AI adoption is widening the attack surface around agents and models

At a glance

What this is: This is an analysis of how enterprise AI adoption expands attack surface through overprivileged agents, shadow AI, and exposed model infrastructure.

Why it matters: It matters because IAM, PAM, and NHI teams now have to govern AI tools and agents as identities that can move laterally, reach sensitive systems, and bypass traditional containment assumptions.

By the numbers:

• AI-driven attacks have increased 56% in the last year, according to Zero Networks.
• Security breaches involving AI tools are surging even faster, rising 61% year-over-year, according to Zero Networks.
• Nearly 90% of organizations use AI in at least one business function, according to Zero Networks.
• AI agent adoption is expected to grow 85% within the next year, according to Zero Networks.

👉 Read Zero Networks' analysis of AI security best practices and containment architecture

Context

Enterprise AI changes the identity problem before it changes the threat model. Every new AI tool, agent, and model connection creates another path into systems, data, and workflows, which means AI security is really an access governance issue as much as a tooling issue. The primary keyword here is AI security, but the operational question is how much reach those identities are allowed to have.

The article argues that the common failure is not the presence of AI itself but the absence of containment around it. That matters to NHI, IAM, and PAM teams because AI agents, SaaS AI services, and model infrastructure all behave like governable access subjects once they are connected to enterprise systems.

Key questions

Q: How should security teams implement AI containment without blocking business use?

A: Start by treating AI tools and agents as governed identities, not just applications. Define approved destinations, restrict each agent to task-scoped access, and use segmentation to limit what it can reach by default. This preserves business use while preventing uncontrolled expansion of the attack surface and reducing lateral movement opportunities.

Q: Why do autonomous agents create more lateral movement risk?

A: Autonomous agents often need broad, chained access across APIs, data stores, and external services, so a compromised identity can move through multiple systems quickly. That is why identity blast radius and control boundaries matter as much as detection.

Q: What are the signs that shadow AI is creating governance and compliance gaps?

A: Common signs include limited visibility into who is using AI tools, no reliable audit trail for prompts and outputs, unclear data residency, and inconsistent handling of sensitive information. If compliance, legal, and executive teams lack the same visibility as IT, the organisation already has a governance gap. Those conditions make it difficult to prove control or investigate misuse.

Q: Should organisations prioritise microsegmentation or visibility first for AI security?

A: They should treat them as linked controls, but visibility comes first operationally because you cannot segment what you have not identified. Once the AI inventory is current, microsegmentation becomes the enforcement layer that limits reach and contains compromise. Discovery without containment is incomplete, but containment without discovery is blind.

Technical breakdown

AI-driven lateral movement and least agency

AI-driven lateral movement happens when an AI agent has broad enough permissions to move from one internal system to another, creating the same blast-radius problem seen with overprivileged service accounts. The article ties this to least agency, meaning the AI actor should be constrained in autonomy, tool access, and decision-making authority. Identity-based access controls and network-layer controls work together here because the agent is not just authenticated, it is also bounded in what it can reach. The security issue is not model intelligence, but excessive reach across email, CRM, cloud APIs, and code repositories.

Practical implication: govern AI agents as privileged identities and restrict cross-system reach before deployment.

Shadow AI and unapproved connectivity

Shadow AI is the unmanaged use of AI tools, agents, or embedded autonomous workflows outside security oversight. The technical problem is not only discovery, but also unapproved connectivity, because if a device or developer session can reach an external AI service, it can create data exposure or policy bypass without any identity review. Real-time inventory and deterministic control are needed to know which destinations exist, which agents are active, and which links are outside approved boundaries. In NHI terms, this is uncontrolled access growth through forgotten or unsanctioned integrations.

Practical implication: inventory AI destinations and block unsanctioned AI connections at the network layer.

LLM exposure as a structural access problem

The article frames LLM exposure as a network access problem rather than a model failure problem. That is a useful distinction, because model inversion, prompt injection, tampering, and data extraction often become possible when model infrastructure is reachable by more systems than it should be. Granular segmentation limits that exposure by ensuring only explicitly authorized systems and identities can reach model infrastructure. This is the same containment logic used for high-value NHI resources, applied to AI model estates and their surrounding services.

Practical implication: isolate model infrastructure so only authorized workloads and identities can reach it.

Threat narrative

Attacker objective: The objective is to turn AI access into a lateral movement path that exposes data, expands reach, or compromises model and enterprise systems.

1. Entry occurs when an attacker or unmanaged user reaches AI tools, SaaS AI destinations, or model infrastructure through overextended connectivity or exposed access paths.
2. Escalation happens when an AI agent or model-adjacent identity has enough reach to pivot laterally into email, cloud APIs, code repositories, or backend systems.
3. Impact follows when the compromised or misused AI path is used to extract data, tamper with model infrastructure, or amplify access into a broader enterprise breach.

Breaches seen in the wild

• Replit AI Tool Database Deletion — Replit vibe coding AI assistant deletes live production database and creates 4,000 fake user records.
• Meta AI Instagram Account Takeover — 20,225 Instagram accounts hijacked via compromised Meta AI support chatbot with overprivileged access.

Read our 52 NHI Breaches Analysis report for a comprehensive view of breaches impacting Non-Human Identities including AI Agents.

NHI Mgmt Group analysis

AI security is becoming an identity containment problem, not a model quality problem. The article’s strongest insight is that AI risk expands when tools, agents, and model connections are allowed to behave like loosely governed internal identities. That shifts the centre of gravity from model tuning to access boundaries, blast radius, and lifecycle governance. For practitioners, the control question is no longer only what the AI can produce, but what it can reach.

