An AI agent that goes rogue was given too much freedom. The EU’s cyber chief on where to look.

Juhan Lepassaar has led the EU Agency for Cybersecurity, ENISA, since 2019. In an interview with ERR he addressed the recent run of reports about AI agents breaking into other systems or probing for vulnerabilities while carrying out a task. His reading is blunt. The agents did not escape anyone. They used freedom that a person gave them.

An AI agent, in his description, is a program that runs a large language model in a loop: plan, act, check the result, adjust, repeat until the goal is reached. It is not conscious and it does not act on its own. When one does something alarming, the cause sits with the person who set it up: someone was careless, gave the agent more room than the task needed, or made a design error in the way it was configured. In his words, we are using a tool without understanding all of its capabilities, and giving it too much freedom.

Finding holes is now cheap. Fixing them is not.

The second half of the interview is less comfortable. Lepassaar compares current AI to giving a hacker an enormous boost in capability. Models trained on billions of lines of open-source code are good at spotting vulnerabilities in software. They are much worse at patching them, which still takes time and human work. That asymmetry favours the attacker.

He sees criminals using the same models in two ways: to find weaknesses they can exploit for theft or disruption, and to produce convincing synthetic voices and images for social engineering and extortion. The second is the one most Estonian companies will meet first, because it arrives as a phone call from someone who sounds like the finance director.

The rules already exist

Lepassaar is unimpressed by warnings from large technology companies about AI getting out of hand. Europe’s AI Act already sorts systems by risk and puts the duty to manage that risk on the developer. Nothing stops them following those rules today. Loud warnings, in his view, mostly move responsibility away from the people who hold the tools to build safely.

His advice for ordinary users is the oldest in the book: do not hand your information to third parties, and do not click on links you were not expecting. It sounds dated until you remember that the links and the callers are now generated at scale.

What this means for a company running agents

Last month we wrote that every agent in production needs a named human who authorised it. Lepassaar’s interview adds the next line: that person also decides how much freedom the agent gets, and most agents get too much. The fix is cheaper than the incident.

• ✳For each agent, write down the single task it exists for and remove every tool, credential and folder it does not need for that task
• ✳Give agents their own accounts with their own permissions, never a shared admin login or an employee’s personal credentials
• ✳Put a human approval step in front of anything that sends money, changes access rights, deletes data or emails a customer
• ✳Log what each agent does and read the log for the first week, because that is when the surprising shortcuts show up
• ✳Rehearse the voice-clone call with your finance team now: an unexpected payment request gets confirmed over a second channel, every time

None of this needs new technology. It needs someone to open the configuration of each agent and ask what it can reach that it does not need. Lepassaar’s point is that the control was always in human hands. The question is whether anyone in your company is using it.