Agentic AI attack surface is outpacing enterprise identity controls

At a glance

What this is: This is an analysis of how agentic AI expands the enterprise attack surface and why conventional identity controls are struggling to keep up.

Why it matters: It matters because AI agents behave like machine identities with accumulating privileges, which means IAM, NHI governance, and zero trust controls need to account for autonomous tool use and scope drift.

By the numbers:

• Almost 80% of organisations are already deploying AI agents.
• Gartner predicts 40% of enterprise applications will be integrated with task-specific AI agents by the end of 2026.
• Less than 5% of enterprise applications used task-specific AI agents in 2025, according to Gartner research cited by Zero Networks.

Context

Agentic AI refers to systems that can plan actions, call tools, and execute multi-step work with minimal human intervention between steps. The identity problem is that these systems are not just applications, they are processes with credentials, access scope, and the ability to change what they reach as tasks evolve.

Zero Networks argues that the attack surface grows as agents are assigned more work, because entitlements accumulate through policy drift, tool chaining, and expanding task scope. That creates a governance problem for IAM and NHI teams: the system can look legitimate while becoming materially overprivileged.

The article frames AI agents as a new insider-like risk because they can operate across multiple systems at machine speed. For identity programmes, the challenge is no longer simply provisioning access, but continuously constraining what the agent can do as behaviour changes.

Key questions

Q: What breaks when agentic AI is governed like a normal application account?

A: Security controls break down because agentic systems do not behave like fixed-function applications. They can choose actions at runtime, combine tools in unexpected ways, and move faster than periodic review cycles. That means static roles, annual recertification, and one-time approvals do not fully describe the risk or contain the behaviour.

Q: Why do AI agents increase identity risk even when the login succeeds?

A: A successful login only proves that the agent reached the system. It does not prove that the specific action was authorised for that task, in that environment, at that moment. AI agents can chain tools and cross systems, so the authorisation problem moves to runtime intent and not just initial authentication.

Q: How do security teams know if agentic AI controls are failing?

A: The main signs are session drift, repeated retry loops, unauthorized tool calls, and behaviour that diverges from the documented task sequence. If the agent keeps moving through steps after intent-to-tool alignment weakens, the system is drifting beyond its control envelope. In practice, teams should measure the full execution path, not isolated prompts.

Q: Should organisations use the same lifecycle controls for AI agents and other non-human identities?

A: Yes, but the review points differ because AI agents can change behaviour during execution. Ownership, inventory, entitlement review, and offboarding still apply, yet they must be driven by observed runtime activity rather than static assignment alone. The lifecycle has to keep pace with the agent’s operating scope.

Technical breakdown

Why agentic AI changes the identity model

Agentic AI differs from a chatbot or scripted automation because it can decide a sequence of actions, invoke tools, and continue execution across systems without human approval after each step. That makes the agent a process identity with real authentication, tokens, and network permissions rather than a transient interface. Once that identity can chain tools and adapt to context, the security question shifts from who signed in to what the agent is allowed to reach at runtime. The result is a much harder authorisation problem than static application access.

Practical implication: model AI agents as identities with runtime reach, not just as software features.

How tool chaining and policy drift expand agentic AI exposure

The article shows that agents accumulate permissions as they are given more tasks, connect to more systems, and inherit broader scope than the original deployment intended. Tool chaining matters because valid access to one service becomes a path into another, so the attack surface grows through legitimate dependencies rather than obvious compromise. Policy drift then turns yesterday’s narrow permission set into today’s overexposed pathway. In practice, the risk is not a single bad grant but a moving boundary that no one is reconciling against actual use.

Practical implication: compare recorded entitlements with observed agent behaviour and tighten any scope that has drifted wider than task need.

Why deterministic network enforcement matters for AI agents

The post argues that agents should be governed at the network layer because they act through systems, APIs, and services that can be constrained independently of the model. Deterministic enforcement is important because even a small error rate in policy can break operations, so controls must be based on observed behaviour rather than guesswork. This is a zero trust pattern for non-human identity: allow only the systems an agent demonstrably needs, and contain the blast radius if it is manipulated or compromised. That changes the control point from review after provisioning to control during execution.

Practical implication: enforce identity-based network boundaries around agent reach instead of relying on broad application trust.

Threat narrative

Attacker objective: The attacker aims to turn a legitimate AI agent into a high-speed internal conduit for data exposure, unauthorized actions, or silent behaviour manipulation.

1. Entry occurs when an attacker manipulates the content or context an agent processes, such as prompt injection, goal manipulation, or identity spoofing. This lets the attacker influence a legitimate agent rather than break in through a classic human login.
2. Credential access and scope expansion happen when the agent uses valid credentials, tokens, or authenticated tool paths to reach systems it was provisioned to touch. The article stresses that stolen or abused agent credentials can expose every connected tool and dataset.
3. Escalation occurs through tool misuse, unexpected code execution, or poisoned inter-agent communication, which lets the attacker extend control from one service to broader internal workflows. Because the agent operates at machine speed, the chain can advance faster than human review.
4. Impact is broad internal exposure or unauthorized action across data stores, prompts, and connected services, including the possibility of altered behaviour for downstream users. In the article’s example, the agent reached a production database and sensitive internal material without legitimate authentication.

