# The Agentic AI Squeeze: How SMBs Are Caught Between Innovation and the Cybersecurity Abyss

The promise of AI agents has seduced small and mid-size businesses (SMBs) into a new era of automated efficiency—but this digital gold rush is rapidly becoming a security minefield. As companies deploy swarms of autonomous agents to handle everything from customer service to data analysis, they are inadvertently opening a Pandora's box of vulnerabilities that lean IT teams are woefully unprepared to close. With old-school attacks like phishing and ransomware being supercharged by AI automation, and brand-new threats emerging from compromised agent ecosystems, SMBs are now facing a cybersecurity squeeze that demands immediate attention.

---

## The Double-Edged Sword of Agentic AI

AI has moved quickly into the daily work of small and mid-size businesses. Many have moved past simple chatbots and begun assigning substantive work to AI agents in the hope of gaining a competitive edge on their similarly resource-strapped rivals. The most ambitious adopters are deploying multi-agent 'assembly lines,' where a supervisor agent manages a swarm of specialist agents, passing work between them to complete complex tasks. However, AI changes more than just how work gets done. Each new access point and integration creates novel dependencies that represent a potential cybersecurity risk.

SMBs rarely have resources to spare, least of all in IT. Cybersecurity is often just one item on a list of duties owned by a person or small team that handles everything from account provisioning to zero-day fallout. Yet few businesses are likely to backpedal on AI adoption until every risk is mapped and addressed. Fewer still know which critical loopholes need plugging first. ESET’s recent global survey of 4,400 SMB decision-makers revealed a startling statistic: 40 percent of businesses don't even have an AI policy in place. Unsurprisingly, rules were more common in companies that had already suffered a security incident, revealing the familiar pattern where governance often arrives only after a costly breach occurs.

## Double Agents and Errant AI: The New Threat Landscape

Broadly speaking, today's security risks are expanding in two main directions: AI creates new paths to business systems while adversaries use it to add speed and scale to 'old' threats. Whatever its specific mandate, each agent connected to business systems can act through permissions granted by its 'owner.' Once an agent has access to internal documents and can communicate externally, anything that influences its instructions can also influence what it does with those permissions. A simple chatbot may produce a wayward answer, but an agent with access to data and tools could take a wayward—and ultimately costly—action. In multi-agent setups, manipulated outputs can be handed to the next part of the chain, triggering a cascading catastrophe whose root cause becomes nearly impossible to track down.

Some risks surrounding AI agents have familiar roots: an agent's supply chains can be compromised and its permissions abused. This is best illustrated by *skills*, or packaged instructions that tell an agent what actions to take and which tools to use. Between March and May 2026, ESET’s systems scanned almost 900,000 unique skills from popular repositories. More than 25,000 turned out to be suspicious, and more than 3,000 were outright malicious. These harmful skills lead to credential theft, data exfiltration, and remote code execution. How many were installed globally is anyone's guess, but the analysis shows how quickly a poorly governed supply chain has grown around agentic AI.

The skills ecosystem lacks app-store-style gatekeeping, and one-off checks before installation are by no means sufficient. Skills and tool connections—including those using ubiquitous MCP servers—remain live dependencies after an initial review, as their instructions and upstream services can change at any time. The end result could be a "rug pull" where a tool that initially behaves as expected later morphs into, for example, an infostealer. A lean IT team is unlikely to review every dependency at installation, much less continue monitoring it afterward. They may not even know an employee has connected a seemingly useful skill to an agent that can read the shared drive and communicate with a third-party service.

## The Invisible Vulnerabilities in AI Models

Other openings are created by large language models (LLMs) themselves. The models are notoriously prone to hallucinations, many of which are no laughing matter as they ultimately open another path from language to execution—and to an attacker-controlled resource. For example, LLMs tend to invent the same software library names and web domains often enough that adversaries register those exact domains and wait for a "vibe coder" or coding agent to use them. Agents can also suffer from *agentic misalignment*, where they proceed doggedly toward their objective even if it involves breaking into other companies. Attackers can inject malicious data into an agent's long-term memory, where the input lies dormant until retrieved to commit fraud or other nefarious actions.

