Google Cloud Releases 2027 Security Trends: Proposes 'Beyond Zero' Architecture to Manage AI Agent Risks
Google Cloud predicts AI will reshape cyber defense and offense, introducing the 'Beyond Zero' framework to limit AI agent permissions and warning of shadow agents and LLM hijacking.
U.S. cloud provider Google Cloud released its 2027 enterprise security trend forecast on November 12, 2026, stating that artificial intelligence will further reshape the cybersecurity landscape. On the defensive side, AI agents are expected to assist Security Operations Centers (SOC) in automatically investigating and handling incidents; however, on the offensive side, software supply chain contamination, data extortion, and abuse of AI models and cloud computing resources will become primary threats.
To address risks arising from excessive permissions granted to AI agents, Google Cloud proposed the "Beyond Zero" security architecture. This approach argues that enterprises cannot merely verify whether a user or AI agent has permission to access an application; they must also restrict accessible resources and executable operations based on security policies and real-time risk. This shift aims to prevent attackers from using techniques like prompt injection to induce high-permission AI agents to execute malicious actions and move laterally across other enterprise resources.
The report also highlighted management blind spots caused by "Shadow AI Agents." As employees or departments build AI agents without integrating them into IT security management, these agents may unknowingly access sensitive data or consume cloud resources. Google Cloud recommends limiting tool usage permissions for such agents and tracking their compute usage and costs. Additionally, Mandiant, a subsidiary of Google, disclosed "LLMjacking" attack cases, showing that attackers use stolen API keys to impersonate enterprises and call large model services, with some victims accumulating up to $1 million in unauthorized fees.