Why AI Agents Break the GenAI Security Model with Devvret Rishi - #770

What It Covers

Dev Rishi, GM of AI at Rubrik, explains why traditional security models—static rules and human approval loops—fail for AI agents, and outlines a three-pillar framework using AI-powered runtime enforcement, cross-platform visibility, and automated recovery to govern agents operating across enterprise environments.

Key Questions Answered

• •Human-in-the-loop failure: Agents operate 10x faster than humans can review their actions, making manual approval a form of security theater. Engineers end up rubber-stamping long command strings they cannot fully parse, which Rishi argues may actually reduce security compared to no review at all. Organizations need AI-in-the-loop systems instead.
• •Three-pillar governance framework: Effective agent security requires cross-platform visibility as a base layer, dynamic runtime enforcement via a domain-specific SLM (Rubrik's "Sage" — Semantic AI Governance Engine), and resilience/rewind capabilities tied to observability. Visibility alone is insufficient without enforcement and recovery built on top.
• •SLM outperforms frontier models for enforcement: For binary allow/deny classification tasks, a fine-tuned small language model outperforms prompt-engineered frontier models like GPT-4 in both accuracy and speed, at a fraction of the cost. Constraining model output to low-cardinality decisions produces measurable accuracy gains for domain-specific security tasks.
• •Agent sprawl is faster than governance: One enterprise leader believed they had three or four deployed agents; an internal audit revealed 250, mostly autonomous background agents running in cloud platforms like Copilot Studio. Organizations should conduct agent audits immediately, as adoption outpaces visibility by orders of magnitude in large enterprises.
• •MCP and agent protocols expand attack surface: Model Context Protocol helps centralize application authorization but does not prevent cross-system data exfiltration—an agent with legitimate Salesforce and email MCP connectors can still move sensitive data between them. Security policies must govern intent and data flow, not just which tools an agent can access.