Perhaps the most common and insidious threat goes after what a model is told. LLMs cannot reliably distinguish between trusted, privileged instructions and untrusted retrieved data, treating everything as a stream of tokens. This leaves agents especially vulnerable to *indirect prompt injection attacks*, where an adversary hides commands in a webpage, email, or another resource that the agent is instructed to fetch. The EchoLeak vulnerability in Microsoft 365 Copilot demonstrated the risk of data exposure without a malicious link ever being clicked. A recent large-scale red-teaming competition found at least one successful hijacking attack against every one of the 13 frontier models tested. This explains why prompt injection consistently ranks as the number one security risk in OWASP’s list for LLM applications.

## Old Attacks, Supercharged by AI

AI-specific threats have by no means displaced the well-established pathways to a company's crown jewels. Phishing, vulnerable software, stolen login credentials, and exposed remote services remain at the core of many incidents. The ESET SMB Cyber Readiness Index 2026 lists phishing and the exploitation of known software vulnerabilities as the two most common causes of breaches. The speed of vulnerability exploitation often leaves defenders with little to no time for patching: nearly 25 percent of the almost 500 known exploited vulnerabilities in the first half of 2026 were exploited on—or even before—the day they were disclosed.

Phishing and other social engineering threats keep changing their delivery methods with considerable success. Microsoft reports that AI-automated phishing emails achieve a 54 percent click-through rate compared to just 12 percent for standard attempts. QR code phishing is soaring, while ClickFix—the rampant threat where a fake error message asks a user to paste a command into their own terminal—is now often dressed up as AI troubleshooting and misuses the public sharing features of popular AI services to host malicious instructions.

Ransomware, which has fallen hardest on SMBs for years, is now being run at higher volume for lower returns. Attackers increasingly target the technology that thwarts their efforts: ESET has documented more than 100 tools built to kill endpoint detection and response (EDR) solutions, most abusing vulnerable drivers. AI is also turning up in malware, although examples found so far tend to be early or experimental. ESET researchers have documented PromptLock, the first known AI-powered ransomware, and PromptSpy, the first known Android malware to abuse generative AI in its execution flow. Together, shorter reconnaissance times, more effective social engineering, cheaper commodity malware, and faster adaptation let attackers accomplish far more with far less.

## Where This Leaves a Small Team

Small teams have their work cut out for them. Hiring enough people to cover every security need is rarely a viable path for an SMB. The largest cybersecurity workforce study has stopped publishing a global headcount gap and now reports missing skills as the more useful measure of the talent shortage, with AI security topping the list of skills in short supply.

As with everything else in security, the first 'port of call' on this journey is visibility: knowing which agents and AI services are running, who connected them, and what their permissions allow them to do. This points to the lethal trifecta of agentic security: access to sensitive data, exposure to material from outside the company, and permissions to communicate or take action externally. An agent that reads a shared drive, processes incoming email, and sends messages has all three. Taking one 'leg' out significantly reduces the risk.

## Conclusion: A Pragmatic Path Forward

No matter how tempting, automating the human out entirely comes with its own risks. Automation is dependable on repetitive decisions but weaker on ambiguous or complex ones, with errors compounding when one automated misjudgment becomes the input for the next. Somebody has to consider the broader context to decide whether odd behavior is an intruder or a glitch. For SMBs, a managed detection and response (MDR) service provides the only realistic solution—it taps into advanced automation to inspect more activity but brings suspicious behavior to a human expert's attention. These days, any such service must also include robust AI-driven security capabilities, watching what AI agents pull in or use—files, external services, repositories, skills, and plugins—as well as what they do with those resources once running. For a company with a small IT team, that's the only version of a security service that was ever going to align with its daily reality. The AI revolution is here, but surviving it requires more than just adopting the latest tech—it demands a new approach to security itself.