AI Security for Businesses: Securing AI Agents and Your AI Stack

AI security in a business today mostly means securing the access that AI agents, automations and AI-built applications work through: admin accounts, API keys and the software packages everything is built on. The most effective levers are phishing-resistant sign-in, least-privilege access for every agent, proper secrets management with rehearsed rotation, a controlled software supply chain and an AI-assisted security review before every go-live.

The week around 21 October 2026 showed why this is urgent. Within 24 hours there were emergency patches for two critical PHP vulnerabilities found with the help of AI, a supply chain attack on the widely used LLM gateway LiteLLM, and a security incident at the hosting provider Railway that led it to ask all customers to rotate their secrets. In this article you will learn:

• what happened in October 2026 and what it has to do with AI stacks,
• why AI is changing the threat landscape for mid-sized companies,
• which seven building blocks actually protect AI agents, n8n workflows and AI apps,
• what an AI-assisted security review can and cannot do,
• and which reporting duties apply when something goes wrong.

What happened in October 2026

The following incidents are publicly documented. They are listed here not for the headlines, but because each one shows a different attack path that can affect your company too.

As of 28 Oct 2026. For PHP2Shell, Tenable reported only exploitation attempts before the patch. Successful attacks have been reported since 24 October, and the US agency CISA has added both flaws to its catalogue of known exploited vulnerabilities. If you run PHP, update to 8.5.12, 8.4.27, 8.3.36 or 8.2.35. Versions before 8.2 no longer receive regular updates.

Why AI is changing the threat landscape

Three developments are coming together.

AI finds vulnerabilities faster, on both sides. Back in 2025, Google’s AI agent Big Sleep found a flaw in SQLite before attackers could exploit it (The Hacker News). PHP2Shell is the next, much bigger example. Attackers have access to the same models. The time between disclosure and first attack keeps shrinking, and Germany’s BSI already counted an average of 119 new vulnerabilities per day in its 2025 report (BSI).

AI keys are a target in their own right. API keys for language models can be monetised directly: whoever steals them runs expensive models on someone else’s bill. Railway and LiteLLM were about exactly these keys. A company running AI agents has more valuable secrets in circulation than it did two years ago.

Agents get real permissions. An AI agent reads emails, creates records and calls APIs. Through tool calling and MCP it is connected to many systems. Every access an agent has is also an access for anyone who compromises the agent or its keys.

The damage is real. According to Bitkom’s Wirtschaftsschutz 2026 study, cyberattacks now account for most of the annual damage from espionage and sabotage in the German economy (Bitkom).

Seven building blocks for a secure AI stack

The good news: most of the October attacks would have been stopped or heavily contained by measures that don’t require a large security team. The overview first:

1. Accounts: phishing-resistant sign-in

Most attacks don’t start with a zero-day but with a login. According to a Microsoft study, multi-factor authentication reduces the risk of account compromise by more than 99% (Microsoft Research). SMS codes and push approvals can still be phished, though. For the accounts everything depends on, use passkeys or hardware keys such as YubiKeys: code hosting (GitHub, GitLab), cloud and hosting accounts, domain and DNS, email admin, your password manager and your AI provider accounts.

The AI providers themselves rely on this. OpenAI now requires a hardware-backed passkey for access to its most cyber-capable features (OpenAI). Anthropic requires phishing-resistant MFA for organisations in its Cyber Verification Program (Help Net Security).

2. Software supply chain: don’t install everything immediately

A supply chain attack doesn’t hit you through your own code but through a package you trust. The tampered LiteLLM version was on PyPI for less than two hours. Affected were those who installed fresh in exactly that window or pulled a container image tagged latest. Anyone pinned to a fixed version was not affected.

Three simple rules follow:

• Pin versions and commit lockfiles. No latest tags in production, Docker images included.
• Monitor dependencies automatically. GitHub Dependabot flags known vulnerabilities and, since 2026, also detects malware in npm and PyPI packages (GitHub). Security updates should ship within days, not next quarter.
• Give new releases a little time. Dependabot now waits three days by default before proposing regular version updates (GitHub). Tampered packages are usually caught within hours. Security updates are exempt and arrive immediately.

3. Secrets: manage them, flag them, be able to rotate them

Secrets are everything systems use to identify themselves to each other: API keys, database passwords, tokens. Good secrets management has four parts:

• One place. Secrets live in the platform’s secret manager or a vault, never in code, a spreadsheet or a chat history with an AI assistant.
• Flagged correctly. In the Vercel incident, exactly the variables not marked as “sensitive” were affected. The flag takes one click.
• An inventory. A list of which key sits in which system, workflow and agent, and who can rotate it.
• Rehearsed rotation. After the Railway incident, customers had to replace all variables. If you have never done that, it takes days and causes outages. Walk through a full rotation deliberately once a year.

4. Least privilege for AI agents, n8n and MCP

The principle of least privilege is old, but it matters even more for AI agents. An agent that classifies invoices needs read access to the mailbox and write access to exactly one folder, not the admin rights of the account it was set up with. In practice:

• One credential per agent and workflow. No shared admin key for all AI automations. That way you can revoke one credential in an emergency without taking everything down.
• Only the scopes you need. Read instead of write, one table instead of the whole database. For MCP servers this means exposing tools deliberately instead of everything the API can do. More on how MCP works in our MCP guide.
• Limits at AI providers. Budget caps and separate projects per application, so a stolen key can only do limited damage.
• Human approval for critical actions. Payments, deletions or emails to customers go through a confirmation step, not full automation.

