Agentic AI security and API exposure are becoming a fourth pillar

At a glance

What this is: Salt argues that AI agents and MCP servers are pushing API security into a standalone fourth pillar because existing endpoint, network, and cloud controls leave major visibility and governance gaps.

Why it matters: For IAM, PAM, NHI, and agentic AI programmes, this matters because machine-to-machine access is increasingly mediated through APIs, so inventory, authorization, and runtime governance now need to move together.

By the numbers:

• APIs now account for over 80% of web traffic, according to Salt.

Context

API security is no longer just a subtopic of cloud or application security. When AI agents and MCP servers drive most interactions through APIs, the control problem shifts from protecting a perimeter to understanding which machine actors can call which services, with what data, and under what conditions.

That shift creates a direct identity governance issue. APIs become the enforcement point for non-human identities, because agents, MCP servers, service accounts, and delegated workflows all depend on machine-to-machine authorization. Existing security models struggle when the asset to govern is not a device or user session, but a dynamic call path between software actors.

Key questions

Q: What breaks when autonomous AI agents rely on APIs with weak object-level authorization?

A: What breaks is the assumption that a valid login or token proves safe access. An autonomous agent can stay authenticated while walking through thousands of objects it was never meant to see. That turns Broken Object Level Authorization into a scale problem, because each individually valid request can still be collectively destructive.

Q: Why do network and endpoint controls miss the main risk in AI workflows?

A: Network and endpoint controls focus on bytes, hosts, and containers, but AI risk often lives in meaning and intent. A prompt can combine pasted records, retrieved context, and software actions into one event that is technically valid yet still unsafe. Those controls also struggle when an agent acts through credentials without a human session.

Q: What are the signs that shadow API governance is not working?

A: Warning signs include teams using the same API with different accounts, no clear business or technical owner, and no reliable catalog of approved dependencies. If new APIs are still appearing without review, or auditing never results in action, the process is failing. A mature program should make approved usage easy to verify and unapproved usage hard to miss.

Q: How should teams govern non-human identities in AI-heavy environments?

A: Teams should govern non-human identities the same way they govern other privileged assets: assign ownership, minimise scope, rotate credentials regularly, and monitor for abnormal use. The key difference is speed. AI-driven workflows can exploit exposed access quickly, so detection and revocation must be automated and tied to lifecycle controls.

Technical breakdown

Why APIs become the control plane for agentic AI

Agentic AI systems do not operate through a traditional user interface most of the time. They execute by chaining API calls across services, so the API layer becomes the practical control plane for action, not just data transfer. That means the security problem shifts from packet inspection or device hardening to governing which identities can invoke which functions, with what parameters, and at what rate. In this model, inventory and runtime authorization matter more than static perimeter assumptions. For identity teams, the critical point is that the agent’s privilege is expressed through API access, not through a visible user login event.

Practical implication: Treat API authorization as identity governance for machine actors, not as a separate technical afterthought.

Why endpoint, network, and cloud controls miss machine-speed API abuse

Endpoint tools are built to observe devices. Network controls are built to inspect flows. Cloud security is built to watch configurations and workloads. None of those layers were designed to interpret high-volume, machine-driven API behaviour where the meaningful signal is the sequence of calls, the relationship between callers, and the intent behind requests. That creates a blind spot when an agent behaves within normal transport patterns but outside expected business logic. Traditional controls can see that traffic exists, yet still fail to tell whether an MCP server or AI agent is overreaching, confused, or manipulated.

Practical implication: Add runtime API behaviour monitoring where business logic and access scope can be evaluated together.

What shadow MCP and undocumented APIs change for governance

The article’s strongest point is that discovery is now a governance issue. If teams cannot reliably inventory agents, MCP servers, and APIs, then they cannot define ownership, apply policy, or validate least privilege. Shadow MCP deployments and undocumented endpoints create invisible trust relationships, which is exactly where policy drift and privilege accumulation take hold. That makes the problem a lifecycle problem as much as a security one. In practice, the missing control is not only inspection, but authoritative registration of every machine interface and every non-human identity path that can reach it.

Practical implication: Build authoritative inventory and ownership for MCP servers, APIs, and the non-human identities that use them.

Threat narrative

Attacker objective: The attacker seeks to exploit AI-driven API paths to reach sensitive data or privileged actions without touching the traditional user perimeter.

1. Entry occurs through exposed or shadow APIs that AI agents and MCP servers can reach without complete governance coverage.
2. Credential or authorization abuse follows when an agent is allowed to call APIs beyond the scope it actually needs, creating confused-deputy conditions.
3. Escalation happens when chained API calls or manipulated agent workflows reach sensitive data or privileged business functions.
4. Impact is unauthorized data exposure, workflow abuse, or business logic compromise at machine speed.

Breaches seen in the wild

• Langflow Flodrix botnet 2025: Attackers used Langflow's unauthenticated code endpoint to dump AI servers' environment variables and enlist them in the Flodrix botnet.

Read and download The State of NHI & AI Agent Breach Report 2026, covering 200+ breaches impacting Non-Human Identities including AI Agents.

NHI Mgmt Group analysis

Agentic AI security becomes a governance problem the moment APIs become the action layer. If AI agents are making decisions and then executing those decisions through APIs, the real control point is no longer the model alone. It is the combination of identity, authorization, and runtime policy at the interface where software acts on behalf of software. Practitioners should treat that interface as a governance boundary, not just a technical dependency.

