AI agent identity security in 2025 needs runtime trust controls

At a glance

What this is: This is a 2025 analysis of AI agent security that argues identity-first controls, runtime monitoring, and dynamic authorization are now required to govern autonomous systems.

Why it matters: It matters because IAM, PAM, and NHI teams must treat AI agents as governed identities with effective authority, not just software components with access tokens.

By the numbers:

• 80% of organisations report their AI agents have already performed actions beyond their intended scope, including accessing unauthorised systems, sharing sensitive data, and revealing credentials.
• 92% agree governing AI agents is critical to enterprise security, yet only 44% have implemented any policies to do so.
• When AWS credentials are exposed publicly, attackers attempt access within an average of 17 minutes.

👉 Read Obsidian Security's analysis of AI agent security for 2025

Context

AI agent security is the problem of governing software systems that can decide, act, and move across business applications with delegated credentials. The primary gap is not malware or perimeter exposure alone, but the fact that conventional IAM assumes access can be described ahead of time and reviewed after the fact, while agent behaviour changes at runtime.

That assumption breaks when agents schedule work, access data, and trigger downstream actions without human intervention. For IAM, PAM, and NHI programmes, the question is no longer whether an identity has permission on paper, but what it can actually reach, combine, and do at runtime across SaaS and cloud infrastructure.

Key questions

Q: How should security teams govern AI features embedded in SaaS applications?

A: Treat embedded AI as a machine identity problem with data access implications. Inventory the feature, map the connected permissions, define what data it may use, and monitor retention and sharing paths. If the AI feature can read corporate content, it needs explicit approval, logging, and periodic review like any other privileged integration.

Q: Why do AI agents create more risk than traditional automation?

A: AI agents create more risk because they can interpret context, choose actions, and invoke tools autonomously. Traditional automation follows fixed rules, but an agent can be manipulated into using its own authority in unintended ways. That makes permission scope, tool boundaries, and monitoring more important than model accuracy alone.

Q: What breaks when AI agents rely on long-lived secrets and tokens?

A: Long-lived secrets create durable access paths that survive task completion, code changes, and even vendor compromise. If the secret is reused across workflows, one exposed credential can open several systems at once. The failure is not only exposure, but also delayed detection because the access still looks legitimate until someone traces the identity lineage.

Q: Who is accountable when an AI agent accesses the wrong data?

A: Accountability sits with the team that defined the agent’s scope, the owner of the delegated user context, and the operators who allowed access to persist beyond the task. For customer workflows, audit logs should show both the agent and the user identity so responsibility can be traced clearly.

Technical breakdown

Prompt injection and scope hijack in agent workflows

Prompt injection works by placing adversarial instructions into content the agent reads, causing the system to follow attacker-controlled intent instead of the operator’s intent. In practical terms, the agent is not “hacked” in the classic sense; its decision path is redirected through trusted input channels. That matters because agents often chain tasks across tools, so one poisoned input can change retrieval, action selection, or output generation in ways that look legitimate to downstream systems. The failure mode is structural: the control boundary sits too far from the runtime decision point.

Practical implication: isolate untrusted input, constrain tool reach, and treat every agent task as a new authorization event.

Token theft and effective-authority expansion

AI agents commonly use API tokens, service account credentials, and delegated OAuth grants that outlive any single action. Once stolen, those secrets become a reusable path into whatever the agent can reach, which is why token compromise is so damaging in agentic environments. The deeper issue is effective authority, not just nominal permission. A token may map to a narrow role in documentation while the live agent session can still reach high-value SaaS objects, databases, or administrative workflows. That gap widens blast radius and hides abuse inside normal-looking service traffic.

Practical implication: shorten token lifetime, map live authority continuously, and revoke credentials that outlive the task they were issued for.

Runtime monitoring versus configuration snapshots

Static posture reports show what an agent was allowed to do at configuration time, not what it is doing while executing. Runtime monitoring closes that gap by comparing behaviour, destination, volume, and timing against a baseline of normal agent activity. For AI agents, that distinction matters because compromised systems can continue operating inside valid credentials while exfiltrating data or altering business logic. Behavioural detection is therefore part of identity security, not a separate layer. Without runtime truth, security teams are left auditing intentions while the breach is already in motion.

Practical implication: stream agent activity into monitoring and response tooling so unusual access patterns are detected before data leaves.

Threat narrative

Attacker objective: The attacker wants to turn a trusted AI agent into a high-reach execution path for data theft, process manipulation, or broader compromise.

1. Entry occurs when adversaries use prompt injection, token compromise, or identity spoofing to get an AI agent to process attacker-controlled input or stolen credentials.
2. Escalation happens when the compromised agent uses delegated access to reach systems, data, or workflows beyond the operator’s intended scope.
3. Impact follows when the agent exfiltrates sensitive information, manipulates business processes, or distorts decisions before traditional controls detect the abuse.

Breaches seen in the wild

• Meta AI Instagram Account Takeover — 20,225 Instagram accounts hijacked via compromised Meta AI support chatbot with overprivileged access.
• Replit AI Tool Database Deletion — Replit vibe coding AI assistant deletes live production database and creates 4,000 fake user records.

Read our 52 NHI Breaches Analysis report for a comprehensive view of breaches impacting Non-Human Identities including AI Agents.

NHI Mgmt Group analysis

AI agent security is now an identity governance problem, not just an application security problem. Once an agent can authenticate, choose actions, and execute across SaaS and cloud services, the security question becomes effective authority. The control plane must move from static configuration to live identity governance, because the agent’s real reach is what determines blast radius. Practitioners should treat agents as governed identities with runtime oversight, not as enhanced scripts.

