ReadingResearchRadarInvestment framework
Sign in / Sign up
← Back to reading
News2 min read·2026-10-21DisconfirmAI Editorial

Cisco AI Security Team: Generic Test Banks Cannot Find the Risk of Agents Being Exploited Through Normal Function

The Cisco AI security product team points out that AI agents hold credentials, call tools, and write to systems of record, making them no longer static features inside applications. A generic test bank can only find errors common to all agents; it cannot find the unique failure modes that arise because each agent has different permissions, tools, and purposes—for example, a support agent talked into refunding the wrong person is not a jailbreak but the agent doing its job.

ImportanceLocalEvidenceE2 unreplicatedWrite-upQuick

Original publication time 2026-10-21 04:59 GMT+8

Agents are no longer just features inside applications. They hold credentials, call tools, and write to systems of record. This means their security testing cannot follow the logic of traditional software scanning: run a test suite, read the results, fix what it found.

The Cisco AI security product team, in a blog post dated October 20, 2026, drew a specific distinction: a support agent talked into refunding the wrong person is not a jailbreak. It is the agent doing its job, except the beneficiary is now an attacker. A test bank written for every agent finds only what is wrong with every agent; it will not find the error unique to this particular agent.

This distinction explains why testing must start from context. A healthcare scheduling agent and a financial advisory agent fail in different ways, because they serve different purposes, reach different tools, and carry different permissions. The adaptive red-teaming process Cisco describes works as follows: first study the agent's purpose, the tools it can reach, and the guardrails already in place; then derive the outcomes that agent must never produce, and pursue them across many turns, pivoting when one approach is blocked. The question stops being whether the agent fails a known attack and becomes what an attacker who reads your documentation would try.

Sign in / Sign up
ReadingResearchRadarInvestment framework

Cisco also noted that standardized testing and adaptive testing each have a role: the former provides breadth against public frameworks (OWASP Top 10, MITRE ATLAS, NIST), yielding wide coverage, comparable results, and something an auditor can repeat; the latter provides depth on the agents that matter most. No one can hand-write a test plan for every agent in an enterprise, but if the goals are derived from each agent's own context, no one has to.

It should be noted that the above is Cisco's own description of its product methodology, with no independent verification data, comparative experiments, or third-party evaluation results attached. The Cisco–Workday partnership—Workday Agent Passport is currently in Early Access, with Cisco AI Defense serving as its launch assessor—is the first public practice case of this method, but its actual security effectiveness has not yet been independently verified.

Sources

  • Source materialblogs.cisco.com↗
Continue researching →