AI Agents Amplify Data Security Gaps, Forrester Says

AI agents retrieve, interpret and act on information, reshaping how data security is debated. Forrester notes that “agentic AI adds speed, scale, and new dependencies” to longstanding challenges of locating sensitive data, controlling access and preventing misuse AI Agents Aren’t Waiting For Data Security.

Existing Weaknesses Become Critical

Unclear classification, uncertain ownership, inconsistent permissions, incomplete lineage and questionable data quality are already problematic. When an autonomous agent can traverse multiple repositories, those flaws become “more consequential,” according to the author. Prompt-inspection and response-blocking are necessary but insufficient because security does not own decisions about data accuracy, retention or suitability for AI use cases.

AEGIS Framework’s Eight Controls

Forrester’s AEGIS model outlines eight controls within the data security and privacy domain. The controls blend technical measures with process and practice, demanding coordination among data, privacy and AI-engineering stakeholders. Security teams typically begin with data classification, using it to build consistent inventories before expanding to policy enforcement for AI-agent access and downstream actions.

Prioritising Direct vs. Collaborative Risks

The article urges security leaders to distinguish risks they can mitigate directly—where autonomous behavior is too risky—from those that require alignment with data-governance and privacy functions, each at varying maturity levels.

Our read: The analysis underscores that AI agents do not create new data-security problems but accelerate exposure of existing governance debt. Organizations that already struggle with classification and lineage will see those gaps exploited at scale, making the AEGIS emphasis on cross-functional controls a necessary, if not sufficient, response.