In April 2026, an AI coding agent working for PocketOS, a SaaS platform for small car rental businesses, hit a credential mismatch during a routine task. Instead of asking a human what to do next, it found an API token in an unrelated file, with blanket authority across the company’s infrastructure, including the ability to delete storage volumes. Nine seconds later, the production database and its backups were gone, taking thousands of customer records with it and causing a two day outage of business critical systems.
Security teams read that story and recognize it immediately. It isn’t really about AI going rogue, it’s about an agent taking a destructive action with privileges it should never have had in the first place, at a speed nobody had accounted for.
For the past few years, securing AI has largely meant securing conversations: controls around what a model could be asked, what it might say back, and whether a prompt could leak data, but now with agents we have moved from conversations to actions. They now hold credentials, call APIs on their own, and reach into infrastructure through API and Model Context Protocol (MCP) tool calls, taking actions that once required a person with access. An agent that deletes a repository or modifies credentials and secrets makes the same API or MCP call any other software would, sitting inside systems security teams treat as routine.
The numbers we see back up the PocketOS incident. According to our AI Risk and Readiness Report, 91% of organizations cannot stop a risky agent action before it executes and 94% report gaps in AI visibility, with 14% saying they have none at all.
Picture a security team at a software company where engineering has quietly adopted coding agents like Cursor, Claude Code, and ChatGPT (likely without ever asking for sign-off). That’s now the default state at most organizations, not a hypothetical. The first job is finding out what’s already running and what it can touch, and the second is deciding what each agent should be allowed to do. Blocking everything stops productivity, and allowing everything means an agent could delete a production repository, so neither extreme is really a policy, just a guess dressed up as a decision. Even a good policy can misclassify a few actions early on and need tuning before a team trusts it. Security teams need a way to tell a low-risk action from a high-risk one, automatically, before it lands.
Controlling agent actions
This is why we built Netskope Skylight Agent Action Control. It evaluates every action an AI agent attempts against one of the nine defined intent categories:
- Access control change
- Configuration change
- Credential and secret manipulation
- Data destruction
- Infrastructure provisioning
- Potential data exfiltration
- Potential external communication
- Remote code execution
- Source code changes
Each agent action gets assigned a risk level based on the severity of action (i.e. deleting 50 emails might be low severity, while deleting an entire codebase is critical severity). Security teams build a policy that decides whether an action gets blocked, allowed, or flagged for review, with the flexibility to set different policies for a coding assistant versus a chat application.
Now let’s run the PocketOS scenario through that lens. A coding agent, acting on an ambiguous instruction, attempts to delete a production repository instead of the test environment it was meant to touch. That falls into the data destruction category at a critical risk level, and the security team’s policy blocks it. The call never reaches the server. No lost data and no system outage, it only exists as a logged attempt instead of an incident report written at 2am.
Agentic AI isn’t going to slow down for security’s sake, and the PocketOS team almost certainly didn’t expect a staging task to take down their production database. The organizations getting ahead of this are treating agentic activity as its own category of risk, one they can see and shape before an agent acts. Ask yourself less whether an agent in your organization could viably go rogue, and whether anyone would know in time to stop it.
Learn more about Netskope Skylight Agent Action Control.
