AI agent exposure is becoming a distinct NHI security domain

At a glance

What this is: This is an analysis of why AI agent exposure is becoming a separate NHI security domain, with Gartner’s report and Astrix Security’s commentary both pointing to delegated credentials and behavioural risk as the defining issues.

Why it matters: IAM, PAM, and NHI teams need to treat AI agents as a governance problem tied to the credentials they use, because the exposure is defined by access paths and runtime behaviour, not by the agent label alone.

By the numbers:

• The DSEM category attracted $2.1 billion in venture investment between 2023 and 2026, reflecting how quickly AI agent exposure is being funded as a security domain.

Context

AI agent exposure is the gap between what an agent can reach and what current IAM and security tooling can actually govern. In this article’s framing, the problem is not the model itself but the delegated credentials, OAuth tokens, service accounts, and API keys that let an agent act inside enterprise systems.

That creates an NHI governance issue as much as an AI security issue. Traditional exposure management assumes a relatively stable asset or user boundary, while agents can expand or mutate their access graph through tool use, cross-system delegation, and continuous execution.

The article argues that this is now distinct enough to justify domain-specialised treatment. That is a reasonable position for practitioners who have already seen machine identity sprawl outgrow human IAM controls and want to avoid repeating the same mistake with agents.

Key questions

Q: What breaks when AI agents are not governed at runtime?

A: Without runtime governance, an agent can shift behaviour after provisioning and still execute actions that were never reviewed in context. That is where tool chaining, MCP connections, and rapid decision-making become dangerous. Static approval cannot stop a live change in intent, so teams lose control at the point of action.

Q: When do AI agent credentials create more risk than they reduce?

A: They create more risk when they are long-lived, over-scoped, hard to revoke, or copied into code and prompts. At that point the credential becomes a standing trust asset with unclear ownership. Security teams should reject any pattern that cannot be traced to a specific agent, environment, and revocation process.

Q: What are the signs that an AI agent may be running out of control?

A: Look for unusual consumption patterns rather than a single spike. Warning signs include token usage at the wrong hours, against the wrong model, or at a volume that does not match the task. A session that keeps consuming without useful progress, or that runs far longer than expected, often indicates a retry loop, orphaned agent, or compromised key.

Q: How should security teams implement NHI governance before AI agents scale further?

A: Start with continuous discovery, then add ownership, lifecycle triggers, certification, and escalation. Security teams should not treat those as separate projects. They form one control loop that tells you what exists, who is responsible, when access should change, and when the identity should be removed.

Technical breakdown

Why agent exposure is an NHI problem, not just an AI problem

AI agents rarely authenticate on their own. They operate through non-human identities such as OAuth tokens, service accounts, API keys, and other delegated credentials that determine what the agent can reach. The technical risk is therefore not limited to the model’s output quality. It sits in the access graph connecting the agent to SaaS, cloud, and internal systems. Once that graph is broad or poorly inventoried, the agent inherits whatever privilege the underlying identity carries, including access paths that humans may never review in the same way. This is why exposure management for agents must start with identity inventory and entitlement scope, not with model prompts or content filters.

Practical implication: Map every agent to the exact NHI credentials it uses and remove any access path that cannot be justified at issuance time.

How behavioural risk changes the exposure model

Conventional scanners and periodic access reviews are built for mostly static conditions. AI agents introduce behavioural risk because the same credential can be used in different ways depending on runtime context, tool choice, and task sequencing. That means the exposure is not just whether access exists, but whether the access can be combined, delegated, or extended in ways the original approval never anticipated. In practice, this pushes exposure management beyond simple entitlement checks into runtime validation of what the agent is doing with the access it already has. The meaningful control question becomes whether the allowed action set matches the agent’s actual operational reach.

Practical implication: Validate agent behaviour against privilege scope in production, not only at provisioning or recertification time.

Why domain-specialised exposure management is emerging

Gartner’s framing of Domain Specialised Exposure Management reflects a real pattern in security architecture. Some exposure domains are too dynamic or context-dependent for broad platforms to model well. AI agent environments are one of them because the relevant signals span identity, behaviour, delegation, and reachability across multiple systems. A general exposure product may see a token; it may not understand the downstream access graph or the significance of an MCP server in the chain. Specialised coverage is emerging because the control problem is not generic asset visibility. It is contextual reachability tied to non-human identity behaviour.

Practical implication: Treat agent exposure as a specialised governance domain and evaluate tools on access-context awareness, not on broad inventory claims alone.

Threat narrative

Attacker objective: The objective is to exploit or abuse the agent’s delegated access to reach enterprise systems and data that were not meant to be exposed through that identity path.

1. Entry occurs through legitimate delegated access, typically via OAuth tokens, service accounts, or API keys assigned to an AI agent.
2. Credentialed access is then extended by the agent’s runtime behaviour, which can combine tools and reach systems beyond the original intent of the approval.
3. Escalation happens when over-privileged access paths or shadow agents create a broader access graph than IAM teams can see.
4. Impact is realised through unauthorised system reach, data exposure, or policy-violating actions executed under valid non-human credentials.

