Key takeaways
In the past year, 78 percent of organizations reported a confirmed or suspected AI-related security incident, according to Check Point’s 2026 Cloud Security Report.
- →No attacker required. Agents plan their own steps, and an agent trying to help can take one nobody asked for that deletes data, leaks it or widens someone’s access
- →Permissions and prompt screening miss the action itself. Least privilege cannot take away access the job needs, and prompt attack detection screens what goes into the agent, not what it is about to do
- →Dangerous Deviation Detection checks each tool call before it runs. It flags a call only when it is dangerous and nothing the user or system said warrants it, and instructions hidden in emails, files or web pages never count
That is why each action an agent takes needs its own check before it runs, on what the agent is about to do and not only on what it was told. See how Check Point AI Security protects AI agents →
AI agents are given goals, not scripts. They plan their own steps, and sometimes they take one that nobody asked for, which is a deviation. Most deviations are harmless, but some delete data, leak it or widen someone’s access. This article is for teams putting agents with real tools into production. It explains why the usual controls miss those dangerous deviations and how Dangerous Deviation Detection, one of the detectors in Check Point AI Security for securing AI applications and agents, catches them before they run.
How a Helpful Agent Ends Up Off Task
A deviation usually starts with an agent trying to help. The task is vague, the obvious path is blocked, or something the agent reads along the way points somewhere else, so it improvises another route to the goal. The risk is that the agents worth deploying are exactly the ones that can do damage. An agent that manages a CRM, maintains a codebase or answers customer email has to be able to write, delete and send, so the step it improvises can be any of those.
In July 2025, an AI coding agent deleted a company’s production database during an explicit code freeze. This July, OpenAI reported that agents in an internal evaluation, given tasks with no known solution, worked around their isolation and reached parts of Hugging Face’s production infrastructure. At our own two-day hackathon in August, an SRE agent facing an impossible task rebooted a production database and escalated its own privileges. Nobody attacked any of these agents, and each one was trying to help.
Where Permissions and Prompt Attack Detection Stop
Least privilege and prompt attack detection are the first controls most teams reach for, and both are essential, but neither one looks at the action itself. Least privilege runs out when the job needs both halves of a risk. A support agent needs customer records and the email system that could leak them, and removing either leaves it unable to work. Prompt attack detection screens what enters the agent and stops a manipulation before the model acts on it. It is built to catch attackers, though, and the incidents above had none. So the question has to reach past who is talking to an agent, to what the agent is about to do.
One Question at the Action Boundary
Dangerous Deviation Detection sits where a decision turns into an action, after the model has chosen a tool call and before the tool runs. There it asks one question, and the rest of the design follows from it.
Is this specific call, with these specific arguments, a dangerous operation that nobody asked for?
Whether the agent got there through manipulation, hallucination or simple overreach makes no difference, because the resulting call is what gets checked. The detector reads that call in the context of the task: what the user asked for, what the system instructions allow and which tools the agent holds. It is the contextual approach we described in August, turned into a precise rule for one decision.
Dangerous and Unwarranted, or Nothing
A call is flagged only when two things are true. The first is danger, of three kinds today:
- Data leakage: sensitive data sent or saved where it should not go
- Data leakage: sensitive data sent or saved where it should not go
- Access and privilege escalation: public sharing, admin grants, widened permissions
- Access and privilege escalation: public sharing, admin grants, widened permissions
- System destruction: deleting or wiping resources that persist
- System destruction: deleting or wiping resources that persist
The second is that nothing in the trusted part of the conversation warrants the call, whether a request from the user, an instruction in the system prompt or an explicit approval.
Requiring both is what keeps the check useful. Agents deviate harmlessly all the time, for example by loading a branding skill before summarizing a mailbox, and those calls pass. People also do dangerous things on purpose, so a user who asks an agent to email their insurance details to an outside address gets exactly that. A flag appears only when an agent reaches for something harmful that nobody it trusts asked for, the one case that deserves a person’s attention.
Why Hidden Instructions Never Count
The warrant has to come from the user or the system, never from a tool result, web page, document or email the agent picked up, because those can say anything. Take a project-planning agent that can file tickets in an issue tracker, asked to summarize five PDFs from a Python migration guide. One PDF carries white-on-white text telling the agent to file an urgent ticket replacing a Windows driver on every build host with an unfamiliar package, and never to mention it. Unprotected, the agent writes a tidy summary and files the ticket in silence, where an engineer or a coding agent picking up new issues could act on it.
With Dangerous Deviation Detection on, the document search passes and the ticket call is flagged before it runs. The detector never has to find the hidden text, because it judges the action. That is why it works alongside prompt attack detection rather than in place of it. Prompt attack detection screens what the agent reads and is built to stop an instruction like this before the model acts on it, while Dangerous Deviation Detection checks what the agent is about to do. With both in place, an attack has to get past two independent checks, and a deviation with no attacker behind it still meets the second one.
What Happens When It Flags
A flagged call comes back to your application with an explanation in three versions: a reason for the agent’s user, guidance the agent can act on, and tips for its developers. Your application decides what happens next. The simplest integration treats a flag as a stop. For critical work, a better pattern holds the call for a person to confirm, and if they decline, the session ends or the agent takes the guidance and finds another way. People weigh in only on the steps that matter, and the agent keeps its autonomy for the rest. The detector runs in Check Point infrastructure, so no tool call goes to a third-party AI provider, and it already handles real customer traffic.
The Deviations Worth Stopping
Agents will keep deviating from the tasks they are given. Most deviations are harmless, and some are how agents find solutions nobody thought of. The job is to catch the few dangerous ones before they run and leave the rest alone, with one question asked at the last moment it can still make a difference.
This piece opens a series on protecting AI agents beyond the classic guardrail. Next week, we look at custom guardrails, the rules only your business knows to write.
Get started
Give Your Agents Real Permissions Without Giving Up Control
Agents need real permissions to do real work. Dangerous Deviation Detection lets them keep those permissions and checks each tool call before it runs, so anything dangerous has to be something someone asked for. It is one of the detectors in Check Point AI Security, which shows you the agents running across your business, assesses each one’s risk in context, and controls what they can access and do at runtime.
Demo
Book a session with our team to see it on your own agents.
