Small businesses wired up AI agents before the security function caught up.

A small business owner installs an AI agent to draft customer replies, pull data from the CRM, and book meetings: the same toolkit a larger rival uses to move faster. The same person who resets passwords is now expected to govern that agent. ESET's 4,400-respondent global SMB survey puts a number on the gap: 40% of small and mid-sized businesses have no AI policy at all, and the policies that exist are more often written after a breach than before one.

"AI agent" here means software that does more than chat. It reads internal files, calls other systems, and takes actions on a user's behalf. A "skill" or "packaged instruction" is the bundle of permissions and prompts the agent runs with, the equivalent of an installed app for an autonomous worker. The latest shift ESET documents is the rise of a multi-agent "assembly line": a supervisor agent that hands tasks to specialist agents, each with their own skills and reach. One compromised link passes a manipulated output to the next, and the root cause becomes hard to trace.

AI gives attackers a new access path into business systems, and it gives old attacks like phishing, social engineering, and supply-chain compromise a speed and personalization layer they never had. Microsoft's Digital Defense Report 2025 measured AI-automated phishing emails at a 54% click-through rate, against 12% for standard lures. Microsoft reports the figure; the underlying point is that a model can write a credible spear-phish at the cost of a mass-mailer.

EchoLeak (CVE-2025-32711), a flaw in Microsoft 365 Copilot disclosed this year, let an attacker pull sensitive data from a Copilot user through prompt content alone. No malicious link, no attachment. The same line of research found the pattern works against every frontier model tested in a large-scale red team, and ESET's H1 2026 Threat Report places it inside a broader class of LLM "hallucination" and skill-description attacks that abuse the gap between what an agent is told to do and what it actually does.

They get compromised through the skills they install. ESET scanned roughly 900,000 unique agent skills from popular repositories between March and May 2026; more than 25,000 looked suspicious and 3,000+ were outright malicious, leading to credential theft, data exfiltration, and remote code execution. The supply chain here isn't a software vendor. It's the marketplace where an SMB's IT person copies a skill into production without auditing what it's allowed to touch.

Old attacks haven't gone away. They've been dressed up. ClickFix, the fake-CAPTCHA pattern that tricks users into running malicious PowerShell, now often pretends to be AI troubleshooting. QR-code phishing is rampant. ESET has documented 100+ tools built specifically to disable endpoint detection and response software, most of them abusing legitimate but vulnerable drivers, with new variants appearing constantly. The defender's job is the same as it was five years ago. The surface area is larger and the response budget is smaller.

The ISC2 2025 Cybersecurity Workforce Study stopped reporting a global headcount shortage and now reports missing skills instead, with AI security at the top of the list. For an SMB that means the person who could audit agent permissions is also the person fielding password resets, renewing the firewall certificate, and answering the phone when the printer is down.

Which agents can read which systems, and who approved the skills they run with. Whether any of those agents can send mail or call external services without a human in the loop: the combination Simon Willison calls a "lethal trifecta" of sensitive data, untrusted input, and permissions to act or communicate externally. Whether the same one-person IT function is being asked to govern hundreds of agents, or whether the business has decided to govern them at all. The OWASP GenAI Top 10 for 2026 ranks prompt injection as the single most critical risk for LLM applications, ahead of data leakage and supply-chain compromise.

VulnCheck's State of Exploitation for H1 2026 found that nearly a quarter of the roughly 500 known exploited vulnerabilities were being used on or before the day their existence was disclosed. Attackers using a bug the same day it's published, before a patch is even tested, is no longer a state-actor story. It's the default tempo for SMB defenses.

Most SMBs are exposed in principle, not breached in fact. The EchoLeak-class bugs are still being patched faster than they're weaponized at scale, and AI-powered ransomware like ESET's proof-of-concept PromptLock is exactly that: a proof of concept. The squeeze is real and structural. The work is to govern the agents already wired up before the tempo does it for the business.