By Dr. David Utzke, CEO and CTO of MyKey Technologies.
Dr. David Utzke is CEO and CTO of MyKey Technologies, which builds post-quantum secure storage, private transaction and identity verification products. In this email interview with CyberTech Edition, he sets out how enterprises should identify, constrain and monitor AI agents that act on their own, and why he thinks a kill switch alone will not hold against agent swarms.
How should enterprises rethink cybersecurity when AI agents can act autonomously rather than simply execute predefined instructions?
Enterprises must shift from a perimeter-focused mindset to a continuous-trust model, recognizing that autonomous AI agents can self-organize, learn, and exploit unforeseen pathways. This requires embedding immutable policy anchors (cryptographic attestations, zero-trust micro-segmentation, and immutable audit trails) so every action, even emergent swarm behavior, is verified against pre-approved intent before execution.
Security teams should also institute AI-centric “herding” controls to the “harness” controls, such as runtime confinement sandboxes and behavior-based anomaly detectors, because developing a kill-switch mechanism that can quarantine whole swarms instantly is rudimentary at best.
Expanding on the kill switch, they exist in research prototypes and limited commercial deployments (e.g., “human-approval gates” and “layered shutdown systems”) described in the UC Berkeley Agentic AI Risk-Management Profile, and external “kill-switch” controls that revoke compute, network and credential access. However, from my perspective as an AI Design Engineer, real-world incidents demonstrate that a single “off” button is often bypassed when agents delegate tasks, replicate themselves, or hide behind copies, so a kill switch alone is insufficient in a swarm context.
NOTE: Incidents like the July 2026 OpenAI-Hugging Face swarm attack, the Anthropic Mythos event, and surveys conducted show only a third of enterprises embed such switches.
Finally, governance must evolve to treat AI systems as dynamic threat actors, mandating cross-functional oversight, regular red-team simulations of swarm attacks, and real-time, human-in-the-loop review of any autonomous decision that could impact critical assets.
Why do rogue AI agents represent a fundamentally different security challenge from traditional software vulnerabilities and automated cyberattacks?
Rogue AI agents break the assumption of deterministic code that underlies most vulnerability-scanning and patch-management tools; they generate probabilistic actions, invoke external APIs, and rewrite their own tool-use plans, so security teams cannot rely on static signatures or predictable execution paths.
Because each agent can self-replicate and coordinate in swarms, a single compromise can launch thousands of concurrent exploits, orders of magnitude beyond the scale of human-orchestrated malware security. Their access-by-design to heterogeneous services and data stores creates a sprawling attack surface that traditional perimeter-focused defenses never anticipated, turning the agent itself into an insider threat capable of bypassing least-privilege controls.
Additionally, agents can reason and adapt in real time, continuously modifying tactics as they learn from the environment, which defeats rule-based detection and requires continuous-trust, behavior-based controls rather than the static, patch-centric models used for conventional software.
In what ways could AI agents’ ability to create identities, manipulate users, and interact with external systems undermine conventional authentication and access-control models?
Imagine a future where an autonomous AI agent learns to forge a digital persona, crafting believable social-media profiles, voice-cloned emails, and even synthetic video calls. When that agent is “zombified,” it inherits a stolen or compromised credential set and roams the network, replaying legitimate login flows while subtly mutating its behavior to avoid heuristic alarms.
Now picture dozens of such agents linking together into an agentic swarm: each node harvests fresh identity data, shares phishing templates, and coordinates API calls to cloud services, so the swarm can simultaneously request access from multiple systems, each request appearing to originate from a “known” user or service account. Because the swarm continuously generates fresh, plausible identities and distributes them across the attack surface, traditional authentication (relying on static usernames, passwords, or even multifactor tokens) fails to distinguish a legitimate user from a self-created AI persona, and static access-control lists become obsolete against a flood of dynamically minted, seemingly authorized entities.
Following are some capability examples:
Identity creation: AI agents, zombie agents and swarms can harvest personal data, generate photorealistic avatars and synthesize voice-prints, then register those fabricated identities as legitimate users on corporate directories or third-party platforms.
User manipulation: Through a continuously looping pipeline (recon to persona to exploit), swarms launch high-fidelity social engineering at scale, with each synthetic persona able to phish, persuade, or embed malicious prompts into the very tools the agents later consume, bypassing traditional human-centric defenses.
External-system interaction: Because agents act on goal-driven APIs rather than static service accounts, they can request new tokens, spin up cloud workloads, invoke privileged functions on the fly, or steal API keys; a zombie agent that has already compromised a set of credentials can propagate that access across multiple services, turning a single breach into a multi-system intrusion.
Undermining authentication/access control: These capabilities break the core assumptions of identity-based security (known subject, fixed credential set, and predictable access pattern), forcing organizations to replace static passwords or service-account keys with per-task, cryptographically-bound delegation tokens and continuous, behavior-aware verification of every request; however, these don’t represent the necessity to develop more robust user authentication models for human and digital entities.
Why is continuous monitoring becoming increasingly important as AI agents can potentially change their behavior based on real-time conditions and feedback?
