Pure hypothetical, but the clearly possible case when an AI targets and infects a company, and it does not have a real person holding the strings.

What would be the best line of defence or best way to prepare? Do we need firewalls for our own AI agents such that they are not infected and taken over?