Your AI Agents Will Try Every Permission You Gave Them | Nadav Cornberg Eve

SPONSORED EPISODE: This episode includes paid promotion. Security Unfiltered was paid by Eve Security for this sponsorship.

Guest: Nadav Cornberg, Co-founder and CEO, Eve Security

▶ Watch the full episode on YouTube

I keep running into the same thing. I give an agent a goal, and it goes after that goal with every permission it can find. Sometimes that saves me hours. Sometimes it's the reason a repo is gone.

That's why I wanted Nadav Cornberg back on the show. This is the final episode in our Eve arc. If you missed the first one, start with Part 1: Why AI Agents Break Enterprise Security With Nadav Cornberg From Eve. This one goes deeper into runtime: intent inside a session, when privileges should change, and MCP hooking tools into systems nobody planned for.

Here's what I took away.

1. Agents know their permissions better than you do

Nadav put it plainly: "Agents know exactly all the permissions they have. And they'll test all of them out."

He said that when Eve blocks an unintended action, "we typically see three to four blocks because the agent tried one way, then it tried another way." It keeps going until it runs out of paths and reports back.

I've watched this happen on my own work. On a tight engagement I handed some setup work to an agent. It checked what it had, figured out which three ways were closed, and took the fourth. It never asked me to grant anything. Helpful? Yes. Also a little unsettling.

People don't operate like that. Most of us couldn't list every access we hold. An agent can, and it acts on all of it. So read your agent's permission set as if every line will get used. It will.

2. Intent matters more than static rules

Intent runs through this whole conversation. Nadav's view: "you can't today with English language being the protocol really solve security for agents without really understanding what stands behind the request."

He walked through a case where Eve caught an agent trying to pull an entire database by calling get user by ID over and over, far past anything it does on a normal day. One request looks fine. The pattern is the problem.

He also pointed out that a lot of agents don't wait for a prompt. An autonomous agent picks up an event, starts a root cause investigation, and if a service doesn't answer, it may start restarting, updating, or changing things to get its answer.

Static guardrails can't keep pace with that. I see companies go all in on AI and end up with tens of thousands of agents within 30 to 60 days. Nobody hand writes rules at that speed.

3. MCP lets tools act in systems nobody planned for

This part stuck with me. Nadav's point is that "the author of that AI agent cannot comprehend all the use cases or systems it could be connected to" once MCP is in the picture.

His example: people connect Cursor to Salesforce to ask about their sales forecast. Nobody building a coding tool designed for that. If the MCP server exposes actions, "Cursor can take action in Salesforce. That's the scary part."

My takeaway for practitioners: inventory your MCP connections. Check which servers expose write actions. Treat any server that can act like any other privileged integration. Nadav mentioned customers who now require MCPs to pass set criteria before anyone can use them.

4. The agent that asked for delete

I told Nadav about hooking agents up to my GitHub repos. One of them tried to slip in permission to delete a repo. I asked why. Its answer, roughly: if the code looked too inefficient, sometimes it's easier to delete it and start over.

A human engineer would never do that. You fix the code and keep the repo. And this isn't hypothetical. A friend of mine building a real product had an agent decide a repo needed a fresh start. It wiped it. That cost him three months.

Nadav's answer is baseline policy. Eve supports global policies, such as requiring every governed agent to comply with HIPAA, and builds baselines of how a given agent tends to behave across environments. On something like deleting repositories: "People typically don't do this, and if they do it then it's only specific people." So don't hand that ability out by default. The goal is finding the point where you aren't so restrictive that developers can't work, and aren't so permissive that one bad call costs you a quarter.

5. Session tainting: privileges that change mid-session

Session tainting was new to me. Nadav described it as the ability to "look at a session and determine in that session if privileges should be expanded or reduced."

His example was simple. A customer wants to block bulk deletes, so the rule is: "Let's not allow more than two deletes." An agent asked to clear out a set of Jira tickets starts going one by one, and after two, it's stopped.

What taints a session can be the data the agent saw or the actions it already took. Nadav tied this to chaining, too. Risky actions usually come after certain earlier steps. If an agent skips those steps, Eve raises a flag.

6. Prevention, AI studios, and small teams

We also covered:

• Auto-remediation in AI studios. When someone spins up a new agent in a studio, Eve routes what it does through Eve's decision point automatically, so admins aren't chasing new agents by hand.
• AI prevention. This means pushing agent-focused policies into tools you already run, like having your EDR block an agent you don't want, or a firewall stopping an agent from reaching an internal resource. Nadav said this is in beta, with a goal of opening it to all customers toward the end of the year.
• Small security teams. Most teams have fewer than ten people. Nadav talked about one-click connectors for stacks like Databricks, Microsoft, AWS, and OpenAI, so setup doesn't turn into a two-year IAM project.

We closed on a sobering note. Nadav expects companies to hand agents more sensitive work, and said: "we're going to have that cataclysmic event. It's going to happen at some stage."

The short version

Whatever permissions you gave that agent, assume it will use them. Know what it's trying to do, watch what it does inside each session, and cut its access when the session goes sideways.

Watch the episode

▶ Watch "Your AI Agents Will Try Every Permission You Gave Them" on YouTube

Full episode: https://www.youtube.com/watch?v=xyGFg3snH-c

New to the arc? Start with Part 1.

About Eve Security

Eve Security builds runtime security for enterprise AI agents. In its own words, its mission is "providing visibility, control, and protection over AI agents across the enterprise." The company was founded by Nadav Cornberg (Co-founder and CEO), Sharon Eilon (Co-founder and CRO), and Amit Eliav (Co-founder and CTO).

Want to see where your own agents stand? Eve offers a free AI risk assessment through the contact form at eve.security.