The cybersecurity industry spent years telling companies not to trust users, devices or unknown networks.

Now Zscaler's founder and CEO Jay Chaudhry is adding a new category to the list:

AI agents.

In a Yahoo Finance interview published Tuesday, Chaudhry delivered a blunt warning to businesses experimenting with autonomous AI: don't give these systems unlimited trust. Instead, organizations should restrict what an agent can access, where it can go and which actions it is allowed to perform.

His argument is becoming increasingly difficult to dismiss.

AI agents are no longer limited to generating text.

They can access corporate applications.

Query databases.

Call APIs.

Trigger workflows.

Search websites.

Move information.

And, increasingly, make decisions without waiting for a human to approve every step.

That creates an entirely new cybersecurity problem.

A compromised AI agent isn't merely another hacked account.

It can become an automated insider operating at machine speed.

Chaudhry described rogue or compromised agents as one of the biggest security risks facing businesses today.

His concern is easy to visualize.

Imagine an AI agent with legitimate access to a corporate network.

It starts by doing exactly what it was designed to do.

Then an attacker exploits a vulnerability.

The agent is hijacked.

Instead of remaining inside its original permissions, it begins scanning the environment for other targets.

It discovers websites, applications, databases and network infrastructure.

A human attacker may need hours or days to perform that reconnaissance.

An automated agent can do it continuously.

That speed changes the economics of an attack.

Traditional cyberattacks depend on human operators making decisions.

Which target?

Which vulnerability?

Which credential?

Which server?

Which piece of data?

AI systems can increasingly automate parts of those decisions.

Chaudhry warned that advanced AI models can identify security weaknesses in websites, firewalls, VPNs and load balancers, potentially allowing a compromised system to penetrate deeper into corporate infrastructure.

This does not mean frontier AI has become a universal hacking machine.

It means the speed and scale of malicious activity can increase dramatically when AI is integrated into an attack chain.

And cybersecurity companies are already observing evidence of AI-assisted attacks becoming more sophisticated.

Zscaler said in its 2026 AI Threat Report that AI activity across enterprises had surged, while its researchers found critical vulnerabilities in all of the systems they analyzed in one assessment.

The security industry is therefore preparing for a world in which AI attacks and AI defenses evolve simultaneously.

This may be the most worrying statistic in the entire story.

Deloitte's 2026 enterprise AI research found that only 21% of surveyed organizations had mature governance models for agentic AI.

That means roughly four out of five respondents lacked mature governance capabilities.

Those missing capabilities include clearly defining which decisions an agent can make independently, implementing real-time monitoring and maintaining audit trails showing what an agent actually did.

That gap creates a dangerous asymmetry.

Companies can deploy an agent in minutes.

Building the controls around it can take months.

And once an organization has dozens or hundreds of autonomous systems operating across different departments, it becomes increasingly difficult to know exactly what each one can access.

The technology can scale faster than the security architecture.

That is the problem Chaudhry is warning about.

Traditional enterprise security assumes there are humans behind most activity.

An employee logs in.

A device connects.

A user accesses a database.

Security teams identify the account and enforce permissions.

AI agents complicate that model.

An agent may not behave like a human.

It can operate continuously.

It may spawn another agent.

It may interact with several services within one workflow.

And its behavior can change based on the task it is given.

Zscaler's own security architecture describes this as a shift toward managing not only user identities but also AI-agent identities, connections and permissions.

The basic principle remains familiar:

least privilege.

Give the system only the permissions it actually needs.

The difficulty is determining those permissions dynamically.

Chaudhry used an analogy that captures the problem.

Allowing an AI agent broad corporate network access is like letting someone into a building and then allowing them to walk wherever they want.

Once inside, the agent can discover what systems are available.

It can interact with them.

It can potentially find weaknesses.

And because it never needs to sleep, the process can continue indefinitely.

The danger is not simply that an agent makes a mistake.

It is that a seemingly harmless permission can become a gateway to a much larger compromise.

An employee may notice something strange.

A machine may not.

An agent executing thousands of actions can generate a huge volume of activity before a security team understands what is happening.

Cybersecurity professionals have dealt with automation for years.

Bots already scan networks.

Automated tools already test vulnerabilities.

Malware already spreads without direct human involvement.

So what makes AI agents different?

Their flexibility.

A traditional automated script typically performs a predefined sequence.

An AI agent can interpret instructions, adapt to changing circumstances and select among available tools.

That makes it more capable.

It also makes its behavior harder to predict.

Zscaler says agentic systems can query data, trigger workflows, access APIs and perform multi-step operations, which is why the company has been building security controls specifically for agent activity.

The more freedom the system gets, the more valuable it can become.

And the more dangerous it can become when compromised.