5. Platforms and your own servers

Large platforms like Microsoft, Google, Cloudflare, Vercel or Supabase invest in security at a scale no mid-sized company can match. For most applications, an established managed service is therefore more secure than a self-run server. Vercel and Railway show that these providers get attacked too. The difference: they disclose incidents, fix them quickly and give clear instructions.

If you run your own servers, for example for a local language model or a self-hosted n8n instance, minimum standards apply: no admin ports open to the internet, access only via SSH key and through a VPN such as Tailscale, a firewall that lets through only what is needed, and automatic security updates. The tools need maintenance too. Tailscale has already published 17 security bulletins in 2026 (Tailscale).

6. AI-assisted security review before every go-live

The same models attackers use to hunt for flaws can be used for defence. An AI-assisted security review goes beyond classic scanners: an agent reads the code in context, follows data flows and permissions and finds logic flaws no pattern scan detects. One example is the open-source tool deepsec by Vercel Labs. It first finds candidates by pattern, then has an agent investigate each spot, prioritises the findings and re-checks them.

The providers are opening dedicated programmes for vetted defenders, such as OpenAI Daybreak and Anthropic’s Cyber Verification Program. They give verified security teams access with fewer refusals for security-critical analysis. TAISC has been approved for Daybreak Blue, the first tier of OpenAI’s programme.

How an AI review compares to other checks:

An AI review does not replace a penetration test when you need one on record. It does make sure a pentest doesn’t get stuck on obvious holes. AI-built applications add typical weaknesses such as missing row level security, which we check with a dedicated checklist described in Taking vibe coding to production.

7. Incident plan and reporting duties

When a provider like Railway asks you to rotate all secrets, nobody should have to start by figuring out where they are. A one-page incident plan is enough: who decides, who rotates which keys in which order, where the logs are, who informs customers.

Then there are legal deadlines. Under the GDPR, personal data breaches must be reported to the supervisory authority within 72 hours. Germany’s NIS2 implementation act has been in force since 6 December 2025 and is estimated to affect around 29,500 companies, in many sectors from 50 employees upwards. And since 11 September 2026, manufacturers of products with digital elements must report actively exploited vulnerabilities within 24 hours under the EU Cyber Resilience Act (Jones Day). If in doubt about whether and how these duties apply to you, check with your legal advisers.

How secure is your AI stack?

How we work at TAISC

At TAISC, security is part of the project from the first line of code, not the week before launch. Every application we build goes through an AI-assisted security review before go-live. Agents and automations get their own least-privilege credentials, and secrets live in the platform’s secret manager.

Much of our review work concerns applications that companies have built themselves with AI. In the security check of a self-built intranet we ran, among other things, a secret scan across the entire version history, role-based tests and a prompt injection review of the internal AI assistant. In the security audit of a Lovable app we found two critical vulnerabilities before go-live and hardened the app instead of rebuilding it.

At TAISC in Karlsruhe, Germany, we build AI agents, automations and custom software, and we run them too. Whether it’s a security review before go-live, hardening an existing system or operations with updates and monitoring, you’ll find the ways we work together under Services.

Frequently asked questions about AI security for businesses

What does AI security mean for a business?

AI security has two sides: protecting AI systems themselves, meaning AI agents, automations and AI-built applications along with their access and keys, and using AI for defence, for example in security reviews. For most companies it starts with accounts, permissions, secrets and the software supply chain.

What is a supply chain attack?

In a supply chain attack, attackers don’t target your system directly but tamper with a software package or service you use. Whoever installs the tampered version brings the malicious code in themselves. One example is the tampered LiteLLM version 1.107.0 from 21 October 2026, which stole credentials. Pinned versions, lockfiles and a waiting period before new releases reduce the risk considerably.

How do I secure AI agents?

Give every agent its own credentials with minimal permissions, only for the systems and actions it really needs. Set budget limits at AI providers, have humans approve critical actions such as payments or deletions, and test agents that process external content for prompt injection.

What is least privilege?

Least privilege means every person, system and AI agent only gets the permissions the task requires. If one credential is compromised, the damage stays limited to that small area.

Does an AI security review replace a penetration test?

No. An AI-assisted security review finds many code flaws quickly and cheaply and fits before every go-live. A penetration test by experienced humans also covers configuration, infrastructure and chains of several weaknesses. Critical systems or regulatory requirements call for both.

What should I do if a provider asks me to rotate all secrets?

Take it seriously and act the same day. Rotate the keys with the widest permissions first, such as cloud and database credentials and AI API keys, then check the logs for unusual use. An inventory of which key is used where makes this step predictable.

What is OpenAI Daybreak?

Daybreak is OpenAI’s cyber defence programme. In the Daybreak Blue tier, verified defenders get access to the cyber capabilities of OpenAI’s regular models with fewer refusals for security-critical analysis. Daybreak Red, with purpose-trained cyber models, requires a separate application and is only open to selected organisations.

Conclusion

The week around 21 October 2026 showed where the security landscape is heading: AI finds vulnerabilities faster, attackers specifically go after AI keys, and even large platforms have to ask their customers for new secrets. For companies using AI agents and automations, the answer isn’t a big security programme but discipline on the basics: phishing-resistant accounts, least privilege for every agent, secrets that can be replaced in hours, a controlled supply chain and a security review before every go-live.

Do you run AI agents or automations and want to know where your biggest gaps are? Book a no-obligation intro call. We’ll look at your stack together and prioritise what to tackle first.