The Agent Is the New Perimeter: What Breaks Next in AI Agent Security

Enterprises are putting AI agents into production faster than they can secure them, and that gap is what breaks next. Agents now call APIs, run code, touch databases and move money. Most security tools still watch the network or the container, not the agent itself.

At Disrupt, I sat down with Matan Bar-Efrat, co-founder and CEO of Rein Security, to talk about what it takes to secure agents once they leave the sandbox. Rein works mostly with tech and financial services companies, where agent adoption is moving fastest. His view of the current state was refreshingly blunt: “The reality is actually not that great.” Agents are still relatively easy to manipulate, and many organizations are still confused about how to govern them.

Watching the agent from the inside

Rein runs as a sidecar to the agent, so it sees what the agent sees. That includes its execution context, tool use, API calls, authentication and authorization, code execution, database operations and network connections.

The advantage is a behavioral baseline. Once Rein knows how an agent normally acts, it can flag the moment that agent behaves out of character. It works across the frameworks enterprises actually use: sandboxed coding agents, LangChain agents, Vercel agents, and agents built on OpenAI’s and Anthropic’s SDKs.

Why one policy for every agent fails

Large enterprises tend to write one agent policy for the whole organization. That policy drifts to the lowest common denominator: loose enough to let agents work, broad enough to cover everyone.

Centralized sandboxes are useful for governance, but they can’t see context. A coding agent and a payments agent should not live under the same rules. Without policy that understands each agent’s execution context, as he put it, you end up either too lenient or too harsh. Neither is acceptable when agents touch production systems.

Sovereign by design, live in a day

In a typical rollout, say a bank deploying agents at scale, Rein goes in through Kubernetes across all AI workloads. Most customers host Rein’s backend themselves, so sensitive data never leaves their environment. Rein built for that kind of AI sovereignty from the start.

Visibility is immediate, from agent posture and vulnerabilities to the actions agents take. The behavioral baseline forms within hours, and teams are typically fully operational in about a day.

After that, a daily CISO report flags what changed: new agents, code vulnerabilities, auth problems, supply chain risks or strange behavior. Nobody has to register agents first. Developers use it to see how their agents really run in production, and SecOps can replay any agent’s actions for forensics.

Detect, prevent, remediate

The part of the conversation that stood out most was remediation. Rein closes the loop in three steps:

Detect abnormal agent behavior in real time against the learned baseline.

Prevent it by learning what good looks like and enforcing an allow list, so the agent can only operate that way.

Remediate by analyzing the code and stack trace behind an incident and proposing a pull request that fixes the underlying issue.

Most security tools stop at the alert. Generating the fix is what turns security from a brake into an accelerator for getting agents to production.

What breaks next

Agentic attacks are already happening. Rein plans to publish a series on the attack types it is seeing in the wild, which should matter to CISOs, policymakers and anyone trying to separate AI hype from operational reality.

For CTOs and CISOs, three takeaways:

Secure the agent, not just the perimeter. Network and container tools miss what agents actually do.

Make policy granular. One organization-wide rule set will be either too loose or too tight.

Demand the fix, not just the alert. Remediation is what gets agents into production.

His message to CISOs was simple: Rein wants to be a partner that helps security leaders become enablers of AI, not blockers.

This conversation is part of Mesa Capital Partners’ What Breaks Next series on what enterprises will actually adopt in AI infrastructure and security. Watch the full interview above, and get in touch to join the conversation.