Fortinet Urges Controls for Government AI Agents

Fortinet’s Jack Chan told GovInsider that government agencies should control AI agents’ identities, permissions, data access and activity as agents gain the ability to retrieve and update records. A banking assistant demonstration showed an agent returning sensitive customer records when asked for 10 sample records for a customer relationship management (CRM) update; security controls blocked the same request. Chan presented on these risks at GovWare 2026 on October 13 and joined a cybersecurity panel the following day.

Chan says prompt injection (instructions that redirect an AI system) and abusive requests can expose information or elicit inappropriate responses. The risks grow when public-sector agents can access citizen records or service-delivery systems. Fortinet’s FortiAIGate sits between AI applications and models, inspecting requests before they reach a large language model, checking responses, and detecting prompt injection, data leakage and other security risks. Logs record inputs, outputs and why suspected malicious requests are blocked.

Chan describes a Zero Trust life cycle for agents: identify a human owner, authenticate the agent before system access, and limit it to the minimum data and permissions needed for its task. Agencies should monitor and review access continuously, assess the agent’s capabilities, data sensitivity and hosting location, and retain human oversight. Security teams need to be able to revoke an agent’s authority immediately and remove access when an application is retired. Chan also calls for monitoring non-human identities and questioning the threat models of agents built internally or supplied by vendors.

As government agents handle health or financial information, agencies need to know which providers process data, where it is stored, who can access it and which jurisdiction applies. Chan says the cost of running AI internally can push organisations toward external models and services, increasing the work needed to control data flows. Data masking (obscuring sensitive information before sharing it) is one safeguard. Security and networking teams also need visibility across AI use through endpoint controls, firewalls and centralised logging, a capability Chan calls “AI observability.”

Chan says AI can support cyber defence through automated responses such as quarantining compromised devices, decoy systems that let defenders observe attackers, and machine learning to coordinate defence and shorten threat detection and response times. He says Fortinet uses frontier AI models to address vulnerabilities and help customers improve security. As an example of detecting unusual activity, he cites a laptop whose usual daily upload of about one gigabyte suddenly rises to ten; recognising the change requires establishing a baseline of normal traffic.

Chan says threat intelligence can link malicious domains, web addresses and file hashes associated with attack groups to activity on an endpoint. Bringing together data from network, endpoint and authentication systems can help AI agents consolidate security information. He says threat intelligence sharing between vendors and government agencies works in both directions, and cooperation also includes operational technology providers whose equipment controls pumps, valves and other machinery. Agencies, he says, need to monitor agent access and withdraw authority when something goes wrong.

Fortinet’s Jack Chan told GovInsider that government agencies should control AI agents’ identities, permissions, data access and activity as agents gain the ability to retrieve and update records. A banking assistant demonstration showed an agent returning sensitive customer records when asked for 10 sample records for a customer relationship management (CRM) update; security controls blocked the same request. Chan presented on these risks at GovWare 2026 on October 13 and joined a cybersecurity panel the following day.

Chan says prompt injection (instructions that redirect an AI system) and abusive requests can expose information or elicit inappropriate responses. The risks grow when public-sector agents can access citizen records or service-delivery systems. Fortinet’s FortiAIGate sits between AI applications and models, inspecting requests before they reach a large language model, checking responses, and detecting prompt injection, data leakage and other security risks. Logs record inputs, outputs and why suspected malicious requests are blocked.

Chan describes a Zero Trust life cycle for agents: identify a human owner, authenticate the agent before system access, and limit it to the minimum data and permissions needed for its task. Agencies should monitor and review access continuously, assess the agent’s capabilities, data sensitivity and hosting location, and retain human oversight. Security teams need to be able to revoke an agent’s authority immediately and remove access when an application is retired. Chan also calls for monitoring non-human identities and questioning the threat models of agents built internally or supplied by vendors.

As government agents handle health or financial information, agencies need to know which providers process data, where it is stored, who can access it and which jurisdiction applies. Chan says the cost of running AI internally can push organisations toward external models and services, increasing the work needed to control data flows. Data masking (obscuring sensitive information before sharing it) is one safeguard. Security and networking teams also need visibility across AI use through endpoint controls, firewalls and centralised logging, a capability Chan calls “AI observability.”

Chan says AI can support cyber defence through automated responses such as quarantining compromised devices, decoy systems that let defenders observe attackers, and machine learning to coordinate defence and shorten threat detection and response times. He says Fortinet uses frontier AI models to address vulnerabilities and help customers improve security. As an example of detecting unusual activity, he cites a laptop whose usual daily upload of about one gigabyte suddenly rises to ten; recognising the change requires establishing a baseline of normal traffic.

Chan says threat intelligence can link malicious domains, web addresses and file hashes associated with attack groups to activity on an endpoint. Bringing together data from network, endpoint and authentication systems can help AI agents consolidate security information. He says threat intelligence sharing between vendors and government agencies works in both directions, and cooperation also includes operational technology providers whose equipment controls pumps, valves and other machinery. Agencies, he says, need to monitor agent access and withdraw authority when something goes wrong.