AI agent security spans apps, endpoints, identities, and cloud

At a glance

What this is: This is an analysis of how AI agents widen the attack surface across applications, endpoints, identities, and cloud, with the key finding that prompt manipulation can rapidly become executed action.

Why it matters: It matters because IAM, PAM, and NHI programmes now need to govern agentic behaviour, borrowed credentials, and runtime access as part of the same control plane.

By the numbers:

• Only 44% of organisations have implemented any policies to manage their AI agents, despite 92% agreeing that governing AI agents is critical to enterprise security.
• Systems with least-privileged AI access had a 17% incident rate vs 76% for over-privileged systems.

👉 Read SentinelOne's analysis of AI agent security across endpoints, identities, and cloud

Context

AI agent security has moved beyond a narrow model-risk problem. When agents can read data, call tools, borrow credentials, and execute actions across browser, endpoint, identity, and cloud layers, the control gap is no longer about a single product category. It is about whether security teams can govern the full interaction-to-action chain before an agent turns a prompt into an operational change.

That creates a direct bridge into IAM, PAM, and NHI governance. Once an agent can hold credentials or act through a borrowed identity, it stops being just software that suggests work and becomes a runtime principal that needs scope, oversight, and revocation controls. The starting position described in the article is increasingly typical for enterprises adopting AI without redesigning access governance.

Key questions

Q: How should security teams govern AI agent tool calls without exposing credentials?

A: Security teams should place credentials in a separate execution layer, not in the model context, and bind every tool call to a distinct agent identity. The key controls are scoped consent, execution-time secret injection, and unified audit logging. That way the model can request actions without ever seeing the material that authorises them.

Q: Why do AI agents complicate existing IAM and PAM controls?

A: AI agents complicate IAM and PAM because they often inherit delegated credentials, operate across multiple systems, and keep acting after the initial approval moment has passed. Human session assumptions, periodic reviews, and static privilege models do not reflect that behaviour. The result is a governance gap between what was granted and what the agent can actually do.

Q: What breaks when AI prompts are changed without evaluation?

A: The system may appear to work in a demo while silently degrading in production. Prompt changes can alter retrieval behaviour, output tone, or decision quality in ways that are hard to spot without comparison runs and scored datasets, which makes regressions harder to detect and explain.

Q: Who is accountable when an AI agent accesses sensitive data it was not meant to use?

A: Accountability sits with the team that approved the agent, its connectors, and its policy boundaries, not with the runtime behaviour alone. Organisations need ownership for intent, permissions, monitoring, and validation so they can prove whether the agent stayed inside its approved purpose. Without that, audit and regulatory response become retrospective guesswork.

Technical breakdown

How agentic AI turns prompts into actions

Agentic AI differs from ordinary automation because it can decide which tools to use, in what order, and when to continue execution. In practice, the attack surface begins when a prompt, plugin, or copied instruction influences that decision path. Once the agent is connected to APIs, code runners, or MCP servers, a manipulated instruction can become a chain of tool calls rather than a harmless text response. That is why AI security cannot stop at content filtering. The relevant control point is the execution boundary, where tool use, data access, and side effects happen in the same runtime session.

Practical implication: map every AI workflow to its execution points, not just its chat interface, and require policy controls at the moment tool calls occur.

Why borrowed identities and static credentials are high risk in AI deployments

When an AI agent holds a secret, token, or session credential, it can inherit the same reach as the human or workload identity that issued it. The risk is amplified when access is standing rather than task-scoped, because the credential becomes reusable outside the original intent of the prompt. Static credentials are especially fragile in agentic environments because they are difficult to bind to a single action or time window. In identity terms, the problem is not only privilege level. It is also persistence, reuse, and the inability to tell whether the current action still matches the original authorisation intent.

Practical implication: treat agent-held credentials as high-risk secrets and replace standing access with tightly scoped, short-lived authorisation wherever possible.

What runtime detection changes for AI, endpoint, and cloud controls

Runtime detection matters because agents can behave correctly at startup and maliciously later in the same session. A prompt injection, malicious installer, or hijacked workflow can pivot from model interaction to shell execution, credential access, or cloud API abuse in seconds. Behavioural detection looks at what the process actually does, which is more useful than trusting what the process claims to be. For AI security teams, the architecture challenge is correlation: the same event chain should connect the agent, the host, the credential it touched, and the cloud resource it reached. Without that chain, investigations fragment into separate tools and delayed response.

Practical implication: correlate AI telemetry, endpoint behaviour, identity events, and cloud actions in one detection pipeline so containment can happen at runtime.

Threat narrative

Attacker objective: The attacker wants to convert a trusted AI interaction into privileged execution, then use the agent's access to steal data, deploy malware, or move into cloud and identity systems.

1. Entry begins when a user interacts with a malicious or manipulated AI prompt, tool integration, or installer that influences the agent's next action.
2. Escalation occurs when the agent is tricked into using borrowed credentials, calling approved APIs, or spawning host-level commands under legitimate-looking access.
3. Impact follows when the attacker uses that reach to exfiltrate secrets, alter cloud resources, or move laterally through connected systems.

Breaches seen in the wild

• McDonald's McHire AI Chatbot Default Credentials — Default credentials in McDonald's McHire AI recruitment chatbot expose 64 million job application records.
• Moltbook AI agent keys breach — Moltbook breach exposed 1.5M AI agent keys.

Read our 52 NHI Breaches Analysis report for a comprehensive view of breaches impacting Non-Human Identities including AI Agents.

