Zero risk isn't the job: a CISO's guide to agentic AI (claude.com)

Jason Clinton, Deputy CISO of Anthropic, recently shared critical insights into navigating the security challenges posed by agentic AI. As organizations rush to adopt these advanced AI agents, security leaders face a dual challenge: managing the risks of uncontrolled adoption while ensuring these technologies can be deployed safely. Clinton emphasizes that achieving zero risk isn't feasible; rather, the focus should be on creating a clear framework for evaluating and bounding the risks associated with these AI systems. His team's approach includes a structured assessment, asking four key questions to evaluate potential vulnerabilities and ensuring a limited capability that allows agents to function without compromising security. Anthropic's work highlights the pressing need to prepare for the surge in vulnerabilities that AI can expose, especially as more sophisticated models like Claude Mythos uncover bugs faster than traditional methods. The risk landscape is expanding, with concerns about data leaks and prompt injection becoming prevalent. Clinton underscores that as these agents gain intelligence and capabilities, organizations must employ robust controls that govern their actions. By establishing clear boundaries and employing a principle of least agency, security leaders can better manage risks while capitalizing on the efficiencies these AI agents offer, ultimately integrating them into incident response operations with careful human oversight.