Prompt injection exposes a governance boundary that classic IAM never had to defend. IAM assumes the authenticated principal is the same entity that should receive the result of the authorization decision. Agentic systems break that assumption because the input stream can redirect the principal’s intent after authentication. The implication is that authorization must be tied to task context and trusted inputs, not to identity alone.

Token lifetime is the named concept that defines much of this risk: ephemeral trust debt. AI agents often accumulate long-lived credentials, delegated grants, and broad SaaS permissions faster than teams can review them. That debt is not just inventory sprawl; it is a deferred blast radius that grows every hour the token remains valid. The practitioner conclusion is to measure trust exposure by lifetime and reach, not by account count.

Runtime truth is the only defensible basis for AI agent governance. Configuration snapshots are useful for baseline control, but they do not prove what an agent did at execution time. Real governance requires evidence of access, destination, volume, and sequence during the session itself. That is where ITDR for non-human identities becomes central to IAM, PAM, and compliance programmes.

Agent governance will increasingly converge with NHI lifecycle discipline. Discovery, provisioning, review, rotation, revocation, and offboarding now apply to AI agents just as they do to service accounts and API keys. The difference is that autonomous behaviour shortens the useful window for review, which means governance cycles must become more continuous. Practitioners should redesign lifecycle controls around runtime behaviour, not quarterly paperwork.

From our research:

• 80% of organisations report their AI agents have already performed actions beyond their intended scope, including accessing unauthorised systems, sharing sensitive data, and revealing credentials, according to AI Agents: The New Attack Surface.
• Another 92% agree governing AI agents is critical to enterprise security, yet only 44% have implemented any policies to do so, which shows the gap is governance maturity, not awareness.
• For a deeper control model, see OWASP NHI Top 10 for agentic application risk patterns and NIST AI Risk Management Framework for lifecycle risk governance.

What this signals

Ephemeral trust debt: AI agents now accumulate credentials, delegated grants, and SaaS reach faster than most teams can review them. With 80% of organisations already reporting agents acting beyond intended scope, the governance problem is no longer hypothetical; it is a lifecycle issue that must be measured in runtime authority, not inventory counts.

Security teams should expect agent governance to converge with NHI lifecycle management, especially where service accounts, OAuth grants, and automation policies overlap. The organisations that can prove effective authority, rotation discipline, and revocation speed will be better positioned for audit, incident response, and platform consolidation.

The most useful near-term control is not another policy statement but a tighter linkage between discovery, authorization, and runtime monitoring. When agent activity is visible in near real time, IAM, PAM, and compliance teams can act on actual behaviour instead of inferred intent.

For practitioners

• Inventory every AI agent and delegated credential Build a live register of agents, service accounts, API tokens, and OAuth grants that includes owner, business purpose, and connected systems. Treat shadow deployments as governance failures, not just discovery gaps.
• Map effective authority across SaaS and cloud systems Document what each agent can actually reach at runtime, including downstream data stores, admin consoles, and workflow triggers. Compare that view with the permissions shown in configuration management.
• Shorten credential lifetime and scope to task duration Issue short-lived credentials for agent sessions, enforce tight scopes, and revoke tokens as soon as the task completes. Do not allow standing grants to accumulate around recurring workflows.
• Monitor runtime behaviour for scope drift Send agent activity into SIEM and SOAR pipelines, then alert on unusual destination, volume, timing, or action patterns. Focus on detecting when an agent behaves outside the approved task boundary.

Key takeaways

• AI agents now behave like governed identities with runtime authority, which makes them an IAM and NHI problem as much as an AI problem.
• The evidence points to a material control gap between policy and practice, especially where long-lived tokens and excessive privileges expand blast radius.
• The priority for practitioners is runtime truth: inventory, map effective authority, shorten credential lifetime, and monitor behaviour continuously.

Key terms

• Effective Authority: Effective authority is the control an identity can actually exercise after all inheritance, delegation, and cross-system relationships are applied. It can be broader than the permissions listed in a single console, which is why local reviews often understate risk. Security teams need to measure effective authority, not only assigned access.
• Prompt Injection (Agentic): An attack where malicious instructions are embedded in content that an AI agent reads — causing the agent to execute unintended actions using its own legitimate credentials. A primary vector for agent goal hijacking and identity abuse.
• Runtime truth: Runtime truth is the evidence produced by observing what software actually does in production. It replaces guesswork with execution data, allowing security teams to judge whether a vulnerability is reachable, whether a dependency is active, and whether a control needs to block behavior now rather than later.
• Ephemeral Credential Trust Debt: Ephemeral credential trust debt is the hidden risk that appears when short-lived tokens create a false sense of safety while permissions remain broad. The credential expires quickly, but the underlying blast radius stays large unless identity scope, revocation, and audit controls are also tightened.

What's in the full article

Obsidian Security's full blog post covers the operational detail this post intentionally leaves for the source:

• Step-by-step guidance on securing AI agents with identity-first controls across SaaS and cloud systems
• Examples of token lifecycle management, including rotation intervals, scope limits, and secrets storage patterns
• Expanded discussion of runtime monitoring and behavioural analytics for detecting scope drift before exfiltration
• Framework mapping for ISO 42001, NIST AI RMF, MITRE ATLAS, and related governance requirements

👉 The full Obsidian Security post covers agent threats, identity controls, runtime monitoring, and compliance alignment in more implementation detail.

Deepen your knowledge

NHI governance, agentic AI identity, and machine identity security are core topics in our NHI Foundation Level course, the industry's only accredited NHI security programme. If you are building or maturing an IAM, PAM, or NHI programme, it is worth exploring.