Rules and risks

How the rules work

No law tells a product how to let agents in. Security agencies wrote guidance before anyone wrote binding rules, and the binding rules that exist were written for something else and touch agents at the edges.

NIST and CISA. NIST IR 8587, final in September 2026 and written with CISA, says access and identity tokens should be valid for no more than an hour, workload tokens must be tightly scoped and short-lived and should be bound to their holder, and long-lived static credentials should give way to workload identity. It's voluntary outside US federal systems and says plainly it isn't a guide to agent risks. NIST's NCCoE project on agent identity drew more than 600 responses to its February 2026 concept paper and has no draft yet. CISA, the NSA and four allied agencies published joint guidance on May 1, 2026 that puts privilege first among agent risks and asks for a verifiable identity per agent, temporary credentials for sensitive actions, human approval for high-impact actions and clear accountability. It's non-binding, and I'd expect security questionnaires to quote it.

The MCP specification. The spec has no legal force. After an incident, though, its "must" rules (audience checks, no token passthrough) are what an expert witness would quote.

EU. The AI Act's transparency article has applied since August 2, 2026: systems that interact directly with people must say they're AI. The text never mentions agents. The new Product Liability Directive covers software placed on the market after December 9, 2026, and the eIDAS 2.0 wallets due by the end of 2026 say nothing about agents.

Payments. US Reg E and Reg Z protect consumers against transfers and card use by someone without authority, and PSD2 and the UK's 2017 regulations do the same; none mentions agents. The UK's FCA said in March 2026 it's working with the Treasury on whether payment rules need to change for agentic AI, and PSD3 won't apply until around 2028.

What mistakes cost

Let's say an AI sales-assistant vendor stores OAuth refresh tokens for 1,000 customers' CRMs, at $12,000-60,000 a year each, and an attacker exports data from 300 of them before revocation (the Drift shape). Rough arithmetic on my assumptions:

• The damage: 100-500 staff hours per affected customer for forensics, rotation and notification, at $100-200 an hour, is $10,000-100,000 each, or $3-30 million across the 300. Cloudflare's own Drift response shows the work: it found 104 API tokens in the exported support cases and rotated all of them.
• What they get back: terms that cap liability at 12 months of fees and exclude lost data mean that even if all 300 sued and won, they'd share at most $3.6-18 million. A customer paying $12,000 a year with $50,000 of clean-up recovers at most a quarter of it.
• Who else gets pulled in: the CRM platform, as Salesforce was after Drift.
• What prevention costs: sender-constrained tokens, hour-long access tokens and short refresh tokens are engineering time, with no licence fee attached.

The record so far:

Every major lab and cloud has had a flaw of this kind reported: Anthropic's MCP Inspector and Git MCP server, OpenAI's ChatGPT connectors, Microsoft 365 Copilot, Google's Antigravity coding tool, AWS's Amazon Q extension. No company published a dollar loss for any of them; the cost shows up as clean-up hours, lawsuits and product changes made afterwards.