When your AI can fire a wire transfer, "verify the user" isn't enough anymore

When an AI agent can fire a wire transfer, "verify the user" is no longer the right control. The control that matters is the scope of action delegated to the agent, and whether that scope is narrower than what an attacker can induce the agent to widen. That is the gap a Cognizant op-ed on TechRadar Pro names as the next problem for the cyber industry, and a 2026 incident catalog is already showing how the gap gets probed in the wild.

AI agents are software that acts with delegated authority. They take a goal in natural language, pick tools, and execute: sending emails, updating records, calling APIs, approving transactions. The old threat model assumed systems followed defined rules and humans logged in with permissions they could revoke. Agents break that assumption because they improvise under language, not just rules, and the blast radius of a hijacked agent is whatever the agent can reach.

The piece on TechRadar Pro is a column by the Global Head of Cybersecurity Services at Cognizant, the IT services firm, and it lays out the case in terms the vendor industry is happy to adopt. The number doing the most work in the column is that nearly half of cybersecurity buyers expect AI to be embedded across the cyber stack within three years. The author's prescription is a unified security architecture spanning AI and traditional systems, and agents given a verifiable identity plus tightly scoped access to data and tools.

A 2026 retrospective from beam.ai catalogs agent-action breaches in which an attacker manipulated the prompt or tool input fed to an agent and got it to retrieve the wrong record, exfiltrate data, or approve an action a human would not have signed off on. In financial services, the sector most exposed to this class of failure, appsentinels argues that agents running across CRM, ticketing, and ERP systems have become the largest unmanaged identity in the enterprise. An Infosecurity Magazine survey cited in the same source bundle found roughly two-thirds of firms had already logged an AI-agent cybersecurity incident.

The counterargument is the obvious one: this is what zero trust and service-account controls were designed for. A CISO running a mature identity program can already issue short-lived credentials, scope them to a single API call, and log every action. That is a fair push, and it is the strongest version of the case against treating agentic AI as a new category. An agent does something a service account cannot: it improvises under natural language. The attacker does not need to steal a credential, only to plant a sentence the agent will trust. The control surface is not the credential, it is the prompt and the tool description.

For a buyer being pitched "AI security" this quarter, the questions that matter are not which vendor has the biggest model. They are the structural ones. Does the agent have a verifiable, attributable identity, separate from the human who invoked it? What is the scope of actions it can take, and is that scope expressed in code or in a prompt? Is there an audit trail a human can replay, and a rollback path that does not depend on the agent cooperating? How is prompt and tool input validated against injection, and who reviews the agent's decisions after the fact? If a vendor cannot answer those in plain English, the agent is the security stack, not protected by it.

The Cognizant column is a marker, not the news. The news is the catalog filling up at beam.ai and the next round of agent deployments in finance, IT operations, and customer support. The cyber stack is being asked to govern software that does not know it is being governed, and the buyer who treats that as a config problem rather than an identity problem will own the next incident.