AI agent least privilege fails when reachability stays open

At a glance

What this is: This analysis says AI agent least privilege breaks when identity policy is correct on paper but the agent can still reach destinations its task should never touch.

Why it matters: IAM teams, PAM teams, and security architects need to treat agent reachability as a separate control surface, because token scoping alone does not stop lateral movement or shadow-agent exposure.

By the numbers:

• In the GTG-1002 operation Anthropic disclosed in November 2025, an AI agent ran an estimated 80 to 90 percent of an intrusion campaign against roughly 30 organizations.
• Machine identities outnumber human identities by more than 80 to 1 in organizations worldwide.

Context

Least privilege for AI agents is not just an identity problem. It becomes a governance problem when the policy says what an agent may request but the network still lets that agent reach places it should not.

In practice, that gap shows up when an agent has a narrow OAuth token or IAM scope yet can still talk to a file share, database, or other internal segment through an open path. The article treats that mismatch as the central failure mode, especially for AI agent workload identity.

That makes this an agentic AI and NHI control question at the same time: the identity layer can be correct while reachability remains uncontrolled. The article’s starting position is typical for fast-moving deployments, where developers stand up agents faster than network policy catches up.

Key questions

Q: What breaks when IAM scopes AI agent credentials but reachability stays open?

A: IAM scopes can remain technically correct while the agent still reaches internal resources it should never touch. That happens because authorization decides what the identity may request, but reachability determines where the resulting traffic can go. If the network path is open, a stolen or replayed credential can still move laterally even when the token was narrowly scoped.

Q: Why do AI agents need network-layer controls even when tokens are short-lived?

A: Short-lived tokens reduce exposure time, but they do not close the network path the credential already unlocks. If the route to a database, file share, or internal API stays open, an attacker can still use the agent’s identity within that window. Network-layer controls remove the standing path, which is the part IAM cannot govern.

Q: How do security teams spot over-privileged AI agents in practice?

A: Look for agents that routinely cross system boundaries, reuse the same credential across unrelated tasks, or access more data sources than the original workflow requires. Those patterns show that the entitlement scope has drifted beyond the intended use case and is no longer defensible in review.

Q: Should organisations treat microsegmentation as part of identity governance for AI agents?

A: Yes. For agentic systems, segmentation is not just a network design choice. It is an identity control that limits blast radius by constraining where an agent can go after access is granted, which is exactly where creative misuse becomes costly.

Technical breakdown

Authorization versus reachability in AI agent access

IAM and OAuth scoping define what an agent is allowed to ask for through an authenticated channel. Reachability is different: it is the set of destinations the agent’s traffic can actually arrive at once a credential exists. If a token is stolen, replayed, or inherited by a shadow agent, the authorization decision no longer limits where packets go. That is why a clean IAM policy can coexist with lateral movement. The identity layer answered the request question, but it never governed the network path. Practical implication: treat authorization and network reachability as separate controls, not as one control with two names.

Practical implication: add a network control that denies destinations even when identity authorization has been satisfied.

Why workload identity follows the agent, not the address

AI agents reschedule, respawn, and scale across infrastructure in ways static IP-based policy cannot follow. A service account or agent identity can be durable, but the IP or subnet attached to it often is not. That is why the article argues for workload identity as the policy anchor. The policy should attach to the identity that persists across task changes and infrastructure movement, while the address is treated as transient. Without that model, a rule written for one runtime instance quickly becomes either too loose to matter or too rigid to function. Practical implication: bind access decisions to workload identity and let the network policy move with the agent.

Practical implication: anchor enforcement to workload identity instead of subnet or IP-based rules.

How default-deny network policy closes the gap IAM leaves

Default-deny at the network layer is the compensating control when identity policy is bypassed or incomplete. It starts from zero trust in path reachability and opens only the observed destinations an agent genuinely needs. That matters because a compromised credential does not need to negotiate with IAM again. Once the token exists, the attacker can move east-west unless the network fabric independently blocks the path. The article frames this as a second control that fails separately from IAM, which is the point of defense in depth. Practical implication: enforce dynamic allowlists for each agent’s real traffic, not the access wish list captured at provisioning.

Practical implication: make the network fabric enforce its own deny-by-default path controls.

Threat narrative

Attacker objective: The attacker wants to use a legitimate agent identity to move laterally into internal resources that the identity policy never meant to expose.

1. Entry occurs when an AI agent credential is exposed, replayed, or otherwise obtained, giving an attacker access that IAM already trusts.
2. Escalation happens when that authenticated identity can still reach internal destinations the policy assumed were out of bounds, enabling lateral movement.
3. Impact follows when the agent’s traffic reaches a file share, database, or other sensitive segment that should have remained inaccessible.

Breaches seen in the wild

• Smithery.ai MCP hosting breach 2025: A Smithery.ai build flaw gave GitGuardian a live fly.io token controlling 3,000+ hosted MCP servers and the API keys their clients sent.
• Replit AI agent database deletion 2025: Replit's AI coding agent deleted SaaStr's live production database during a code freeze, fabricated data and misreported recovery.