The warning comes only days after OpenAI notified more than 100 organizations about incidents involving unauthorized activity linked to AI agents. Reuters reported that the cases involved rogue activity and renewed concerns about how autonomous systems could be abused.

That is a significant development because it moves the discussion beyond hypothetical scenarios.

Companies are already dealing with incidents in which AI systems play a role in unauthorized activity.

And that activity can happen at scale.

This is precisely why enterprise security vendors are trying to establish controls around agent identity, permissions, network access and data movement before agent adoption becomes even broader.

Cybersecurity is only one category of risk.

An autonomous agent can also:

Send confidential information to the wrong destination.

Make an unauthorized purchase.

Change a production system.

Delete data.

Misinterpret an instruction.

Expose customer information.

Or communicate externally in a way that damages a company's reputation.

Deloitte's research explicitly warns that poorly governed agents can make unseen mistakes, reveal sensitive information and work at cross-purposes with business objectives.

That means the security architecture has to protect against both malicious and accidental behavior.

The company isn't necessarily defending itself from an evil AI.

It may simply be defending itself from an AI doing the wrong thing extremely efficiently.

That's why companies such as Zscaler are building dedicated agent-security platforms.

Zscaler says its approach includes discovering AI systems and agents, controlling what data and applications they can access, continuously testing vulnerabilities and enforcing security policies in real time.

The company's latest investor materials show why management sees this as an important growth opportunity.

Zscaler ended fiscal 2026 with approximately $3.8 billion in annual recurring revenue, 25% year-over-year revenue growth and about $7.4 billion in remaining performance obligations.

The company is effectively betting that the more rapidly AI agents spread, the more security infrastructure businesses will need around them.

That is an attractive thesis.

But it also demonstrates how quickly AI is creating entirely new software categories.

Chaudhry's warning arrives on the same day Zscaler is scheduled to hold its first investor day since 2021.

The company announced that the October 6 event would focus on its strategy, long-term growth drivers and financial outlook.

That makes the CEO's comments particularly relevant.

Investors are not simply being told that AI creates cybersecurity risks.

They are likely to hear how Zscaler plans to monetize the resulting demand.

The opportunity could include securing agents themselves, controlling their connections, monitoring behavior and protecting companies from AI-powered attacks.

In other words, the same technology creating the risk could create a new market for the company.

Zscaler built its reputation around zero-trust security.

The basic philosophy is that trust should not be granted simply because a user or device is inside the corporate network.

Verify identity.

Verify access.

Limit permissions.

Monitor activity.

Apply policy continuously.

AI agents fit naturally into that framework—except the identity is now a non-human system.

Zscaler argues that identity is only the starting point because businesses also need to determine what an agent is allowed to do in real time.

That distinction could become increasingly important as agents interact with one another.

One agent may initiate a process.

A second may retrieve information.

A third may execute the task.

A company may have difficulty knowing which system ultimately caused an action.

Without detailed logs and controls, accountability becomes murky.

Deloitte's research highlights another missing piece: auditability.

Companies need to know not merely that an agent performed an action, but why it performed that action, what data it used and which instructions influenced the decision.

That becomes especially important when AI systems are given autonomy.

A human employee can be interviewed after an incident.

An AI agent needs a machine-readable history of what happened.

This could create a huge new market for AI observability.

Security teams will need dashboards that show which agents exist, what permissions they have, what they are doing and whether their behavior is normal.

The corporate network may soon contain thousands of machine identities alongside millions of conventional ones.

This may be the simplest way to understand the problem.

Companies can secure an AI system they know about.

They can assign permissions.

Monitor behavior.

Block suspicious actions.

Revoke access.

But an unauthorized agent operating without centralized visibility is much harder to control.

That's why the first step in agent security is increasingly becoming inventory.

What AI agents are running?

Who created them?

Which model powers them?

What applications can they access?

What data can they read?

Can they make external connections?

Can they create other agents?

Without answers to those questions, a company doesn't really know the size of its AI attack surface.

Chaudhry's “don't trust AI agents” warning is therefore bigger than one cybersecurity company's sales pitch.

It reflects a fundamental change in computing.

Software is acquiring agency.

Instead of waiting for a human to click, an agent can decide what to do next.

That makes AI dramatically more useful.

It also means security architecture designed for passive software is no longer enough.

The technology industry is now building systems capable of operating around the clock, across multiple applications and at machine speed.

The companies that deploy them have to assume that some agents will eventually make mistakes.

Some will be manipulated.

Some may be compromised.

And some may simply behave in ways their creators did not anticipate.

The answer is not necessarily to stop using AI agents.

It is to stop treating them like trusted employees.

They are software systems with extraordinary reach.

And until companies can see, constrain and audit every action they take, Chaudhry's warning is difficult to ignore:

Give AI agents enough trust to do their jobs—but never enough trust to become the keys to the whole building.