How agent security differs From WAAP (and what to do about it) | Harness Blog

Gartner projects that by 2028, the average Fortune 500 company will have 150,000 AI agents operationally in play. That scale alone should give security teams pause — but the more urgent problem, according to this Harness and ActualTech Media webinar, is that AI agents don't fail the way web applications and APIs fail. Protecting them with the same web application and API protection (WAAP) playbook misses what's actually different about an agent as an attacker's target.

AI is changing the threat model, not just the attack volume

The numbers back up the urgency: vulnerability discovery tied to AI systems is climbing at a 270% quarter-over-quarter rate, according to Mythos data cited in the session. That's not simply "more of the same attacks, faster." AI is enabling attacks that are more sophisticated and harder to detect than the injection and abuse patterns WAAP tools were built to catch.

Attacks that a traditional WAF was never built to catch

The session walked through attack types that don't map onto a conventional web application firewall's rule set at all:

• Prompt injection — manipulating an agent's instructions through its inputs rather than exploiting a code vulnerability
• Goal hijacking — redirecting what an agent is trying to accomplish without ever touching its underlying code
• Unauthorized tool use — getting an agent to invoke a tool or API it should never have reached
• Chained vulnerabilities — multiple minor weaknesses combined into a zero-day-class attack path

None of these show up as a malformed request or a known attack signature, the traditional triggers a WAF is tuned to catch.

A three-part defense for agentic systems

The session laid out a defense strategy that’s uniquely capable of defending against these newer threats:

• Unified protection — secure APIs, AI, and agents together as one connected surface, rather than protecting each in isolation with a different tool. Trying to defend AI in isolation from other connected systems will result in gaps that attackers can exploit.
• Shift left and shield right — build security checks into agent development from the start, and maintain active protection through runtime, rather than treating security as a pre-launch gate only. Relying only on runtime protection removes a key tool from the toolkit, since risk scoring, testing, and red teaming can all harden defenses and improve security posture.
• Continuous forensic observability — monitor what an agent is actually doing against what it's expected to do, on an ongoing basis, so deviations surface as they happen rather than after an incident review. It’s important to note that this requires visibility into each agent’s ecosystem of LLMs, MCPs, and APIs, since the agent’s remit should include a list of what connections and tool calls are explicitly allowed.

What practitioners said they'd actually do differently

When polled on what they'd change given what they now know, attendees overwhelmingly picked one answer: spend more time testing. It's a candid admission that mirrors a pattern security teams have seen before with new technology adoption: testing often gets deprioritized under launch pressure, and the gap only becomes visible after something goes wrong.

The takeaway for security teams

Treating agent security as "WAAP, but for AI" undersells the problem. Agents introduce attack types — prompt injection, goal hijacking, unauthorized tool use — that a conventional WAF was never designed to see, at a scale (150,000 agents per organization by 2028) that most security programs haven't sized for yet. Unified protection across APIs, AI, and agents, security built in from the start rather than bolted on, and continuous behavioral observability are what actually close that gap.