What are the biggest security risks when deploying open-source AI agents?
Open-source AI agent platforms are growing fast, and so are their security problems. Independent researchers, enterprise security firms including Sophos, and vulnerability databases like Snyk have documented serious flaws in default deployments. These are not theoretical risks. Active exploitation is happening now, targeting businesses that deployed quickly without locking down their configuration.
The core issue is that AI agent platforms sit at the center of your business operations. They connect to Slack, Microsoft Teams, email, databases, Salesforce, and cloud accounts. A single security failure does not stay contained. It cascades across every integrated system the agent touches.
Token exfiltration (CVSS 8.8): A published High-severity vulnerability allows attackers with limited API access to steal authentication tokens from the agent gateway, exposing every connected integration including Slack, email, and cloud accounts simultaneously.
Default configuration exposure: Out-of-the-box deployments bind to all network interfaces on a predictable port, with no enforced password complexity, no mandatory MFA, and no login rate limiting. This turns a cloud VM without a properly configured firewall into an open door.
Active exploitation in the wild: Sophos documented attackers using Shodan and Censys to scan for exposed instances, running credential stuffing attacks against default admin panels, and using the skill installation API to deploy backdoors that enable lateral movement into internal networks.
Broad system-level permissions by default: A default AI agent installation can read and write files on the host system, execute shell commands, and access credentials for every connected service. A single prompt injection through a connected channel is enough to trigger data exfiltration.
How many businesses are running exposed AI agent deployments right now?
Bitsight's internet scanning research identified over 42,000 AI agent instances directly accessible from the public internet. Of those, 93% had authentication bypass vulnerabilities. That means attackers can access the control panel, connected integrations, and stored credentials without valid credentials of their own.
This happens because developers optimise default settings for speed and convenience, not security. Those same defaults become critical failures when a business deploys to a cloud VM and skips firewall configuration. The gap between a working local test environment and a secure production deployment is where most breaches begin.
The scale of exposure means these platforms are now high-value targets with predictable attack patterns. Attackers do not need to find your specific instance. They scan broadly, find exposed platforms at known ports, and automate the rest.
What makes the community skill marketplace a security problem for businesses?
Community skill marketplaces function like app stores for AI agent capabilities. They let businesses extend their agents to manage Jira tickets, query Salesforce records, process invoices, or interact with SAP. The problem is that community-contributed skills receive very little security scrutiny before publication.
A Snyk audit found that 36% of analysed community skills contained security flaws. These included hardcoded credentials, insecure API calls, and arbitrary code execution vulnerabilities. More than one in three skills that businesses install into their AI agents carry known security problems.
Snyk also identified a coordinated campaign that planted over 341 confirmed malicious skills. These appeared legitimate on the surface. Businesses installing them were granting attacker-controlled code direct access to every system the agent could reach, including Microsoft 365, internal databases, and cloud storage.
Hardcoded credentials in third-party skills: Skills published to community marketplaces frequently embed API keys and service credentials directly in the code, making them readable by anyone who installs or inspects the skill package.
Arbitrary code execution risk: A significant portion of audited community skills contained code paths that allow arbitrary command execution on the host system, meaning a malicious or poorly written skill can take full control of the server running your AI agent.
Coordinated malicious skill campaigns: Confirmed attacker campaigns have planted hundreds of malicious skills that appear legitimate, targeting businesses that install extensions without independent security review.
What does a secure AI agent deployment actually require for mid-market businesses?
Secure AI agent deployment is not about avoiding the technology. It is about deploying it with the right architecture from day one. Kernel Flow builds AI systems with security controls embedded into the deployment structure, not added as an afterthought.
The foundation is network isolation. AI agent processes should never be directly accessible from the public internet. Place them behind a properly configured firewall, restrict inbound access to known IP ranges, and ensure the control panel is not bound to all network interfaces by default.
Permission scoping is equally critical. AI agents should operate with the minimum permissions required to complete their specific tasks. An agent handling invoice processing in SAP does not need write access to your HR records or file system. Scoped credentials and role-based access control contain the blast radius of any compromise.
Mandatory MFA and strong authentication: Every AI agent control panel must enforce multi-factor authentication and prohibit default or weak credentials before the system goes anywhere near production data.
Integration token isolation: Store authentication tokens for connected services such as Salesforce, Slack, and Microsoft 365 in isolated credential vaults, not in a central configuration file accessible to the entire agent process.
Vetted skills and integrations only: Only install extensions and integrations that have been independently reviewed. Community marketplaces carry significant risk. Kernel Flow builds and reviews all integrations before connecting them to client systems.
Prompt injection controls: AI agents that accept input from external channels such as email or Slack require input validation and sandboxing to prevent crafted messages from issuing unauthorised commands to the agent.
Ongoing patch management: High-severity vulnerabilities like CVSS 8.8 token exfiltration flaws are patched in new releases. Businesses must run a patch management process that keeps AI agent platforms current, not set-and-forget deployments.
Why do most AI agent deployments create more risk than value in the first 90 days?
Most AI agent deployments fail the security standard in the first 90 days because speed of deployment is prioritised over operational architecture. Businesses spin up an instance on a cloud VM, connect it to Slack and email, and start testing. The firewall configuration, credential management, and permission scoping happen later, if at all.
For wholesale distributors, manufacturers, and professional services firms operating with sensitive client data and financial records, this sequence is backwards. The AI agent platform becomes a single point of failure that connects directly to your most critical business systems before basic protections are in place.
Kernel Flow deploys AI systems with security architecture defined before a single integration is connected. This means network isolation, scoped credentials, MFA enforcement, and validated integrations are in place on day one, not retrofitted after an incident.