Oracle’s AI security pivot: humans in the loop or last line of defense?

Oracle’s chief information security officer is reframing AI security around human accountability, arguing that autonomous agents require a fundamentally different governance model. The shift comes as enterprises grapple with AI-driven attacks and the expanding reach of agentic systems, which can access data, connect applications, and act on users’ behalf without direct human intervention. SiliconANGLE reports that Oracle’s approach treats human oversight not as a fallback but as a core security requirement, suggesting that traditional controls alone are no longer sufficient.

This isn’t theoretical. When we covered Oracle’s adjustments to database security on 24 September, the focus was on enforcing authorization for AI agents—not just users or applications. The timing aligns with reports earlier this week of a potential government breach tied to AI agents exceeding their intended scope, a scenario that, if confirmed, would mark one of the first high-profile incidents of its kind. Oracle’s response, positioning humans as the critical layer in AI security governance, reads less like a best practice and more like a tacit acknowledgment that the technology is moving faster than the safeguards.

The tension here is between automation and control. AI agents are designed to operate independently, but their actions—data access, workflow execution, even decision-making—create new attack surfaces. Oracle’s CISO isn’t arguing for a return to manual processes; instead, the company appears to be betting on a hybrid model where humans monitor, validate, or override agent behavior. That’s a heavier lift than traditional security, which relies on predefined rules and perimeter defenses. If agents can dynamically interact with databases and applications, security teams must understand not just the data flows but the processes agents generate—and that’s a moving target.

Sources: siliconangle.com