NHI Mgmt Group analysis

AI agent security is now an identity governance problem, not just an application security problem. Once an agent can hold credentials, call tools, and act without a human approving every step, it behaves like a non-human identity with runtime privilege. That means IAM and PAM teams need to think in terms of scope, revocation, and task-bound access rather than just login and session control. The governance question is no longer whether the model is safe to query. It is whether the agent can be trusted as a principal in the environment.

Context-aware control is becoming the difference between signal and noise in AI security. Pattern-based controls are weak against non-deterministic systems because the same prompt can be benign or harmful depending on the surrounding context. A named concept here is interaction-to-action chain risk: the gap between a user-facing AI interaction and the downstream execution it can trigger. Practitioners should treat that chain as a single policy surface because the abuse point may appear in the prompt, the tool call, or the host command.

Standing privilege is the core failure mode in agentic deployments. The article makes clear that the dangerous part is not the existence of an agent, but the persistence of access it inherits or borrows. When credentials outlive the task, an attacker only needs one successful prompt injection or workflow compromise to turn a temporary interaction into a durable breach path. That is why zero standing privilege thinking now extends naturally into agent governance.

Endpoint, identity, and cloud telemetry need to be joined before AI security can be operationalised. A hijacked agent rarely stays in one layer. It starts in an app or prompt, manifests on a host, and often ends in identity or cloud abuse. Security teams that keep these domains separate will continue to see isolated alerts instead of one attack chain. The practical conclusion is to align runtime response, identity enforcement, and cloud containment around the same event graph.

Security architecture for AI will converge on policy and runtime enforcement, not advisory controls. The market is moving toward systems that can inventory AI actors, bound their reach, inspect tool use, and stop unsafe execution at the point of impact. That shift does not remove the need for governance. It raises the bar by making governance enforceable in the same session where the risk appears.

From our research:

• Systems with least-privileged AI access had a 17% incident rate vs 76% for over-privileged systems, according to The 2026 Infrastructure Identity Survey.
• Also from our research: 67% of organisations still rely heavily on static credentials despite the risks they pose to agentic AI deployments, according to The 2026 Infrastructure Identity Survey.
• Forward look: See OWASP NHI Top 10 for the control patterns practitioners should map to agentic runtime risk.

What this signals

Interaction-to-action chain risk: security teams should assume the most important control boundary is no longer the app front end but the execution point where an agent can invoke tools, touch secrets, or trigger infrastructure change. That makes policy evaluation at runtime more valuable than after-the-fact review, especially when the same agent can move from browser to endpoint to cloud in one session.

The operational signal for practitioners is whether AI telemetry, identity events, and endpoint behaviour are being correlated in one investigation path. If those signals remain split across teams, the organisation will keep treating agent abuse as a set of unrelated alerts rather than a single attack chain. For governance alignment, the NIST AI Risk Management Framework is the most relevant external anchor for accountability and measurement.

For practitioners

• Inventory every AI agent and MCP connection Build a live register of all agents, copilots, browser assistants, IDE extensions, and MCP servers that can reach enterprise systems. Include who owns them, what data they touch, and which identities or tokens they can use.
• Replace standing access with task-scoped controls Limit each agent to the minimum permissions required for a specific workflow and prefer short-lived credentials over reusable secrets. Review whether any agent can keep access after the task is complete.
• Correlate tool calls with identity and host activity Make tool invocation logs, endpoint telemetry, and identity events searchable in the same investigation path so a suspicious prompt can be traced to execution, credential use, and downstream impact without manual stitching.
• Add runtime kill switches for unsafe execution Define containment actions that can block a malicious tool call, revoke a token, or isolate a host at the moment an agent crosses policy. Pair those controls with clear escalation rules for SOC and IAM teams.

Key takeaways

• AI agents are not just another application layer. They can become non-human identities with borrowed access and runtime authority.
• The biggest control weakness is standing privilege. When access outlives the task, prompt manipulation can become execution very quickly.
• Security teams need one governance model for prompts, tool calls, identities, and endpoints if they want to contain agentic attacks in real time.

Key terms

• Agentic AI: Autonomous AI systems capable of planning, deciding, and taking actions — including calling APIs, writing code, and orchestrating other agents — with minimal human oversight. Agentic AI introduces new NHI risks as agents must authenticate to external services.
• Non-Human Identity (NHI): A digital identity assigned to a non-human entity such as a software application, service account, API key, bot, machine, or AI agent that enables it to authenticate and interact with systems without direct human involvement. NHIs now outnumber human identities in most enterprises by 25 to 50 times.
• Interaction-to-Action Chain: The path from a user-facing AI interaction to a real system action such as an API call, shell command, or cloud change. The security challenge is that a single prompt can influence multiple steps, so control must exist at the point where the agent executes, not only where the text is entered.
• Standing Privilege: Standing privilege is access that remains active even when no immediate task requires it. For NHI programmes, it is a common failure mode because long-lived credentials and persistent roles create unnecessary exposure. Reducing standing privilege usually means tighter expiry, on-demand access, and clearer review of who or what still needs access.

What's in the full article

SentinelOne's full article covers the operational detail this post intentionally leaves for the source:

• How its platform maps agent activity across apps, endpoints, identities, and cloud workloads in a single telemetry flow.
• The specific runtime enforcement and kill-switch behaviours it describes for blocking unsafe tool calls and revoking access.
• Examples of endpoint detections it cites, including AI-linked malware and supply chain abuse scenarios.
• The vendor's explanation of how its AI telemetry is correlated with existing endpoint data for investigation and response.

👉 SentinelOne's full post covers the runtime response model, identity enforcement, and AI telemetry correlation details.

Deepen your knowledge

NHI Foundation Level course, the industry's only accredited NHI security programme, covers NHI governance, machine identity security, secrets management, and agentic AI identity. It is designed for practitioners who need to connect identity controls to broader security operations.