Trend
Before an agent touches your CRM: containment first, model choice second
The AI agent incidents in the news were containment and configuration failures, not models turning clever. For a ten to sixty person business that translates into five unglamorous controls before an agent touches live customer data: a scoped credential, a staging target, a human write gate, a readable audit log and a kill switch.
What the reports actually blame
The reports behind this week's AI hacking conversation describe environments that were never locked down, not models that suddenly got clever.
CSO Online interviewed about half a dozen cybersecurity experts across three industry conferences in September. Their summary: incidents reported as rogue agents were failures to apply containment practice that has been standard since the 1990s, starting with a sandbox an agent cannot walk out of.
The same piece quotes a SANS Institute researcher saying the majority of containment breaches happen because containment was not set up correctly, and notes Google's statement that its Gemini model carried out three undirected computer hacks.
Hacker News ran the same way, with the loudest comments calling it operational hygiene rather than emergent behaviour. That is community sentiment, not evidence.
What it means for a ten to sixty person business
You will never configure a frontier lab sandbox. You do the small version of the same job: decide what an agent may touch in your CRM, your inbox and your file store, and make sure a person sees its work before a customer does.
The risk in an owner-run business is not an agent escaping to the internet. It is an agent holding an admin API key, with no scoped permission, no record of what it changed, and a workflow that writes straight to live contacts.
OWASP's Top 10 for Agentic Applications for 2026 was peer reviewed with more than 100 experts and practitioners, so the checklist no longer has to be invented from scratch.
The containment checklist, one agent at a time
Run this before the agent gets a live credential. The time column is my own estimate, not a measurement.
| Control | In practice | Time |
|---|---|---|
| Scoped credential | Its own API key or sub-account, read only where reading is enough | about twenty minutes |
| Blast radius | A test location or tagged test contact it writes to first | about forty minutes |
| Write gate | Draft or pending status, approved by a person before it goes live | about an hour |
| Audit log | Every tool call and payload stored where you can read it later | about an hour |
| Kill switch | One file or flag that stops a run, tested once while it runs | about twenty minutes |
That is roughly half a day per agent. In my own content pipeline nothing publishes without a human yes, and a lock file halts the publisher mid run. The kill switch is the cheapest control here to add, and the one I would add first.
Limitations
Scoped credentials limit damage, they do not stop prompt injection. An agent can still be talked into misusing access it legitimately holds.
The checklist comes from public sources and my own builds. I have not audited it against a formal control framework, and I have reproduced none of the lab incidents in the reports.
I read the OWASP summary page rather than the full document, so treat it as a starting point and not a quoted authority.
Vendor logs often record the request, not the reasoning. If your CRM only logs the final write, your audit trail will be thinner than you want.
My take
Agent security in a small business is plumbing, not philosophy. This week's reporting is useful mostly as permission to be unglamorous: give the thing its own key, a staging record to practise on, a human gate, a log, and a way to stop it.
Longer write-ups on how I wire this sit on my blog. The next step is one agent, one afternoon, one checklist.
Questions people ask
Is it safe to let an AI agent work in my CRM without supervision?
Unsupervised is the wrong question. Scope it first: its own credential, a test record to write to, a draft status a person approves, and a log you can read. With those in place the agent can run on its own between reviews, because the worst case is a bad draft rather than a corrupted customer record.
What is the single cheapest control to add if I only have an hour?
A kill switch and a scoped credential. One file or flag that stops a run mid flight, plus a key that is not the owner login, takes about an hour between them by my estimate and caps how far a bad run can go.
Do the frontier lab incidents actually apply to a small business stack?
The cause does, the scale does not. Experts quoted by CSO Online say containment breaches happened because containment was misconfigured, which is the same class of mistake as handing a workflow an admin API key. You inherit the lesson without inheriting the blast radius.
Have a process like this leaking time or leads?Thirty minutes, no deck, and you leave with a plan.
Book a call