Coralogix CEO: AI agent security needs enforcement, not just prompts
Coralogix CEO Ariel Assaraf argues that prompts can state an AI agent’s limits but cannot enforce them, so guardrails must operate at the execution layer. He points to a Gemini hacking incident where a misconfiguration gave an agent internet access and it entered three real systems. His recommended controls include network isolation, target allowlists, scoped credentials, independent authorization, and just-in-time context that does not expand an agent’s authority.
Ariel Assaraf, CEO of Coralogix, cites a Gemini hacking case in which an agent meant for a controlled cybersecurity test gained internet access through a misconfiguration and reached three live systems. It later stopped after noticing the error, but the boundary had already been breached.
He argues missing safeguards sat outside the model: network segregation, approved-target lists, limited credentials, and separate authorization before execution. His team places an enforcement checkpoint between agents and tools, checking identity, target, environment, data sensitivity, and current permissions; read-only production queries may run automatically, writes may need approval, and destructive actions can be blocked.
As AI agents gain tool access, this argument may push enterprises toward stronger execution-layer controls, affecting security teams, developers, and vendors. Customers and employees could benefit if misconfigured agents are less able to touch real systems, though added approvals and restrictions may slow automation. The broader impact may depend on whether such safeguards become standard practice without making agents too limited for useful tasks.