AT&T and T-Mobile are increasing cybersecurity investment as they expand AI across network operations, with both carriers emphasizing stronger safeguards around AI agents that can reach sensitive customer information and connected software. Their technology executives discussed the risks with Reuters on October 23.

The comments came as telecom operators face growing pressure to secure customer data and critical communications infrastructure while automating more operational workflows.

AT&T has deployed encryption, multifactor authentication and human oversight of data access. It is also working to verify whether third-party AI agents seeking customer-account access are acting on behalf of legitimate customers.

T-Mobile Chief Technology Officer John Saw said the carrier is increasing investment in how it monitors and responds to threats, while working with vendors to close security gaps as quickly as possible.

AT&T CTO Jeremy Legg warned that third-party software providers and AI agents create risks extending beyond a carrier’s own network. Vulnerabilities could lead not only to data breaches but also to network disruptions.

Autonomous Networks Remain Years Away

The carriers already use AI for operational tasks. AT&T uses it to analyze trouble tickets, identify potential fixes and, in some cases, automatically implement repairs. T-Mobile uses it to automatically adjust cell-site antennas when nearby sites go down, compensating for coverage gaps.

Still, fully autonomous networks remain “years away,” according to Legg, because human intervention is required to resolve complex problems.

Sensitive Data Access Requires Stronger Agent Controls

For chief data officers (CDOs), the telecom industry’s approach illustrates how AI governance is moving toward agent-level data-access controls. 

An AI system that can retrieve customer information or trigger changes in operational systems requires more than conventional application permissions.

Organizations need to establish which data an agent can access, what actions it may perform and when human approval is required. These controls become particularly important when agents interact with third-party software, where responsibility for protecting information can extend beyond an organization’s own infrastructure.

As more decisions and actions shift from employees to AI systems, AI governance must account for both the data agents can reach and the consequences of the actions they are permitted to take.