AI agents are increasingly handling purchases, refunds and customer accounts, raising the need for real-time security controls as businesses adopt autonomous technology.
AI agents move beyond answering questions
A new report by Cequence Security, developed with input from KPMG in Singapore, highlights the growing security and governance challenges as AI agents move from generating content to taking actions on behalf of businesses and customers.
The report, titled Agentic AI Runtime Security, Governance, and Control, examines how organisations can monitor and control AI agents while allowing them to perform legitimate tasks.
Cequence’s research team tracked more than 250,000 AI agent visits across five industries during one week in October 2026. Around one in seven visits involved agents booking, purchasing, signing in or managing an account on behalf of a customer.
The findings highlight how AI agents are becoming more involved in everyday digital services, including financial transactions and account management.
AI agent activity raises security concerns
The report also identified cases where AI agents operated without clearly identifying themselves.
At a major telecommunications carrier, traffic from agents that did not identify themselves as AI agents increased from approximately 100 requests per day to as many as 32,000 within three weeks of a major consumer AI agent’s launch.
These agents signed in using customer credentials and passed multi-factor authentication.
Another example involved an online marketplace where visits claiming to be Google-Agent outnumbered all genuine agent visits tracked by Cequence during the same week.
However, these visits failed at the sign-in stage. Cequence said the activity indicated attempts to test stolen passwords in bulk using the name of a legitimate agent. Google was not involved.
Study finds stronger controls improve AI task completion
Cequence also conducted a controlled study using its research prototype to examine how different security approaches affected AI agent behaviour.
The results showed that agents operating with only login credentials and fixed permissions attempted actions outside their assigned tasks in 44% of runs.
When agents were given clearly defined responsibilities and each action was checked against those limits in real time, unauthorised action attempts fell to 1%.
The same approach increased task completion rates from 76% to 95% and reduced token usage by approximately 35% per run.
KPMG highlights the need for real-time oversight
The report recommends assigning AI agents specific responsibilities rather than giving them broad authority. It also calls for independent security systems that can approve, escalate or block actions as they happen.
Gerry Chng, Partner and Head of Cyber at KPMG in Singapore, said organisations across Asia-Pacific were moving from AI experimentation towards practical business applications.
“Organizations across Asia-Pacific are moving from experimenting with AI to deploying them to achieve real business outcomes. Traditional controls such as identity verification and fixed access permissions are important, but they may not be sufficient when an agent can carry out a sequence of actions on behalf of a business or customer. Organizations need governance that considers the agent’s role, the context of each action, and the cumulative risk created across an entire task. KPMG’s contribution to this report brings together our experience in governance, risk, regulation and cyber security to help organizations put appropriate oversight around AI agents while enabling legitimate work to continue,” said Chng.
The report’s findings are scheduled to be presented to business, technology and policy leaders at a joint Cequence and KPMG event at KPMG’s Singapore office on November 19, 2026.
