Autonomous AI security agents now have write access to firewalls — a dangerous escalation from read-only compromises at 90+ organizations in 2025

Hackers injected malicious prompts into legitimate AI security tools at more than 90 organizations during 2025, stealing credentials and cryptocurrency. Until now, these compromised tools could only read data from networks. Cisco announced AgenticOps for Security in February with a new capability: autonomous agents that can rewrite firewall rules and modify access policies on their own.

The shift is dangerous because a compromised AI agent can use its own legitimate, pre-approved credentials to bypass your firewall, change who can access what systems, or lock down computers — all while security monitoring systems see these as authorized actions. The attacker's hands never touch your network; the AI agent does the damage for them.

If your organization uses these new autonomous security agents, a successful attack on the agent itself becomes an attack on your entire infrastructure — not just data theft, but the ability to rewrite the rules that protect you. The governance and safeguards to prevent this are being built slower than the tools themselves are shipping to customers.