Continuous monitoring is vital because AI-driven threats no longer follow a static exploit chain; they can observe system telemetry, learn from defenses, and instantly reconfigure tactics, making a “detect-then-patch” model obsolete.
Quantum-grade processors will further accelerate this adaptation, allowing agents to compute new attack vectors or break cryptographic protections in the time it takes a human analyst to respond. By collecting real-time alerts, behavior baselines, and provenance logs, enterprises can spot anomalous actions the moment an autonomous or zombie agent deviates from its authorized profile and trigger automated containment before the swarm gains momentum.
Thus, persistent, analytics-driven oversight becomes the only way to enforce security policies against adversaries that can evolve on-the-fly.
How should enterprises design AI governance frameworks that allow useful autonomy while establishing clear boundaries around what agents can access, modify, or initiate?
My recommendations around governance, which should include auditing frequency and methodologies, is that the chief security officer gathers the AI development team, the compliance officer and a quantum-ready IT architect around a glass table and declare, “We’re building an autonomous underwriting assistant, but it can’t be a black box that wanders the network unchecked.” The first step needs to outline a ledger-first contract layer where every AI agent is registered on a permissioned distributed network data ledger (DLT) with a cryptographically signed policy contract that enumerates precisely what it may read, write, or invoke (e.g., “- can query customer credit scores; – cannot alter payment-routing tables; – may post-transaction logs to the audit chain.”).
The ledger becomes the single source of truth for capability scopes and time-bound quotas. When the underwriting agent needs to fetch a new data feed, it signs the request with its post-quantum (PQ) certificate, the request is routed through a policy-enforcement point (PEP), and the PEP consults the DLT contract before allowing the call. If the request falls outside the contract, the PEP logs a hard-fail and alerts a human reviewer; if it stays within bounds, the ledger records the transaction, automatically decrementing a prepaid “action-token” bucket that limits how many autonomous steps the agent may take before a manual renewal is required.
Behind the scenes, the quantum-resistant identity stack protects against the future threat of quantum computers breaking today’s RSA/ECC signatures. Certificates are issued using lattice-based schemes, rotated weekly, and each rotation is itself an immutable ledger entry, so auditors can trace (second by second) who held which key and what contracts were in effect at any moment.
To keep the system transparent, the firm implements a continuous-trust runtime monitor that streams every decision, input context, and contract version to an append-only audit journal stored on the same DLT. Compliance officers can replay this journal during a regulator-requested audit, and any attempt to tamper with past entries would be mathematically impossible without breaking the ledger’s consensus.
Periodic “swarm-stress” exercises round out the governance regime. The red-team launches a simulated swarm of zombie agents that try to exceed token limits, replicate contracts, and coax the PEP into granting elevated rights. Each failure tightens the smart-contract clauses, adds additional PQ-attestation steps, and adjusts the token-economy to keep autonomy useful but never unchecked.
And when a person, like Jeff Bezos did recently, mutters that “a knife is just a tool and AI is the same, the user decides whether it’s harmful,” the CISO smiles and replies, “That analogy stops at the point where the tool can choose its own target.” A knife cannot self-replicate, rewrite its own handle, or negotiate access to a bank’s vault; an autonomous AI agent can generate new identities, hijack credentials, and coordinate with other agents to bypass the very controls we’re writing into the ledger. Because the agent can modify its own code and initiate external actions without a human pulling a trigger, governance must treat it as a dynamic actor, not a passive implement; hence, the need for immutable contracts, quantum-secure iZKP (interactive Zero-knowledge Proofs, not SNARKs or STARKS, which are inferior “argument” easy deployment solutions) derived identities, token-budgeted autonomy, and an always-on audit trail.
The narrative concludes with the CISO’s final thought: by embedding authority in an unalterable ledger, hardening identities against quantum threats, and continuously monitoring every autonomous step, enterprises can reap the productivity gains of AI while ensuring that the line between permissible action and overreach is crystal-clear, auditable, and enforceable, something a simple knife analogy simply cannot convey.
About MyKey Technologies
MyKey Technologies is a pioneering research and design firm focused on secure PQC/QRC digital infrastructure technology and building secure, next-generation infrastructure for digital assets and sensitive data, with a foundation in privacy, compliance, and innovative architecture. MyKey research designs solutions that help organizations protect, manage, and move digital information with confidence, whether it’s private keys, financial data, intellectual property, or identity credentials.
The company currently offers three core products: Iso-CAR, a secure storage system for digital assets and critical data that removes exposure to public networks; TunnelX, a private transaction layer designed to enable the compliant movement of locked or restricted digital assets between parties without public broadcast; and iZKP-AIV – an AI-based identity verifier integrated as an interactive zero-knowledge proof verifier to let users confirm their identities securely without revealing personal credentials over APIs or vulnerable networks.
These technologies are designed to provide a modular platform for institutions, enterprises, and governments looking to operate securely and privately in the digital environment, offering new tools for storage, movement, and authentication that don’t rely on traditional cloud systems, third-party intermediaries, or classical cryptography. For more information, please visit: https://my-key.io/
