AI agent identity risk is outpacing enterprise IAM controls

At a glance

What this is: This is a weekly threat roundup that highlights how identity, automation, and AI-driven attack paths are converging, with zero-click prompt injection standing out as the clearest identity governance risk.

Why it matters: It matters because IAM teams now have to govern not just accounts and secrets, but AI-mediated execution paths that can act on data and services before human review is possible.

By the numbers:

• 27 days

👉 Read Anomali's Cyber Watch coverage of zero-click prompt injection and identity risk

Context

AI agent identity risk is becoming more visible because systems that read external content and act on connected services can be turned into execution paths for malicious instructions. In identity terms, that means the trust boundary is no longer limited to login and token issuance. It extends to what the system ingests, how it interprets that input, and which actions it can trigger.

For IAM, NHI, and PAM teams, the important shift is that access control alone does not describe the full risk surface. When an agent can automatically consume emails, documents, or third-party data and then act on them, governance has to cover the ingestion path, the tool path, and the output path together. That is a different control problem from conventional user access management.

Key questions

Q: How should security teams govern AI agents that can access enterprise systems?

A: Security teams should govern AI agents as non-human identities with explicit ownership, scoped privileges, and continuous monitoring. The control set should include inventory, task-bound credentials, audit trails, and revocation paths. If an agent can call tools or touch production systems, it belongs in the same governance model as service accounts and other machine identities.

Q: Why do AI agents complicate traditional IAM controls?

A: AI agents complicate traditional IAM controls because they do not behave like human users with short, predictable sessions. They can act continuously, chain actions, and reuse the same identity across many systems. That creates a governance problem centered on access duration, revocation, and blast radius, not just authentication.

Q: What breaks when prompt injection reaches a tool-using AI agent?

A: What breaks is the assumption that the model's output is low impact. Once the agent can call tools, a malicious instruction can become a database query, a file write, an email, or a deployment action. Without policy checks and approval gates, the agent's legitimate permissions become the attacker's path to impact.

Q: Who is accountable when an AI agent accesses sensitive data it was not meant to use?

A: Accountability sits with the team that approved the agent, its connectors, and its policy boundaries, not with the runtime behaviour alone. Organisations need ownership for intent, permissions, monitoring, and validation so they can prove whether the agent stayed inside its approved purpose. Without that, audit and regulatory response become retrospective guesswork.

Technical breakdown

How zero-click prompt injection becomes an execution path

Zero-click prompt injection works when malicious instructions are embedded in content that an AI system is already authorised to process. The model does not need a user to click or approve anything if the surrounding workflow lets it read external data and call tools automatically. The risk is not only model manipulation. It is delegated execution through trusted integration points such as email, documents, or connected services. Once the agent consumes the payload, the system may treat attacker-authored text as operational intent, which can drive unintended actions or disclosure.

Practical implication: treat every ingested data source as a potential control boundary and constrain which sources can reach agentic workflows.

Why agentic tools behave like privileged non-human identities

An AI agent is not just a model. It is a runtime system that can hold credentials, call APIs, and move data across services. That makes it behave like a privileged non-human identity with a decision layer attached. The identity risk changes when the system can combine context, select actions, and execute them without a human approval gate. In that case, the real control question is not who signed in, but what the agent is allowed to read, retain, and transmit after interpretation.

Practical implication: apply NHI-style entitlement review, secret isolation, and output monitoring to any agent that can act across multiple systems.

Why prompt injection needs identity controls, not only model controls

Prompt injection is often discussed as an AI safety issue, but in enterprise environments it is also an identity and access issue. The abuse path depends on connected credentials, delegated permissions, and weak separation between input handling and action execution. If the agent can access internal data or external services, the attacker does not need to break authentication. They only need to steer a trusted execution path. That makes the control plane as important as the model itself.

Practical implication: bind model permissions to narrowly scoped service identities and review tool permissions as if they were production workload access.

Threat narrative

Attacker objective: The attacker wants to turn trusted AI processing into a covert exfiltration and action channel that bypasses normal user awareness.

1. Entry occurs when malicious instructions are embedded in content already allowed into an AI workflow, such as email, documents, or connected services.
2. Escalation follows when the agent interprets that content as operational intent and uses its delegated access to read or move data.
3. Impact occurs when the agent transmits sensitive information or performs unintended actions without any direct victim interaction.

Breaches seen in the wild

• CoPhish OAuth Token Theft via Copilot Studio — CoPhish campaign exploits Microsoft Copilot Studio agents to steal OAuth tokens via AI-assisted phishing.
• Gemini AI Breach — Google Calendar Prompt Injection — Gemini AI assistant prompt injection attack leaks sensitive Google Calendar data.

Read our 52 NHI Breaches Analysis report for a comprehensive view of breaches impacting Non-Human Identities including AI Agents.

NHI Mgmt Group analysis

Zero-click prompt injection is an identity problem before it is a model problem: The attack succeeds because an authorised execution path can be steered by untrusted content. That means the core failure is not simply unsafe text handling. It is delegated action without sufficiently narrow identity boundaries. For practitioners, the lesson is that agent governance must start with the permissions behind the agent, not the prompt in front of it.

