AI Agents Are Already Inside Your Buildings. Who Gave Them Permission?

Building Intelligence · Risk Reduction · Data Ownership

AI Agents Are Already Inside Your Buildings. Who Gave Them Permission?

Three signals landed in the same sixty-day window. They rarely get told together. They should be — because they are the same story.

TL;DR: Agentic AI is already running inside your buildings, breaches are already inside your vendor SaaS stack, and fresh OT vulnerabilities (CVE-2026-20761) already let attackers reach building management systems. The question that decides who runs a credible CRE portfolio in 2026: who has permission to act on your operating data, in real time, across every vendor — and can you produce the audit trail? Most owners can’t. Property Brain™ is the owner-controlled orchestration layer that turns “mysterious” into “governed” before the next incident — and lets Property Brain™ become Portfolio Brain™ once the standard is set at one asset.

In the last sixty days, three signals landed in the same window. CREtech is hosting an industry webinar titled “The AI Workforce in Real Estate: Who’s Actually Doing the Work Now?” — a session that takes for granted agentic AI is already running lease administration, broker research, and enterprise workflows. Cushman & Wakefield confirmed a breach tied to the ShinyHunters Salesforce extortion campaign — more than 500,000 records compromised. And Claroty’s Team82 disclosed two vulnerabilities in EnOcean’s SmartServer IoT platform that allow remote command execution against building management systems.

The three stories rarely get told together. They should be. Because they are the same story. Software is acting on data inside your buildings, faster than ever, with permissions nobody on your side actually wrote down. And the owners who can answer who has permission to do what, with which data, in real time, are the only ones who can credibly run a portfolio in 2026.

Most owners cannot answer that question. That is the problem.

What “agentic AI” actually means inside a portfolio

When the trade press says agentic AI, it means software that does not just answer questions. It takes actions. It schedules. It pays. It books a tour, generates a lease addendum, triggers a rent-pricing recommendation against three other vendor systems, files a report. The shift looks small from outside. From the inside, it is a permissions revolution.

A search assistant that answers a leasing question is one thing. An agent that books the tour, generates the lease addendum, and triggers a pricing recommendation across platforms the owner doesn’t fully control is a different thing entirely. It is acting under credentials. Multiple credentials. Across platforms the owner doesn’t control.

This is not a hypothetical

The Cushman & Wakefield breach is a useful reminder that operating data lives in dozens of vendor SaaS instances. Salesforce. Yardi. RealPage. AppFolio. Building dashboards. Camera analytics. Access control. Each one is a separate identity store, a separate breach surface, a separate set of API keys floating in someone’s password manager. ShinyHunters did not need a sophisticated zero-day. They got 500,000 records out of one firm.

Now layer agentic AI on top. Every agent that can read across those systems is an additional pivot path. It just has to be misconfigured. Or compromised. Or running under a credential that should have been rotated six months ago. CVE-2026-20761 lets a remote attacker send specially crafted IP-852 messages and execute arbitrary commands against a building management system. The vulnerability sits in a controls platform that quietly runs in thousands of buildings. That is not an IT problem. That is an OT governance problem.

The triangle gap, and why agents make it worse

Every CRE org has the same triangle. The property manager is on tenants. The asset manager is on financials. The IT manager is on employee tech. Operating technology — the buildings’ actual brain stem — falls between the three roles. Nobody owns it. That is a structural gap, not a personal failing. Agents move faster than the triangle. They read across the silos. They take actions across the silos. The gap that was always there gets exploited at agent speed.

Property Brain™ is the orchestration layer

Property Brain™ is a vendor- and LLM-agnostic intelligence layer: a governed data plane plus a governed trust plane, sitting above whatever vendors the building runs. Identity, access, privacy, lineage, retention, and rules of use are governed at this layer, not inside the vendor. Agents plug into the trust plane and act under owner permissions. Every action is logged in the owner’s environment. If a vendor is acquired, replaced, or breached, the orchestration plane keeps running.

Three concrete moves this quarter

The PPP 5C™ plan — Clarify · Connect · Collect · Coordinate · Control — is how owners get from “we have no idea who’s acting on what” to a governed environment. Three things to do in the next 90 days:

1. Clarify what’s already running. Inventory every AI feature, agent, and copilot in every vendor platform you renewed in the last 12 months. Do not trust the original sales deck. Read the current product page — many features were added in product updates after the contract was signed. Map who has admin credentials, what each agent can read, and what each agent can write back.
2. Run an OT vulnerability review. Cover BMS, lighting, access control, sub-meters, and IoT controllers — with specific attention to remote-access paths, default credentials, and exposed management interfaces. CVE-2026-20761 is the headline this week. There will be another next week.
3. Scope a Property Brain™ pilot at one asset. No rip-and-replace. Stand up the data plane and the trust plane above the vendors so the next agent and the next breach find a governed environment instead of an open one. Prove the standard at one building. Then run it across the portfolio.

The asset manager test

If you had to brief your investor committee tomorrow on “who is currently authorized to act on operating data inside our portfolio, across every vendor and every AI agent,” what would the answer look like? For most owners today, the answer is a shrug and a list of vendor names. That is the gap institutional capital, insurance underwriters, and acquirer diligence teams will price into the next transaction — at your expense.

Agents are already in your buildings. Whether you authorized them or not. Whether you can audit them or not. If you cannot answer who has permission to act on your operating data, in real time, across every vendor in this portfolio, that is the first conversation to have. The agents will not wait for the answer.

Own your data & digital infrastructure. Operate with strategic foresight. Build for the long game.

— Bill