Deploy Reference Monitors to Secure AI Agents Against Insider Threats, Rapid7 Says
Rapid7 argues that AI agents require external reference monitors rather than internal prompts to prevent misuse of privileged access.
Key points
- Rapid7 research identifies AI agents as new insider threats requiring controls outside the model.
- The firm advocates for a reference monitor architecture to enforce policy on agent actions.
- Agents operating under shared accounts or human credentials increase the blast radius of attacks.
Rapid7 research published in its blog argues that security teams must treat AI agents as privileged users requiring external controls. The firm states that the industry view of agents as insider threats is incomplete because it fails to specify where controls should reside. According to Rapid7, the solution lies in applying the reference monitor concept from 1972, with the security operations center enforcing those policies in practice.
The risk
Large language models lack the deterministic behavior of traditional software, meaning the same prompt can produce different actions on different runs. Rapid7 notes that defenders can no longer assume a system will behave consistently. The firm describes agents as confused deputies, trusted programs tricked into misusing their authority via poisoned emails or documents. No password is stolen in these scenarios; the agent’s permissions become the primary blast radius.
Who is exposed
Environments where AI agents read mailboxes, query data lakes, open tickets, push code, or act on production systems are exposed to this risk. Rapid7 highlights that unlike human hires, agents cannot be background-checked or made to sign acceptable-use policies. The firm warns that any content an agent reads can serve as a potential command, making every data source a potential attack vector for instruction injection.
Cost and compliance
The source material does not provide specific financial costs, regulatory fines, or compliance framework requirements related to securing AI agents. Rapid7’s research focuses on architectural controls and detection strategies rather than quantifying the economic impact of potential breaches or citing specific legal mandates for agent governance in this publication.
Our take on the response
Rapid7 advises separating the reasoning model from the policy enforcement layer to ensure agents cannot bypass restrictions. Security teams should implement external reference monitors that check every access request and log decisions independently. This approach ensures that even if an agent proposes a harmful action, the enforcement point prevents it from reaching real systems.
What defenders should look for
Teams should monitor for discrepancies between an agent’s reported reasoning and its actual tool calls or data accesses. Check whether agents are operating under unique identities rather than shared service accounts or human credentials. Look for unusual sequences of actions triggered by standard data inputs, such as emails or documents, which may indicate instruction injection. Contain potential compromises by revoking agent permissions immediately, as internal prompts cannot be trusted to stop malicious behavior.
What to do and how to stay safe: Rapid7
- Assign unique, non-shared identities to every AI agent to enable precise tracking and revocation of access.
- Implement external policy layers that validate agent actions before they reach production systems or data stores.
- Monitor logs for actions that deviate from the agent’s stated reasoning or expected operational patterns.
- Treat any data input processed by an agent as a potential command source and restrict access to untrusted content.
Step-by-step guide: Unpatched Software Response: Containment, Recovery, and Prevention Steps
General security guidance from the BlueTeam Herald newsroom. It is not confirmed advice from the organisations named in this story.
Frequently asked questions
Why can't internal prompts secure AI agents?
Rapid7 states that system prompts are suggestions, not controls, and can be bypassed by well-crafted injection attacks that talk the model out of restrictions.
What is the reference monitor approach?
It is a mechanism that checks every access request, cannot be bypassed, and cannot be tampered with by the program it governs, separating reasoning from enforcement.
How do AI agents differ from human insider threats?
Agents act at machine speed, have no career consequences, and their reasoning may not match their actions, making external evidence essential for forensics.