API inventory is now an identity inventory for machine actors. The article correctly identifies that organizations cannot secure what they cannot see, but the deeper implication is that undocumented APIs and shadow MCP servers create ungoverned trust relationships. That is a lifecycle failure, not just a discovery gap. Shadow API trust gap: once a machine identity can reach an unregistered service, policy and accountability both break down. The practitioner task is to make registration and ownership non-optional.

Legacy security stacks are missing behavioural context, not just packets. Endpoint, network, and cloud controls can all report traffic while still failing to explain whether an agent is operating inside its intended business logic. This is why machine-speed governance has to pair discovery with intent-aware monitoring. The important shift is from seeing activity to understanding whether the agent’s line of credit is being exceeded.

Agentic AI does not replace NHI governance, it concentrates it. AI agents, MCP servers, service accounts, and API keys are all part of the same trust chain, so the question becomes who or what may act, for how long, and against which functions. That makes NHI governance, workload identity, and API authorization converge into one operating model. Practitioners should expect identity teams to own more of the control surface, not less.

The market is signalling a category split between general security tooling and machine-actor governance. The fourth-pillar framing is less about branding than about control architecture. As AI-driven traffic grows, practitioners will need dedicated discovery, behavioural baselines, and authorization policy for machine actors, or else every other control layer will remain reactive. The implication for the field is clear: machine identity governance is becoming a first-class security discipline.

From our research library:

• 69% of security leaders agree identity management must fundamentally shift to address agentic AI systems, according to the 2026 Infrastructure Identity Survey.
• 53% of security leaders expect AI to run major portions of their infrastructure autonomously within the next three years, according to the 2026 Infrastructure Identity Survey.
• Read next: MCP Security Guide

What this signals

Agentic AI security is becoming a control-plane problem, not just an application-layer problem. When machine actors execute through APIs, governance has to move closer to the call path itself. That means security teams need discovery, authorization, and behavioural monitoring to converge around the same machine identity relationships, or policy will lag the systems it is meant to govern.

API inventory now doubles as trust inventory for NHI programmes. Every shadow API, MCP server, and delegated service account expands the number of machine actors that can reach sensitive data and business functions. Continuous discovery of AI-to-data bridges is therefore not a monitoring nice-to-have, but a prerequisite for credible machine identity governance.

Shadow API trust gap: once an unregistered interface becomes reachable by an agent, the organisation loses reliable visibility into who can invoke what. That is why registration, ownership, and behavioural baselines need to be treated as operating controls rather than documentation tasks. In practice, this is where agentic AI security converges with NHI governance.

For practitioners

• Map every AI agent to its API and MCP dependencies Create an authoritative register of each agent, the MCP servers it can reach, and the APIs those services expose. Include shadow deployments and unregistered endpoints so policy reflects reality, not developer assumptions.
• Define machine-speed authorization boundaries Limit each non-human identity to the specific APIs and operations it needs, and review whether agent actions are scoped to business functions rather than broad service access.
• Baseline normal API behaviour per agent Establish expected call frequency, sequence, and payload patterns for each agent so deviations can be detected as logic abuse rather than simple transport anomalies.
• Monitor the full prompt-to-API path Correlate agent prompts, intermediate decisions, and final API calls across gateways, load balancers, and runtime services to identify manipulated or overreaching workflows.
• Assign ownership to every machine interface Tie each API and MCP server to a business owner, a technical owner, and a review cadence so inventory, policy, and accountability stay aligned as the environment changes.

Key takeaways

• AI agents and MCP servers are turning APIs into the main control surface for machine action, which exposes a gap that endpoint, network, and cloud tooling cannot close alone.
• The risk is amplified by undocumented APIs and shadow MCP deployments, because unknown machine interfaces are also unknown trust relationships.
• Practitioners need authoritative inventory, function-level authorization, and behavioural monitoring tied to non-human identities if they want agentic AI governance to hold up in production.

Key terms

• Agentic AI Security: Agentic AI security is the discipline of securing autonomous AI systems that can take actions, use tools, and chain decisions without direct human approval at each step. It covers identity and access management for AI agents, prompt injection defence, tool call governance, credential scoping, and runtime monitoring. As agentic systems acquire real-world authority, API access, file writes, workflow triggers, the security model must treat them as non-human identities with explicit lifecycle controls, not trusted processes.
• Model Context Protocol: Model Context Protocol is an open protocol that lets AI agents connect to tools and data sources. It expands what an agent can reach, so governance has to cover not only the model and its prompts, but also every system that can receive or return agent-driven data.
• Shadow API: An API endpoint that exists in production but is not fully known, reviewed, or governed by the security programme. Shadow APIs often emerge through fast delivery, copy-paste development, or overlooked internal routes, and they create untracked exposure because they sit outside inventory, policy, and ownership processes.
• Machine-speed governance: Identity and access control that operates fast enough to keep up with automated or agentic execution. The concept matters because a control that works for humans but cannot respond within the session, task, or policy window is not actually governing the actor.

Deepen your knowledge

NHI Foundation Level course, the industry's only accredited NHI security programme, covers NHI governance, agentic AI identity, and machine identity security. It helps security and identity teams build the governance model needed for API-driven AI environments.