ThreatLocker announced Zero Trust AI Control (ZTAIC) on 21 October 2026, a tool that governs what an AI agent can access, execute and connect to from outside the agent itself (Help Net Security, 21 October 2026). The design choice is the point: because the controls sit externally, they hold even if the agent behaves unexpectedly, rather than depending on the agent to police its own behaviour.
ThreatLocker CEO Danny Jenkins framed the shift plainly: AI agents "aren't just providing information anymore" — they now take actions across an organisation's environment, invoking other applications, scripts, browsers and services in multi-step workflows (Help Net Security, 21 October 2026). ZTAIC ships with pre-built policies that security teams can adopt and then tailor, and it works alongside ThreatLocker's existing Allowlisting and Web Content Control products, which already govern which AI applications and browser-based AI services are permitted in the first place.
Why this is not an isolated product launch
The premise behind ZTAIC — that an agent's own guardrails are not a sufficient control — has independent support.
A Milliman white paper on securing AI agents, published 13 August 2026, describes a red-team exercise by the Israeli AI-security firm DeepKeep against a fictional travel-booking agent, using only its public endpoint and no code access. The team bypassed the agent's guardrails consistently with simple prompt manipulation, producing nine distinct findings across prompt injection, unauthorised data access, tool misuse and business-logic abuse, mapped to OWASP's agentic-AI risk categories. One example: an attacker used a fabricated system instruction and an emotional appeal to get a free hotel night authorised with no real approval behind it. Milliman's paper concludes that "the current guardrail approach is therefore not robust enough for production deployment," and recommends layering controls at the input, tool-execution, output and monitoring stages rather than relying on one check the model performs on itself (Milliman, 13 August 2026).
The scale of exposure is growing alongside the agents. C1's 2026 Future of Identity Report, published 10 March 2026, found that 95% of surveyed organisations now have AI agents performing IT or security tasks autonomously, and that 80% of organisations suffered at least one identity-related breach in the past year (C1, 10 March 2026). Agents that act autonomously need credentials and reach to do so, and that reach is exactly what external controls like ZTAIC, or governance built into the agent's own operating environment, are meant to bound.
What it means for a regulated enterprise
An agent that can invoke other applications and processes is, functionally, a new actor inside the network with its own access path. Under the EU AI Act's record-keeping obligations, an organisation has to be able to say what an AI system did; under NIS2, cybersecurity risk management carries personal management accountability. Both assume the organisation can point to a control that constrained the agent and show it held, not merely that a policy document described the intended behaviour.
That assumption breaks if the only thing standing between an agent and a sensitive action is the agent's own instructions. Prompt-level guardrails are text the model is asked to honour. They degrade under adversarial input exactly the way DeepKeep's red team showed, and an auditor or regulator asking "what stopped this agent from doing X" will not accept "we told it not to" as an answer when the agent runs untouched in production.
The exposure is sharper for agents that touch multiple systems in one workflow — the pattern ThreatLocker specifically calls out. A support agent that can read a ticket, query a database and send an email has three separate places where an instruction embedded in attacker-controlled input (a ticket title, a document, a webpage) can hijack the chain. External control has to intervene between the decision and the action, not just at the model's input.
What actually addresses it
The mechanism that matters is enforcement outside the reasoning loop: a layer that checks what an agent is permitted to touch, independent of whatever the agent currently believes it should do, and that cannot be argued out of its decision by a cleverly worded prompt. ThreatLocker's approach does this with allowlisting and application-level control at the execution boundary. Milliman's recommendation — layered checks at input, tool execution and output, plus logging of every tool call — describes the same shape of defence from the security-engineering side: assume the model's judgement will be wrong or manipulated some fraction of the time, and put the control where that failure cannot reach.
The second piece is a record. A control that blocks an action is only auditable if the attempt and the block are both logged. Without that, a security team can tell you the policy exists but not what it actually stopped last week.
How AANCER answers
AANCER enforces agent boundaries the same way, outside the model's own reasoning. Each Certified Agent runs under a signed passport issued by your own per-install certificate authority, naming the tools, data and spend it may reach — a scope decided before the agent runs, not negotiated with it mid-conversation. Revocation takes effect in under 30 seconds and does not depend on the agent cooperating or on redeploying anything.
Every tool call and data access an agent makes is written to an append-only, tamper-evident audit ledger, so a security team can show what an agent actually did rather than what its policy said it should do. Where an action is consequential, a human approval gate sits between the agent's decision and its execution, and that approval is recorded alongside the action it authorised.
What to check on Monday
List every agent currently running in your environment and ask, for each one, whether the thing stopping it from a dangerous action lives inside the agent's own prompt or outside it in infrastructure you control. If the answer is "inside," you have a guardrail, not a control, and the DeepKeep findings suggest how quickly that guardrail bends under a motivated adversary. Then check whether you have a log of what each agent actually did in the last 30 days, independent of what it was approved to do — if you cannot produce that log today, that is the gap to close before the next audit asks for it.
Sources - ThreatLocker adds external controls for AI agent access and execution — Help Net Security, 21 October 2026 - Securing AI agents: Assess technology vulnerabilities through red teaming — Milliman, 13 August 2026 - 2026 Future of Identity Report — C1, 10 March 2026
Related guides
Compliance
The EU AI Act Article 12 readiness guide
What record-keeping and human-oversight obligations actually require operationally from August 2026 — and the evidence an auditor will ask you to produce.
9 min read
Read the guide →Risk
The credentials nobody reviews
Your AI agents hold OAuth tokens, API keys and service accounts that went through no approval process. The agent was reviewed. The studio was reviewed. The identity behind them was not.
5 min read
Read the guide →Security
When the agents organised themselves: what the Hugging Face swarm means for accountability
Roughly 700 AI agents divided labour, traded favours and compromised production infrastructure across four regions. The uncomfortable part is not that it happened — it is that the account of what happened had to be reconstructed afterwards, by outside parties.
6 min read
Read the analysis →