The Next AI Security Failure May Look Completely Legitimate

What network evidence can establish, where it stops, and why authority must be defined before AI agents act.

An AI security failure does not always look like a breach. It may be a single action performed with valid credentials, through an approved application and over an authorized network path. That distinction - between activity a system can detect and an action it was authorized to take - is central to securing autonomous systems.

When Shane Buckley, President and CEO of Gigamon, and I met in Paris on October 8, he described how AI changes a long-standing imbalance. Defenders must cover many paths into an environment; attackers need only one. AI can widen that imbalance by allowing attackers to explore more paths at once.

“You have a machine-based attack and you have a human-based response.” — Shane Buckley

That observation is an argument for faster detection, not a claim that every security decision should be automated. The governance question begins where detection ends: which actions can a machine take on its own, and which require authority defined before execution?

The speed of discovery is changing

Anthropic reported in 2026 that Project Glasswing gave a limited group of defensive partners access to Claude Mythos Preview for cybersecurity work, and that the programme had identified more than 10,000 high- or critical-severity vulnerabilities in essential software. The result is a useful illustration of the changing tempo: identifying a weakness can accelerate far faster than validating, prioritising, fixing and safely deploying a patch.

Buckley makes the same point about operational telemetry. In an interview, he contrasted the delay that can exist in log-based workflows with network telemetry available while traffic is moving. The precise delay depends on the architecture and the incident; the broader implication is sound. Where an event must be contained quickly, the organisation needs evidence that arrives early enough to support a decision.

What network evidence can and cannot establish

The network can expose useful evidence about how AI systems connect and behave. The Model Context Protocol (MCP) specifies how AI applications connect to external tools and data, while the Agent2Agent protocol (A2A) defines a way for agents to communicate. Those exchanges can create signals for security teams when they traverse observed network paths.

Buckley gave two examples: an MCP session that bypasses the enterprise's approved gateway and a credential associated with a volume of activity that is inconsistent with its expected use. In each case, the signal can justify investigation or policy-based containment. But network telemetry is not complete: encrypted content may require authorised decryption, and local process-to-process exchanges may not traverse a network observation point.

“There is no way to intrinsically know it’s a bad transaction.” — Shane Buckley

That limit matters. A one-off, high-consequence action can look fully legitimate in the available telemetry: valid identity, approved route, configured permission. Visibility can show what happened. It cannot, by itself, prove that the relevant person or policy holder intended it. For such actions, the control has to be designed before execution: a consequence-based approval, an independent confirmation, or a verifiable chain of authority.

When the defender is also an agent

Buckley expects security operations to progress from machine-assisted detection toward more automated response. He is careful about the current stage: detection can be automated in defined circumstances, while response carries a different level of operational risk.

“If the machine is real time, then the human can’t be real time, because we don’t respond that fast.” — Shane Buckley

An autonomous defender is a privileged actor. It may isolate a workload, revoke access or change a production configuration. The appropriate authority should follow consequence, reversibility and confidence in the signal. A protocol violation with a narrow, reversible remedy may be suitable for automatic action. A decision that can interrupt a plant, a hospital service or a critical business process needs a pre-agreed authority boundary, a safe fallback and named accountability.

Hybrid AI does not remove the control problem

Enterprises are combining frontier, open-weight and privately hosted models to balance performance, cost, data control and sovereignty. That can be a rational architecture choice. It does not automatically reduce cyber risk, because each additional environment adds integrations, identities, permissions and data flows that must be governed.

“As the world moves to hybrid AI, you’re repeating exactly the same error.” — Shane Buckley

The point is not that hybrid AI should be avoided. It is that the effective authority of an agent is only as strong as the least-governed environment it can reach. Rules for consequential actions must therefore be enforced where those actions execute, not merely described where policy is written.

Evidence for the people who carry the risk

“How much information should someone see, and how much information does someone need to see? Those are two totally different vectors.” — Shane Buckley

Board-level assurance does not mean presenting every alert. It means being able to show which consequential actions agents can take, who authorised each class, which controls detect deviation and whether those controls still work after models, tools or permissions change. Network telemetry, agent execution traces, identity records and approval records are complementary evidence; none is sufficient alone.

Gigamon's September 29, 2026 press release, reporting research from more than 300 CISOs, illustrates the governance gap: 76% cited limited visibility into AI-driven traffic as a major barrier to securing AI adoption, 80% identified inadequate governance around unsanctioned AI use as the top data-security challenge, and 43% ranked corporate AI governance among their top security priorities. These are vendor-commissioned survey responses, not independent measurements.

The same release reported that only 27% of CISOs said their organisation could identify root cause and restore normal operations within 72 hours, compared with 48% of other C-level executives. It also reported that 88% of CISOs had deployed new detection or visibility tools while breaches rose 18% year over year. The figures describe respondents' reported experience; they do not demonstrate that any individual control is effective.

A different measure of readiness

“Don’t be fooled into thinking that you have to move quickly. It’s one of the things hackers do.” — Shane Buckley

The practical response is neither to halt AI adoption nor to grant agents blanket authority. Start with one or two consequential use cases. Identify the action, its irreversibility, the evidence available if it goes wrong, the authority required before it runs and the fallback if automation fails. Better detection will catch more of the attacks that leave patterns. The actions that happen only once will still depend on authority decided before the machine moves.

Sources

Interview with Shane Buckley, President and CEO of Gigamon, Paris, October 8, 2026 — https://www.gigamon.com/

Gigamon 2026 Survey press release, September 29, 2026 — https://www.gigamon.com/company/news-and-events/newsroom/2026-survey-shift-to-hybrid-ai-drives-governance-to-top-of-the-ciso-agenda.html

Anthropic, Claude Mythos Preview cybersecurity capabilities and Project Glasswing — https://www.anthropic.com/research/mythos-preview

Model Context Protocol specification — https://modelcontextprotocol.io/specification/2025-06-18

Agent2Agent protocol specification — https://a2a-protocol.org/latest/specification/