Fifty dollars a breach is the new price of a weak permission

A researcher told Reuters this week that one attacker used autonomous AI agents to probe more than 1,200 websites and break into over a hundred, at roughly fifty dollars of computing per success. The same week, NIST, the NSA and CISA published ten practices for agents that act outside their instructions: limit access, monitor continuously, be able to shut down fast.

Read together, those stories reset the economics of security. When an attack costs fifty dollars, every unnecessary permission is a liability with a price tag. Any business putting agents into its own systems should assume the people attacking it already have agents of their own.

At ELP GPT we decided early that an agent may read and draft, but nothing is sent, changed or deleted in a customer’s apps without the customer confirming it. Connectors request the narrowest scopes they can. That costs us some convenience in demos. It is also the reason a business can let us near its inbox.

My advice to operators: list every system your AI tools can write to, remove what is not needed this quarter, and put a human confirmation in front of the rest. It is the cheapest security spend you will make this year.

— Edgar Melo Costa, founder

Founder’s notes are opinion. They are not investment, legal or professional advice.