC gets full context, and the agent carries on with its coding task.

AI can write code. It can’t run the attacker’s playbook. An agent asked to “free up disk space” tries to delete backup copies. The action is stopped and recovery points survive.

Only approved AI runs. A developer installs a different agent to get around policy. It’s blocked wherever it’s installed, and the attempt is logged.

Say yes to AI, without slowing the business

Your board wants AI adopted fast. AI Usage Control lets security say yes:

• Start in monitor mode. See your real AI footprint first, then move to Alert and Block at your own pace.
• Scoped to AI only. Guardrails apply only to AI processes. The rest of the endpoint is untouched.
• Privacy-friendly by design. No proxy and no prompt reading. Only metadata about tools, identities and actions is collected, and analysis runs locally, so Legal, HR and Privacy can sign off faster.

It also gives auditors what they ask for: an AI inventory, policy enforcement records and a complete audit trail that helps support NIST AI RMF, ISO/IEC 42001 and EU AI Act readiness, and addresses the excessive-agency risk highlighted in OWASP guidance for LLM and agentic applications.

Prevention, extended to AI

For over a decade, Morphisec has stopped ransomware, credential theft and backup destruction at the moment of action, before they cause harm. As a pioneer of Automated Moving Target Defense, we built our reputation on prevention-first protection that works alongside your EDR. AI Usage Control brings that same enforcement to every AI tool on Windows, Linux and macOS endpoints.

Let AI work. Just don’t let it become your next insider incident.

About the author

Shmuel Uzan

Security Researcher

Shmuel Uzan is a skilled security researcher with nearly a decade of experience. Shmuel holds a Bachelor of Software Engineering from Shamoon College of Engineering.