Cisco wants to put AI agents’ security boundaries beyond their reach

Cisco recently announced that it is developing security controls for AI agents that run on dedicated networking processors instead of relying solely on the software those agents use. The objective is to prevent a compromised agent from gaining the keys to its own security controls.

In a blog post co-authored by two senior vice presidents on 21st October 2026, Cisco outlined the work on NVIDIA BlueField data processing units (DPUs). These are specialised processors that handle networking and security tasks separately from the main server workload. Its programmable platform and security services remain in development.

The problem is already showing up. Research from Cequence Security and Enterprise Management Associates, which we have previously covered, found that 65% of 202 enterprise IT and security leaders surveyed reported an AI agent acting outside its intended scope. Yet only 33% said they provisioned agents with least-privilege access.

Giving AI agents boundaries they cannot rewrite

Cisco’s proposed approach follows three steps: plan, observe, and enforce. 

First, define an agent’s permitted activities. A gateway running on the DPU would substitute credentials without exposing the underlying secrets to the agent. Next, collect evidence of access patterns and inspect traffic between workloads, tools, and data. Finally, apply policies that allow or block activity.

A support agent may retrieve billing information and create tickets, for example, while being prevented from exporting customer records in bulk or deleting accounts. Think of a receptionist whose access badge opens the front office, but not the records room.

That distinction between access and authority matters. As P0 Security’s Neha Duggal told TechFinitive, “every meaningful action should be treated as its own authorization decision”.

Separate controls, not an invincible shield

For cloud providers sharing AI infrastructure between customers, DPU-enforced network rules could strengthen tenant separation and limit a compromised workload’s ability to reach neighbouring systems. Cisco also plans a shared appliance for servers without onboard DPUs.

There are conditions, however. Cisco says protections depend on securing the separate management system and preventing traffic from bypassing enforcement. Application-level inspection is also part of the developing architecture, not a blanket capability already delivered. The promise is independently enforced boundaries, not hardware that makes agents infallible.