Thoma Bravo managing partner Seth Boro says the growing use of autonomous AI systems will create lasting risks as attackers exploit their access to sensitive tools and data.
Seth Boro, managing partner at Thoma Bravo, has warned that the cybersecurity risks around artificial intelligence are not a temporary problem, but a structural one that will deepen as AI agents become more common. Speaking to Bloomberg TV on 19 October 2026, he said the spread of autonomous systems would bring persistent danger from malicious or compromised “rogue agents”, and argued that trust in AI will depend on whether security keeps pace with deployment.
His comments reflect a broader concern now running through the technology sector: the more useful AI agents become, the more access they are given to email, passwords, payment tools and internal systems. That creates a larger attack surface for hackers, and makes misuse more consequential. Technology coverage from Tom’s Hardware has highlighted the same risk, noting that granting AI systems broad permissions can lead to unauthorised actions and data breaches. Axios has likewise reported that conventional sandboxing is proving too limited for agents that need to interact with external tools and live data, forcing security teams to look for tighter but still practical controls.
Boro drew a direct parallel between prompt manipulation and social engineering, the long-established tactic in which an attacker tricks a person into breaking security rules. In his view, manipulating an AI model through carefully crafted inputs is the machine equivalent of a phone scam or phishing call. That comparison matters because it suggests the weakest point in many AI systems may not be the model itself, but the way it is persuaded to ignore its guardrails. Thoma Bravo says its portfolio companies are already building defences against those kinds of attacks and working together on protections against AI-driven threats.
The warning also fits Thoma Bravo’s wider strategy. The private equity group has spent years building a substantial cybersecurity franchise, which it says now generates about $8 billion in related revenue. Boro has overseen that effort since joining the firm in 2005. The firm has backed dozens of security businesses since 2008 and has completed more than 15 exits in the sector. It remains active on the deal front, having announced a $5.3 billion acquisition of Darktrace on 9 October 2026. On the same day as Boro’s interview, Proofpoint agreed to buy Varonis for $6.3 billion, underlining how consolidation is continuing in a market shaped by the rise of AI and the pressure to defend against it.
For businesses, the message is clear: AI security cannot be treated as an afterthought. Systems that are useful because they can act on a user’s behalf are also risky because they can be manipulated on a user’s behalf. For consumers, the caution is even more direct. An assistant with access to sensitive accounts can be helpful until it is tricked into serving the wrong party. The question now is whether the industry’s defences can mature as quickly as the agents themselves.
Disclaimer: This content is intended for informational purposes only. Readers are advised to exercise their own judgement, conduct due diligence, or consult a qualified expert before acting on any information provided.
