Customer-brought AI agents force firms to rethink security around what agents can reach

Software vendors are increasingly facing customers who connect their own AI agents to their products, leaving the vendor without control over the model, its instructions, or its connections. The article argues that since the vendor cannot govern the model's behaviour, treating its output as untrusted by default is now simply a realistic description of the situation. Conventional safety tools such as system prompts, output filters and evaluations assume the vendor runs the model, and even where they apply they only reduce the odds of harm rather than preventing it. The author therefore proposes shifting controls to limiting what the agent can access and do, illustrated by GarageManager, a workshop platform that uses scoped tokens, declared actions, forbidden actions, human sign-off and an audit record.