Least agency is the right control concept for AI agents because autonomy without boundaries creates lateral movement risk. AI agents connect to multiple systems by design, which means unconstrained permissions create the same structural problem as an overprivileged NHI. The article correctly ties this to identity-based access controls and network containment, because the agent’s authority must be bounded at the point of connection. Security teams should treat this as a privileged access problem with AI-specific execution patterns.

Shadow AI creates governance debt faster than traditional asset discovery can absorb it. Unsanctioned AI use is not just a visibility issue, it is an access-authorisation problem hidden inside everyday business adoption. That means discovery, approval, and enforcement must move together, otherwise the organisation ends up mapping a risk surface it still cannot control. The practical takeaway is that unmanaged AI should be handled as an identity sprawl issue, not as a narrow procurement issue.

Identity-based microsegmentation gives AI a finite blast radius, which is the correct security objective for non-human access subjects. The article’s containment architecture framing aligns with how NHI governance should work across service accounts, workload identities, and AI agents. Once AI is granted enterprise reach, the security objective becomes limiting propagation, not assuming prevention at the model layer. That makes segmentation, deterministic policy, and monitored enforcement the governance stack that actually scales.

AI adoption is exposing the same control gaps that already exist in many NHI programmes, but with higher speed and lower tolerance for delay. The article shows that organisations are adding AI faster than they are extending Zero Trust, which is a familiar lifecycle failure pattern in identity security. The difference is that AI agents and model interfaces can operationalise that gap immediately. Practitioners should treat AI as a forcing function for modernising access governance across human, NHI, and autonomous-like workflows.

From our research:

• 85% of organisations lack full visibility into third-party vendors connected via OAuth apps, according to The State of Non-Human Identity Security.
• Only 1.5 out of 10 organisations are highly confident in their ability to secure NHIs, compared with nearly 1 in 4 for securing human identities.
• That confidence gap is why practitioners should also review 52 NHI Breaches Analysis for the control patterns that fail when access outgrows governance.

What this signals

Shadow AI will keep growing faster than policy inventories unless identity teams own the control plane. The practical problem is that business users adopt AI first and security teams discover it later, which means the enforcement model must shift from periodic review to continuous visibility. With 85% of organisations lacking full visibility into third-party vendors connected via OAuth apps, the same discovery gap is likely to appear wherever AI tools attach to enterprise identity.

Identity-based containment is becoming the default architecture for AI governance. As AI agents gain enterprise reach, security teams should expect segmentation, least agency, and deterministic policy to become core controls rather than specialised overlays. That is the point where NHI governance, IAM, and network security converge around one operational question: what is this identity allowed to reach right now?

The next phase of AI security maturity will be measured by how quickly organisations can inventory, approve, and isolate AI connections before those connections become business-critical. Teams that already manage service-account sprawl and lifecycle governance will be better placed to extend the same discipline to AI agents and model infrastructure.

For practitioners

• Map AI identities and connections in real time Build a live inventory of AI tools, agents, SaaS destinations, and model infrastructure so you can see what is active, what it connects to, and what sits outside IT oversight.
• Constrain AI agents to least agency Apply identity-based access controls so each AI agent can only reach explicitly authorized systems, approved resources, and task-scoped connections.
• Isolate model infrastructure with segmentation Segment model environments so only authorized workloads and identities can reach them, reducing the chance of tampering, extraction, or prompt abuse.
• Enforce deterministic guardrails for AI policy Base policy creation and enforcement on observed network behavior rather than assumptions, then simulate segmentation changes before allowing new AI deployments.
• Block unsanctioned AI connections by default Use network-layer controls to deny access to SaaS AI destinations and embedded autonomous workflows unless they appear on an approved list.

Key takeaways

• AI security is increasingly an identity containment problem, because tools and agents expand attack surface when they are allowed broad internal reach.
• The evidence points to rapid adoption outpacing governance, with shadow AI, overprivileged agents, and exposed model environments all creating avoidable exposure.
• Practitioners should respond by combining discovery, least agency, segmentation, and deterministic enforcement across AI and NHI estates.

Key terms

• AI-induced lateral movement: A lateral-movement pattern where an attacker uses an AI layer to pivot through authorised workflows instead of moving directly across the network. The model or agent becomes the intermediary for access, data exposure, or action execution, which makes trust boundaries as important as credentials.
• Shadow AI: AI agents, copilots, or connected tools operating without full visibility or governance from security teams. Shadow AI becomes an identity problem when those systems authenticate with unmanaged tokens, service accounts, or OAuth apps that can reach production resources.
• Least Agency: The agentic equivalent of least privilege — the principle that AI agents should be granted only the minimum level of autonomy necessary to complete their designated task, and no more. Coined in the OWASP Top 10 for Agentic Applications 2026.
• Deterministic Guardrails: Hard controls that constrain what an AI system can do, regardless of what it wants to do next. In practice, they limit tools, actions, destinations, and escalation paths so runtime behaviour stays inside policy. For autonomous or agentic systems, this is the control pattern that replaces trust in self-policing.

What's in the full article

Zero Networks' full article covers the operational detail this post intentionally leaves for the source:

• The specific AI segmentation pattern used to constrain lateral movement across tools, agents, and model infrastructure.
• The article's breakdown of least agency enforcement for AI agents and how it maps to identity-based access controls.
• The deterministic guardrail approach for policy creation and enforcement as AI adoption scales.
• The practical network-visibility questions teams should use to inventory SaaS AI destinations and embedded workflows.

👉 Zero Networks' full post covers AI lateral movement, shadow AI discovery, and model isolation in more operational detail.

Deepen your knowledge

NHI governance, agentic AI identity, and machine identity security are core topics in our NHI Foundation Level course, the industry's only accredited NHI security programme. If you are building or maturing an identity security programme, it is worth exploring.