Agentic AI expands the attack surface for identity and access controls

At a glance

What this is: This is an analysis of how agentic AI creates a new security and identity governance problem by giving software real authority to act across business systems.

Why it matters: It matters because IAM, PAM, and NHI programmes now have to govern dynamic software actors that can accumulate credentials, chain actions, and exceed intended scope.

By the numbers:

• 97% of the organizations that suffered an AI-related breach lacked proper AI access controls.
• Breaches involving shadow AI cost an average of $4.36 million.
• Gartner forecasts that 40% of enterprise applications will embed task-specific AI agents by 2026.

Context

Agentic AI changes the security problem from generating text to taking action. Once an AI system can authenticate, call tools, and sequence tasks inside business workflows, it stops behaving like a simple application and starts behaving like a delegated operator with its own access boundary.

That shift creates a governance gap for identity, access, and monitoring teams. Traditional controls assume a user, service account, or application has a relatively stable purpose and a clear approval path, but agentic systems can collect credentials, move across platforms, and make context-dependent decisions at machine speed.

The identity angle is not accidental. When AI agents are trusted with inboxes, payment flows, code repositories, and cloud tools, they become non-human actors that need lifecycle controls, scoped permissions, and auditability in the same way that other high-risk NHIs do.

Key questions

Q: What breaks when an AI agent can turn untrusted content into privileged actions?

A: The trust boundary breaks because the agent no longer just reads external text. It can convert that text into tool calls, data access, and outbound transmission. Once that happens, classic assumptions about safe ingestion and human review no longer hold, and the control point shifts to pre-action authorisation, content trust, and destination restrictions.

Q: Why do AI agents increase non-human identity risk?

A: AI agents increase non-human identity risk because they can execute many actions quickly once they inherit a credential or tool permission. That speed expands blast radius, shortens attacker dwell time, and makes weak delegation more dangerous. The remedy is tighter scoping, continuous verification, and strict separation between observation and execution privileges.

Q: What are the signs that an autonomous agent is operating outside its intended boundary?

A: Look for agents running with approval prompts disabled, outbound connections to unfamiliar destinations, and access to production-classified systems that the workflow does not require. Other warning signs include token reuse, unexpected account creation, and credentials appearing in shared locations. Those signals indicate the agent is no longer confined to a narrow task scope and may be self-extending.

Q: How do organisations keep AI agent access aligned with Zero Trust principles?

A: They need policies that evaluate the acting agent, the delegator, the task sensitivity, and the time of execution together. That keeps authorisation conditional and traceable rather than assuming a one-time account grant is enough for the whole workflow.

Technical breakdown

Why prompt injection becomes an execution risk in agentic AI

Prompt injection is the manipulation of an agent through content it is already expected to read, such as emails, web pages, PDFs, or chat messages. In a normal chatbot, the harm may stop at a bad answer. In an agentic system, the same manipulation can change tool use, data access, or action sequencing because the model is not just interpreting text, it is choosing what to do next. That makes the attack less about breaking the model and more about steering a trusted workflow into unsafe execution.

Practical implication: treat untrusted content as a control input problem, not just a content filtering problem.

How credentials and tool permissions accumulate across agent workflows

Agentic systems often work through API keys, tokens, browser sessions, and service integrations across several platforms at once. Each added connection expands the agent's effective identity, because the agent can inherit access from the systems it touches and continue acting across tools without a human in the loop. That creates a familiar identity risk pattern: access that was narrow in design becomes broad in practice when the agent can chain permissions, reuse sessions, or pivot between systems faster than reviewers can track.

Practical implication: model the agent as a privileged non-human identity and inventory every authentication path it can use.

Why Zero Trust matters for autonomous software actors

Zero Trust is relevant here because it shifts the security model from implicit trust to continuous verification and explicit authorization. For agentic AI, that means each tool call, data request, and downstream action should be constrained by context rather than assumed safe because the agent was previously approved. The challenge is that many organisations still design automation for speed first and governance second, which leaves a gap between what the agent can do and what the organisation can explain after the fact.

Practical implication: enforce deny-by-default boundaries around agent actions and require explicit scope for every high-risk system.

Threat narrative

Attacker objective: The attacker aims to hijack a trusted AI workflow so that legitimate access is used to reveal data, perform actions, or spread manipulation across business systems.

1. Entry occurs when an attacker places malicious instructions inside content the agent is expected to process, such as an email, document, website, or message.
2. Credential abuse follows when the agent uses its legitimate API keys, browser sessions, or integrated accounts to act on those instructions across connected systems.
3. Impact appears when the agent exposes sensitive data, triggers unintended purchases or changes, or carries out actions outside the organisation's intended boundaries.

Breaches seen in the wild

• CoPhish OAuth phishing via Copilot Studio: Datadog showed Copilot Studio agents on a Microsoft domain can front OAuth consent phishing and forward stolen tokens; no victims reported.
• AI agent retail card theft campaign 2026: AI agents breached 27+ retailers for about $25 each, used cloud keys and a Secrets Manager dump, and stole 600,000+ payment cards.