Breaches seen in the wild

• CoPhish OAuth phishing via Copilot Studio: Datadog showed Copilot Studio agents on a Microsoft domain can front OAuth consent phishing and forward stolen tokens; no victims reported.
• AI agent retail card theft campaign 2026: AI agents breached 27+ retailers for about $25 each, used cloud keys and a Secrets Manager dump, and stole 600,000+ payment cards.

Read and download The State of NHI & AI Agent Breach Report 2026, covering 200+ breaches impacting Non-Human Identities including AI Agents.

NHI Mgmt Group analysis

Agentic AI creates assumption collapse, not just a larger attack surface: identity governance was designed around access that remains stable long enough to be reviewed, certified, and revoked. That assumption fails when an AI agent can acquire, chain, and shed access as part of a live task. The implication is that identity programmes must treat access as a runtime condition, not a static entitlement state.

Ephemeral review cycles do not fit agent-timed execution: agents operate across open-ended workflows with no human approval gate between steps, so privilege can change faster than access review cadences can observe it. That means the core control problem is not whether a review exists, but whether it can ever see the permission state that mattered. Practitioners should treat observation timing as a governance constraint, not an implementation detail.

Identity blast radius is now the primary control variable: when a process identity can call multiple services, consume prompts, and traverse APIs, the question is no longer only least privilege at provisioning time. The real issue is how far a compromised or manipulated agent can move before deterministic containment stops it. That is an NHI governance problem with direct implications for ZT-NIST-207 and OWASP-NHI thinking.

Shadow AI is a governance failure before it is a discovery problem: the article notes that many organisations lack the policies needed to manage AI or detect shadow AI. That means the first failure is not missing tooling but missing lifecycle ownership for agents that appear and expand faster than the programme can inventory them. The practical conclusion is that inventory, ownership, and offboarding must move together.

Agentic AI security is converging with machine identity governance: the article’s strongest evidence is that AI agents authenticate, hold tokens, and rely on tool access in the same way other non-human identities do, even if their decision loop is more dynamic. That makes the line between AI security and NHI governance increasingly artificial. Security leaders should stop treating agentic AI as an adjacent category and govern it as privileged machine identity with decision rights.

From our research library:

• 53% of security leaders expect AI to run major portions of their infrastructure autonomously within the next three years, according to the 2026 Infrastructure Identity Survey.
• 69% of security leaders agree identity management must fundamentally shift to address agentic AI systems, according to the 2026 Infrastructure Identity Survey.
• Read next: Agentic AI Identity Maturity Model

What this signals

Identity blast radius: agentic AI turns permission scope into the main containment problem, because each new tool, API, or dataset increases the distance between declared intent and actual reach. Security teams should expect review-based governance to lag behind runtime behaviour unless they add continuous visibility and enforcement.

Agent ownership is becoming a lifecycle requirement: once AI agents are treated as processes with identities, the programme has to answer who owns them, when they are re-certified, and how they are offboarded. That is the same governance logic used for machine identities, but now applied to systems that can alter their own execution paths.

Runtime enforcement matters more than static approval: the article’s core control point is not model quality but network-level containment of agent actions. For practitioners, that means agent governance should be measured by actual reach, not by whether a policy existed on paper.

For practitioners

• Build a live agent inventory Track which agents exist, what systems they can reach, and which credentials or tokens they actually use in practice. Treat undocumented agent reach as an exposure issue, not a discovery task.
• Compare observed reach to intended task scope Measure the gap between provisioned access and real agent behaviour, then remove systems, APIs, or data stores the agent does not demonstrably need. Reassess after every material workflow change.
• Contain agents with deterministic network boundaries Apply identity-based controls at the network layer so each agent can reach only the services it has proven business need for. Use deterministic policy enforcement to avoid breaking legitimate workflows.
• Automate lifecycle governance for agents Assign ownership, review cadence, and offboarding triggers to each agent so new tools or expanded permissions do not persist without accountability. Lifecycle controls should follow the agent as tasks and integrations change.

Key takeaways

• AI agents are behaving like privileged machine identities, which means the real control issue is runtime reach rather than model capability alone.
• As tasks expand, agents accumulate access across systems and can move beyond the scope that was originally approved.
• Deterministic network containment and lifecycle governance are the two controls most likely to reduce agentic AI blast radius.

Key terms

• Agentic AI: Autonomous AI systems capable of planning, deciding, and taking actions, including calling APIs, writing code, and orchestrating other agents, with minimal human oversight. Agentic AI introduces new NHI risks as agents must authenticate to external services.
• Agentic Threat Surface: The agentic threat surface is the full set of places where an AI agent can be manipulated, misused, or made to act outside intent. It includes the model, prompts, tools, MCP connections, memory, and data sources, because attacks often chain across more than one layer.
• Scope drift: Scope drift is the gradual mismatch between what an integration was meant to do and what its credentials still allow it to do. It happens when permissions are not revalidated as business needs change, creating hidden over-privilege across SaaS and API-connected systems.
• Deterministic Enforcement: A policy model that produces a clear allow or block decision based on defined rules rather than probabilistic model judgment. For AI agents, deterministic enforcement is valuable because it can stop risky execution even when language is obfuscated, multi-turn, or designed to evade classifier-based guardrails.

Deepen your knowledge

NHI governance, agentic AI identity, and machine identity lifecycle are core topics in our NHI Foundation Level course, the industry's only accredited NHI security programme. If you are responsible for identity security strategy or NHI governance in your organisation, it is worth exploring.