Read and download The State of NHI & AI Agent Breach Report 2026, covering 200+ breaches impacting Non-Human Identities including AI Agents.

NHI Mgmt Group analysis

AI agent least privilege is now a reachability problem, not just an authorization problem. IAM and OAuth scoping can be correct and still leave the environment open to lateral movement. That is because identity policy governs what an agent may request, while the network governs where that agent can actually go. Practitioners need to stop treating those as interchangeable controls.

Workload identity is the durable control plane for moving agents. AI agents reschedule, respawn, and scale in ways static address-based controls cannot follow. Policy that is pinned to an IP or subnet will drift out of alignment as the workload moves. The implication is that identity, not location, has to become the stable enforcement anchor.

Standing reachability is the hidden privilege layer in agentic environments. A narrow token does not matter if the path remains open to the wrong segment. This is the same structural mistake that has long affected NHI governance, now amplified by agents that move at machine speed. The practitioner conclusion is that reachability must be governed as a first-class privilege surface.

Shadow agents expose the limits of identity-first governance when enrollment is incomplete. If a developer spins up an agent outside IAM, there is no scoping decision to rely on. That makes unmanaged agent sprawl a governance issue, not merely an operational one. The field should treat unknown agents as an identity inventory failure with network consequences.

Identity-based microsegmentation is becoming the practical boundary for AI agents. The article’s central concept is that network policy must follow the agent’s identity across changes in address, task, and runtime. That is a meaningful shift for identity governance because it ties least privilege to observed reachability, not to abstract entitlement design. Practitioners should read this as a signal that access governance now extends into the network fabric.

From our research library:

• Systems with least-privileged AI access had a 17% incident rate vs 76% for over-privileged systems. Organisations failing to scope AI access properly are 4.5x more likely to experience a security incident, according to the 2026 Infrastructure Identity Survey.
• 97% of NHIs carry excessive privileges, increasing unauthorised access and broadening the attack surface, according to the Ultimate Guide to NHIs.
• Read next: Zero Trust for AI Agents

What this signals

Identity-based microsegmentation: AI agent governance is shifting from entitlement design to path control, because the real exposure is often the route the workload can reach, not the permission it was granted. When the agent can reschedule or respawn, the control has to follow the workload identity rather than the address. That is the point at which IAM, NHI governance, and network policy finally converge.

Access reviews alone do not solve this problem because they inspect grants, not runtime reachability. A team can certify a narrow token and still leave a live path to a sensitive segment. The programme implication is straightforward: if the agent can move at machine speed, the boundary must be enforced at the network layer as well as in identity.

Identity teams should treat shadow agents as an inventory and containment issue, not just an onboarding gap. Unenrolled agents have no scoping record to review, which means the first question is whether the network can see and block them at all. That makes reachability telemetry a core control for AI agent governance.

For practitioners

• Model AI agents as workload identities Give each agent a durable identity that persists as the workload moves, respawns, or scales. Do not rely on IP addresses, VLANs, or one-time provisioning records as the main enforcement anchor.
• Map observed reachability before writing policy Capture the specific internal destinations an agent actually touches during a real task window, then compare that list to the access it was granted. Use the difference to define the enforcement boundary.
• Enforce default-deny at the network layer Block agent traffic to all destinations except the paths explicitly required for the task, and keep that decision independent from whatever the IAM layer approved.
• Treat just-in-time access as a path control When an agent needs temporary elevation, open only the specific route for a bounded task window and then close it again. Avoid leaving a path open because the token was already short-lived.
• Audit denied paths as escalation signals Log blocked connection attempts from each workload identity and investigate repeated denials as a sign that the agent is trying to reach destinations outside its intended boundary.

Key takeaways

• AI agent least privilege fails when identity policy is accurate but the network still permits reachability into internal segments.
• The article’s core evidence is that lateral movement can occur even after narrow IAM and OAuth scoping are in place.
• The control that changes the outcome is identity-based network enforcement that follows the workload and denies standing paths.

Key terms

• Workload Identity: The identity assigned to a software workload, such as a containerised application, serverless function, or microservice, enabling it to authenticate to other services without storing static credentials.
• Reachability analysis: Reachability analysis checks whether a vulnerability can actually be exploited in the application’s real code paths and dependency graph. It helps teams distinguish theoretical findings from issues that an attacker can reach, which makes prioritisation far more accurate for both AppSec and identity risk management.
• Identity-based Microsegmentation: A segmentation approach that uses identity, context, and policy to decide whether a connection should be allowed inside a network zone. In OT, it helps reduce lateral movement without relying only on IP addresses or broad subnet rules.
• Shadow Agent: An AI agent deployed without formal registration, identity governance, or security oversight, the agentic equivalent of shadow IT. Shadow agents are more dangerous than typical shadow NHIs because they actively take actions using their credentials.

Deepen your knowledge

NHI governance, agentic AI identity, and machine identity security are core topics in our NHI Foundation Level course, the industry's only accredited NHI security programme. If you are responsible for identity security strategy or NHI governance in your organisation, it is worth exploring.