AI Security for Telecommunications: CPNI, Care Desks and Agents on the Network

Telecom AI security comes down to one collision: carriers are wiring autonomous agents into networks that hold CPNI, the one data class the FCC fines over on a schedule, while a nation-state intrusion is still being scoped.

That sentence contains the whole argument. The rest of this piece is the evidence, and what to do about it.

Care desks went agentic faster than anyone audited them

Verizon put a Gemini-based research assistant in front of all 28,000 of its customer care reps, scaled to full deployment by January 2025; Verizon and Google report 95% answerability and a 40% increase in sales through care teams. Per August 2026 trade reporting, Gemini now handles the majority of Verizon's inbound consumer calls and chats, with the partnership expanding across network operations, marketing, and employee workflows.

T-Mobile went a different way. IntentCX, announced in September 2024 as a multi-year OpenAI partnership press-reported at around $100 million, builds an intent-driven decisioning platform trained on billions of customer interaction data points and wired into T-Mobile's care and transaction systems. Read that architecture as a security engineer rather than a product manager: an external AI vendor with a direct line into systems that hold CPNI and can execute account changes.

AT&T runs Ask AT&T, its internal assistant, for roughly 100,000 employees at about 10 million API calls a month, inside a dedicated Azure tenant the company says was pressure-tested for leakage. Its 2025–26 push is autonomy: a network-integrated digital receptionist that engages unknown callers in real time to screen fraud, and agents that stop suspicious transactions on their own, "under human oversight" in AT&T's phrasing.

The network side is moving just as fast. Through late 2025 and early 2026, more operators declared Level 4 autonomy in specific network domains under TM Forum's model, meaning the network operates and maintains itself with humans reserved for the unusual. TM Forum's Agentic NOC project goes further: an agent-of-agents ecosystem spanning network, service, field force, security, and virtual operations. Nineteen mobile operators, BT, Vodafone, and Telenor among them, signed on to the GSMA's Responsible AI maturity roadmap when it launched. So deployment governance exists. Security governance is the gap.

CPNI does not behave like ordinary PII

Customer Proprietary Network Information, the call detail, location, and service-configuration data carriers generate about every customer, is protected by statute, 47 U.S.C. § 222, and the FCC enforces it with a regularity that privacy lawyers in other industries would find exotic.

April 2024: combined fines of roughly $200 million against the largest wireless carriers for selling access to customers' real-time location data without valid consent. T-Mobile $80M, AT&T $57M, Verizon $47M, Sprint $12M. A federal court has since upheld the T-Mobile fine on appeal.

Then the 2024 consent decrees. TracFone, a Verizon subsidiary, paid $16 million in July over three breaches in which criminals reached personal information and CPNI through customer-facing API vulnerabilities; its decree mandates an API security program plus SIM-change and port-out protections. AT&T paid $13 million in September over a breach in a vendor's cloud environment, with obligations covering vendor access limits and data disposal. The FCC framed that one as a supply-chain duty for every voice provider.

Here is the mapping the industry has not fully priced in. Every third-party AI platform that ingests customer interactions is a vendor environment holding CPNI, in exactly the sense the AT&T settlement polices. Every AI agent a customer can talk to, if it reads account data or triggers account changes, is a customer-facing API in exactly the sense the TracFone decree polices. The FCC's AI-specific action to date has centered on voice cloning, not carrier operations. It has not needed more. The consent decrees already describe the architecture carriers are building; the word "AI" just isn't in them yet.

The enforcement file, read as a requirements document

Last verified: September 9, 2026.

One asymmetry in that table deserves a sentence. Carriers are both regulated deployers of AI and the pipe other people's AI abuse travels through; Lingo was punished for carrying someone else's deepfake. No other industry gets held responsible from both ends at once.

Salt Typhoon changes the assumptions, and not because of AI

To be plain about two things. There is no evidence Salt Typhoon involved AI. And there is no public incident anywhere, as of this writing, of an AI or agentic system causing a telecom breach. Anyone telling you otherwise is inventing case history.

What Salt Typhoon did was reset the scrutiny baseline. The Chinese state-sponsored campaign against telecom infrastructure, disclosed in 2024 and still being scoped, reached at least 200 US organizations and roughly 600 across more than 80 countries, per the August 2025 joint advisory and FBI estimates. Reported US victims include AT&T, Verizon, and Lumen. The attackers got into the platform used for court-ordered wiretaps. CISA officials have said publicly that they could not be certain the adversary had been evicted, because the full scope of the intrusion still was not known.