Read and download The State of NHI & AI Agent Breach Report 2026, covering 200+ breaches impacting Non-Human Identities including AI Agents.

NHI Mgmt Group analysis

Agentic AI is becoming an identity governance problem, not just an AI problem. The central issue is that software is now being trusted with delegated authority inside live business workflows. That means access scope, approval boundaries, and evidence of intent matter more than model quality alone. Practitioners should treat agent governance as part of identity governance, not as a separate AI side project.

Prompt injection is a privilege escalation path when the agent can act on the world. The article captures a key failure mode that many teams still underweight: malicious content does not need to break the model if it can redirect a legitimate actor with valid access. That makes the real control question not whether the agent can read something, but whether reading it can change authorised actions. Practitioners should design controls around action suppression, not just content screening.

Standing access for agents creates a new form of non-human overprivilege. The more tools and sessions an agent accumulates, the more it resembles an over-entitled service account with unpredictable execution patterns. That is a direct NHI governance concern because lifecycle, ownership, offboarding, and privilege review all become harder once access is spread across inboxes, cloud platforms, and business systems. Practitioners should inventory agents the way they inventory high-risk NHIs.

Zero Trust for AI agents is becoming a practical control model, not a slogan. The article reinforces that deny-by-default and explicit scoping are the only defensible starting points when software can improvise across systems. In identity terms, this is a shift from certifying what an agent may have had access to, toward governing what it can do in the moment. Practitioners should align agent access with Zero Trust and continuous verification.

Agentic AI creates governance debt if organisations deploy faster than they can audit. The hardest problem is often not the first action, but the inability to reconstruct why the agent acted after the fact. That weakens accountability, incident review, and control assurance. Practitioners should require logs that preserve prompts, tool calls, and decision context, or accept that the agent will outpace governance.

From our research library:

• 53% of security leaders expect AI to run major portions of their infrastructure autonomously within the next three years, according to the 2026 Infrastructure Identity Survey.
• Read next: Agentic AI Identity Guide

What this signals

Agentic access control is moving from edge case to baseline requirement: 69% of security leaders agree identity management must fundamentally shift to address agentic AI systems, and that is a governance signal, not a trend line. Access models built for human workflows will not hold once software can choose actions, sequence tasks, and carry delegated authority across systems.

Organisations that still rely on static credentials for AI workflows are compounding the problem, because the privilege lasts longer than the task and expands the blast radius of any manipulation. That is why agent identity, tool scoping, and revocation discipline are becoming core programme controls rather than implementation details.

For practitioners

• Define each AI agent as a governed non-human identity Assign ownership, purpose, approved tools, and offboarding criteria for every agent that can authenticate or act independently.
• Scope agent permissions to single-purpose workflows Remove broad, reusable access and separate inbox, payment, code, and cloud privileges so one agent cannot pivot across functions.
• Block untrusted content from influencing high-risk actions Treat external documents, messages, and web content as untrusted inputs that cannot directly trigger sensitive changes, transfers, or approvals.
• Require action-level logging for agent decisions Capture prompts, tool calls, inputs, outputs, and downstream actions so investigators can reconstruct why the agent behaved as it did.
• Apply deny-by-default controls to agent integrations Use Zero Trust rules to force explicit approval for each new system connection, especially where the agent can access customer data or money movement.

Key takeaways

• Agentic AI turns software into a delegated actor, which changes the security problem from content generation to action governance.
• The main exposure is not only malicious behaviour by the model, but manipulation of legitimate access through prompt injection and overbroad permissions.
• Identity teams should treat AI agents as governed non-human identities and enforce explicit scope, logging, and Zero Trust boundaries.

Key terms

• Agentic AI: Autonomous AI systems capable of planning, deciding, and taking actions, including calling APIs, writing code, and orchestrating other agents, with minimal human oversight. Agentic AI introduces new NHI risks as agents must authenticate to external services.
• Prompt Injection (Agentic): An attack where malicious instructions are embedded in content that an AI agent reads, causing the agent to execute unintended actions using its own legitimate credentials. A primary vector for agent goal hijacking and identity abuse.
• Non-Human Identity (NHI): A digital identity assigned to a non-human entity such as a software application, service account, API key, bot, machine, or AI agent that enables it to authenticate and interact with systems without direct human involvement. NHIs now outnumber human identities in most enterprises by 25 to 50 times.
• Zero Trust: A security model that assumes no identity, human or non-human, should be trusted by default, even inside a network perimeter. Every access request must be verified, authorised, and continuously validated.

Deepen your knowledge

NHI Foundation Level course, the industry's only accredited NHI security programme, covers NHI governance, machine identity security, and secrets management. It helps practitioners translate identity controls into operational discipline for human and non-human actors.