AI agent identity collapses the old separation between user intent and system action: Traditional IAM assumes requests are initiated deliberately and can be reviewed before action is taken. In an agentic workflow, the system itself can translate input into action at runtime, which changes the assurance model for access reviews, approvals, and audit evidence. Teams need to recognise that the actor is no longer a passive consumer of access but an active decision layer.

Ephemeral trust debt is the right name for this risk: The longer a connected AI system can retain context, tokens, and tool access, the more likely it is to carry attacker influence into later actions. That is not just privilege sprawl. It is trust accumulation across a session boundary. The practitioner conclusion is that retention, scope, and tool use must be treated as one governance unit.

Agentic governance must extend NHI controls into runtime behaviour: Service-account thinking still matters, but it is no longer enough when the identity can interpret, decide, and act. The same controls used for workload identities need a behavioural layer for tool choice, content provenance, and outbound action limits. The implication for identity programmes is that AI agents belong in NHI governance, but with an additional runtime decision lens.

From our research:

• The average estimated time to remediate a leaked secret is 27 days, according to The State of Secrets in AppSec.
• Only 44% of developers are reported to follow security best practices for secrets management, exposing a significant developer behaviour gap.
• The next step is to connect secrets discipline to broader identity governance, including Top 10 NHI Issues and session-level control design.

What this signals

Ephemeral trust debt: AI agents that retain context, tokens, and tool access across multiple actions create accumulating governance risk even when no single action looks dangerous. Identity programmes should watch for workflows where the scope of access outlives the original user intent, because that is where agentic abuse becomes hardest to detect.

With 43% of security professionals already concerned about AI systems learning and reproducing sensitive information patterns from codebases, the control conversation now extends beyond storage and into inference-time behaviour. That is why identity teams need to align agent permissions with the principles in OWASP Agentic AI Top 10 and keep a hard boundary around what the system can read, retain, and emit.

Programme owners should expect AI-agent governance to converge with NHI lifecycle practice. Recertification, offboarding, and entitlement review will matter for agent identities in the same way they matter for service accounts, but the review criteria will need to include runtime decision scope, not just static access lists.

For practitioners

• Restrict agent ingestion paths Limit which emails, documents, feeds, and third-party sources can reach AI workflows. Separate high-trust internal sources from untrusted external content and require explicit validation before content can influence tool use.
• Scope tool permissions to a single purpose Assign each agent the smallest possible set of API calls, data scopes, and write actions. Review those scopes as if they belonged to a production workload identity, not a convenience automation account.
• Add output and action monitoring Log what the agent read, what it decided, and what it executed. Alert when a session attempts unusual data movement, unexpected tool chaining, or disclosure of sensitive information.
• Separate human approval from high-risk actions Require a human gate for external sharing, credential use, or destructive changes. Do not allow the agent to convert interpreted input directly into irreversible actions.
• Reclassify AI agents inside NHI governance Inventory agent identities alongside service accounts, API keys, and tokens. Apply lifecycle ownership, recertification, and offboarding to the credentials that let agents act.

Key takeaways

• Zero-click prompt injection turns trusted AI ingestion paths into covert execution channels, which makes this an identity governance issue as much as an AI safety issue.
• Conventional IAM assumes access is deliberate, reviewable, and stable across the session, but agentic workflows can turn input into action before that assumption holds.
• Security teams need to govern agent permissions, ingested content, and outbound actions as one control surface rather than treating the model and the identity separately.

Key terms

• Agentic AI Identity: The complete set of credentials, permissions, and governance controls applied to an autonomous AI agent — covering authentication, authorisation, action logging, and access revocation. Distinct from traditional NHI because agent identities are often ephemeral, delegated, and multi-hop.
• Prompt Injection (Agentic): An attack where malicious instructions are embedded in content that an AI agent reads — causing the agent to execute unintended actions using its own legitimate credentials. A primary vector for agent goal hijacking and identity abuse.
• Ephemeral Credential Trust Debt: Ephemeral credential trust debt is the hidden risk that appears when short-lived tokens create a false sense of safety while permissions remain broad. The credential expires quickly, but the underlying blast radius stays large unless identity scope, revocation, and audit controls are also tightened.
• Tool Scope: The specific set of actions or resources a tool-enabled identity is allowed to use. For MCP, scope is the practical boundary that keeps a model-connected server from turning into broad system access. Weak scope design creates unnecessary blast radius and complicates later revocation.

What's in the full analysis

Anomali's full article covers the operational detail this post intentionally leaves for the source:

• The full weekly threat roundup context behind the zero-click prompt injection item and the other threats covered in the same edition.
• The article’s direct source links to the underlying reporting on the AI abuse technique and the related threat items.
• The broader mix of identity, exploitation, and phishing topics that informed the roundup.
• The original analyst commentary that frames each item from the source publisher’s perspective.

👉 Anomali's full Cyber Watch roundup includes the original reporting links and analyst comments for each threat item.

Deepen your knowledge

NHI governance, agentic AI identity, and machine identity lifecycle are core topics in our NHI Foundation Level course, the industry's only accredited NHI security programme. If you are building or maturing an identity security programme, it is worth exploring.