Now put an agentic NOC into that environment. A Level 4 agent with change rights on the core network is a privileged identity operating inside infrastructure a nation-state may still occupy. Its credentials are a target, and so are its tool servers and control plane. Unlike a human administrator, it acts thousands of times a day without ever getting suspicious. That is why Salt Typhoon belongs in an AI security piece: not because the attack was AI, but because it defines the threat model your agents inherit on day one.

What a CPNI-aware agent program looks like

What follows is our view, synthesized from the enforcement record above rather than from any regulator's AI playbook.

Two controls matter more than the rest, and neither is exotic. First, agent identity scoped per domain. TM Forum's own autonomy model is domain-by-domain, not network-wide, and agent permissions should match it: the fault-management agent has no business holding credentials that reach lawful-intercept systems, and an agent identity should never be a shared service account a human also uses. In a possibly contested network, a long-lived agent credential is a gift to whoever is still inside, so rotate hard and often.

Second, per-action audit. An FCC consent-decree compliance program and NIS2's incident clock share one assumption: you can reconstruct what happened. Agent-of-agents architectures multiply the actors whose steps need logging, and a care agent that touched CPNI needs every read and write attributable after the fact. The mechanics of getting agent activity into your SIEM are in our piece on AI audit trails and SIEM integration.

The rest of the program, briefly:

• Kill criteria, codified. AT&T keeps its fraud agents under human oversight; write down what that means for yours. Blast-radius thresholds and config-change classes that always gate a human, with a hard stop on anything touching CPNI. Escalation design for autonomous operations is covered in our agentic MDR governance framework.
• Vendor pipeline terms. The AT&T decree's retention and disposal duties are the template for AI vendors and their model pipelines. Get deletion and non-training commitments in writing before care transcripts start flowing.
• Treat every customer-facing agent as a customer-facing API, with the TracFone decree as the checklist, SIM-swap and port-out protections included. That means runtime enforcement rather than prompt-side pleading; the argument for why is in AI agent runtime security.

This is the program AccuroAI's AI agent security product was built for: per-agent identity, inline policy checks at under 38ms p99 so they can sit on live care traffic, and audit trails mapped to 8 compliance frameworks. The carrier-specific reference architecture, CPNI data flows included, is on our new telecommunications industry page.

The European stack of clocks

EU and multinational carriers get the same problem with tighter deadlines. Under NIS2, providers of public electronic communications networks and services are essential entities regardless of size, with an early warning due 24 hours after a significant incident, a fuller notification at 72 hours, a final report within a month, and penalties up to €10 million or 2% of global turnover. An AI-related incident involving personal data adds GDPR's 72-hour notification to a second authority, and the AI Act layers its own serious-incident reporting on top for deployers. That can mean three notification clocks running to different authorities on a single incident.

The AI Act's high-risk deadlines are set to slip to December 2027 and beyond under the provisionally agreed Digital Omnibus, which buys time on classification work. It buys nothing on incident readiness, because reporting machinery is not something you design retroactively while an agent incident is live and your 24-hour NIS2 window is already burning.

Questions carrier security teams keep asking

Has an AI system actually caused a telecom breach?

Not publicly, as of September 2026. The incident base that should shape your program instead: infrastructure intrusion (Salt Typhoon), CPNI reached through APIs and vendor clouds (TracFone, AT&T), and AI-voice abuse carried over carrier networks (Lingo). Plan against those patterns rather than waiting for a named AI incident to justify the budget.

Was AI involved in Salt Typhoon?

No evidence supports that, and this piece makes no such claim. Its relevance is context: it put carrier security programs under maximal scrutiny and established that agent credentials and control planes will be deployed into networks you cannot certify as clean.

Do CPNI rules reach our AI vendors?

Section 222 binds carriers, but the AT&T vendor-cloud settlement made clear the FCC treats vendor environments holding CPNI as the carrier's responsibility, with access limits and disposal duties to prove it. A conversational AI platform ingesting care interactions fits that description without strain. Contract accordingly.

What did the FCC's AI voice ruling change?

The February 2024 declaratory ruling classified AI-generated voices as artificial voices under the TCPA, making AI-voice robocalls without prior express consent illegal, effective immediately. The operative duty for carriers runs upstream: Lingo Telecom paid $1 million for transmitting the New Hampshire deepfake calls, with STIR/SHAKEN caller-ID authentication obligations attached.