Breaches seen in the wild

• CoPhish OAuth phishing via Copilot Studio: Datadog showed Copilot Studio agents on a Microsoft domain can front OAuth consent phishing and forward stolen tokens; no victims reported.
• Dropbox Sign breach 2024: A compromised back-end service account gave attackers Dropbox Sign customer data, including API keys, OAuth tokens and MFA information.

Read our 52 NHI Breaches Analysis report for a comprehensive view of breaches impacting Non-Human Identities including AI Agents.

NHI Mgmt Group analysis

AI agent exposure is now its own NHI governance domain: the decisive security question is no longer whether an agent exists, but which delegated credentials let it move through enterprise systems. Gartner’s report reflects a market shift toward treating that access graph as a separate exposure surface. For IAM and PAM teams, that means the control boundary has moved from the agent instance to the non-human identity estate behind it.

Generalist exposure tools miss the control problem that matters most: standard scanners and periodic access review processes were built for more stable identities and more predictable reachability. Agents create a faster, more adaptive entitlement path, so the old assumption that access can be evaluated after the fact becomes unreliable. The implication is that exposure governance has to move closer to issuance, context, and runtime behaviour.

Identity blast radius is the right concept for AI agent security: the agent is only the actor; the blast radius is defined by the OAuth tokens, service accounts, and API keys that the agent can exercise. That framing is useful because it connects AI governance back to NHI lifecycle control, where inventory, least privilege, and revocation are already familiar disciplines. Practitioners should measure agent risk by reachable systems, not by model capability.

Domain-specialised exposure management will reshape procurement and operating models: once agent exposure is treated as a distinct category, teams will need separate validation logic for agent identities, MCP servers, and shadow agents rather than folding them into generic cloud or identity tooling. That will accelerate convergence between NHI governance and AI security operations. The practical consequence is that security architecture reviews must now ask whether current controls can model agent-specific access paths at all.

Shadow agents make governance incomplete by default: if discovery only covers sanctioned deployments, the organisation will miss the identities that matter most to exposure management. That is a classic NHI problem with a new surface area, because unregistered access paths are where lifecycle control breaks down first. Practitioners need to assume that agent inventory will be incomplete unless discovery spans cloud, SaaS, and delegated credentials together.

From our research library:

• 70% of organisations grant AI systems more access than they would give a human employee performing the exact same job, according to the 2026 Infrastructure Identity Survey.
• Read next: Agentic AI Identity Guide

What this signals

Identity blast radius will become the organising concept for agent governance: teams will increasingly measure risk by what an AI agent can reach through delegated credentials, not by the sophistication of the model itself. That pushes the programme back toward entitlement scoping, credential lifecycle, and discovery across cloud and SaaS.

The practical pressure point is shadow inventory. If sanctioned agents are the only ones visible, governance will lag reality because the most dangerous access paths are often the least documented.

This is where agent security converges with NHI discipline: the organisation that can inventory, scope, and revoke agent credentials quickly will have a defensible exposure programme, while everyone else will be managing symptoms after the access graph has already expanded.

For practitioners

• Inventory agent-linked non-human identities Create a single register for OAuth tokens, service accounts, API keys, and MCP-related access used by AI agents across cloud and SaaS environments.
• Reduce delegated access to the minimum reachable graph Review each agent’s effective blast radius and remove entitlements that are not required for the task, including cross-system permissions inherited from parent identities.
• Validate shadow agent discovery continuously Extend discovery beyond approved deployments so unregistered agents and hidden MCP servers are visible before they create unmanaged exposure.
• Tie remediation to credential lifecycle events Revoke or rotate agent credentials when behaviour violates policy, when scope expands unexpectedly, or when the underlying business use case changes.

Key takeaways

• AI agent exposure is becoming a separate security domain because the real risk sits in delegated access, not in the model label alone.
• The article points to compromised reachability through OAuth tokens, service accounts, and API keys as the practical source of agent blast radius.
• Security teams should govern AI agents through NHI inventory, least privilege, and revocation workflows, then layer behavioural oversight on top.

Key terms

• AI Agent Exposure: AI agent exposure is the set of reachable systems, data, and actions created when an autonomous agent receives credentials and tool access. It is broader than vulnerability exposure because it includes delegated authority, runtime behavior, and the blast radius created by connected identities.
• Identity Blast Radius: The amount of damage a compromised identity can cause across systems, data, and infrastructure. In NHI environments, it is shaped by permissions, network reach, and administrative capability rather than by the credential alone. Reducing blast radius is a containment strategy that limits lateral movement and data exposure.
• Domain Specialized Exposure Management: Domain specialized exposure management is a security approach built for one high-complexity attack surface, such as AI agents, rather than broad infrastructure risk. It combines discovery, validation, and remediation using context the general-purpose tools usually lack.
• Shadow Agent: An AI agent deployed without formal registration, identity governance, or security oversight, the agentic equivalent of shadow IT. Shadow agents are more dangerous than typical shadow NHIs because they actively take actions using their credentials.

Deepen your knowledge

NHI governance, agentic AI identity, and machine identity lifecycle are core topics in our NHI Foundation Level course, the industry's only accredited NHI security programme. If you are building or maturing an IAM programme, it is worth exploring.