AI agent security tools miss the toxic combination at runtime

At a glance

What this is: The article argues that the core AI agent security problem is not behavioral monitoring but the toxic combination of excessive permissions and unauthorized reachability.

Why it matters: For IAM, IGA, PAM, and AI governance teams, this matters because agent security fails when entitlement scope and invocation pathways are managed separately instead of as one runtime control problem.

By the numbers:

• Obsidian research shows agents receive 10x more access than their workflows require, and nearly 2 in 5 carry medium, high, or critical risk factors from the moment they deploy.
• 92% agree governing AI agents is critical to enterprise security, yet only 44% have implemented any policies to do so.

👉 Read Obsidian Security's analysis of why AI agent security tools miss runtime risk

Context

AI agent security is the discipline of governing what an agent can reach, who can invoke it, and when an action should be blocked before execution completes. The article's central claim is that current tools focus on post-event visibility, while the actual risk is created when over-privileged agents are reachable by unauthorized users or workloads.

That is an IAM and NHI governance problem as much as an AI problem. When an agent runs through OAuth tokens and service accounts inside third-party applications, traditional controls often lose both attribution and decision-time enforcement, which leaves security teams unable to prove whether access was appropriate or to stop misuse at the point of action.

The article's starting position is typical for modern enterprise environments: agents are spreading faster than governance models built for static identities, and the gap is now architectural rather than procedural.

Key questions

Q: What breaks when AI agent security tools only monitor behavior?

A: Behavior-only tools miss the moment when an agent becomes dangerous through valid credentials and excessive reach. By the time the action looks suspicious, the agent may already have acted inside a trusted application. The control gap is not visibility alone. It is the absence of runtime enforcement tied to entitlement scope and invoker authority.

Q: Why do AI agents complicate traditional IAM and PAM controls?

A: AI agents complicate IAM and PAM because they can make decisions, chain tools, and act faster than human review cycles can respond. They also blur the line between authentication and authorization, since the same identity may trigger multiple actions after a single approval. That means organizations need policy, telemetry, and revocation designed for autonomous behavior, not just human login events.

Q: How should organisations govern embedded AI features inside SaaS apps?

A: Treat embedded AI as a runtime governance problem, not just a procurement issue. Require visibility into feature activation, tie each capability to data classification rules, and re-review the app when a vendor adds new AI processing. If the feature can change what leaves the application, it needs continuous control.

Q: Who is accountable when an AI agent accesses sensitive data it was not meant to use?

A: Accountability sits with the team that approved the agent, its connectors, and its policy boundaries, not with the runtime behaviour alone. Organisations need ownership for intent, permissions, monitoring, and validation so they can prove whether the agent stayed inside its approved purpose. Without that, audit and regulatory response become retrospective guesswork.

Technical breakdown

Why agent behavior monitoring misses the real control point

Most AI security tools focus on prompts, tool calls, and anomalous behavior, but that only works after the agent has already acted. The more important question is whether the agent's effective privileges and invocation paths create a toxic combination before execution. Because agents often authenticate through OAuth tokens and service accounts, the decisive security signal sits in entitlement scope inside connected applications, not in endpoint telemetry or a prompt log. If the agent is legitimately authenticated but over-reachable, the dangerous act can look normal until the moment of impact.

Practical implication: security teams need runtime enforcement tied to entitlement context, not just post-event alerts or agent activity logs.

How third-party applications hide AI agent risk

Agents rarely live only in an agent platform. They execute inside SaaS and cloud applications where the service account inherits broad application permissions, while the IdP, EDR, and network stack may see little or nothing meaningful. This creates a layered visibility problem: the identity system sees a token, the endpoint sees a process, and the application sees a legitimate action, but no single control can determine whether the agent should have been allowed to reach that data in the first place. That is why application-level entitlement mapping is central to AI agent governance.

Practical implication: map each agent credential to the specific records, datasets, and actions it can reach inside every connected application.

What runtime enforcement changes in AI agent governance

Runtime enforcement matters because it is the only control point that can still interrupt an action before it completes. Detection can identify a risky configuration, but it cannot prevent a legitimate agent from using valid credentials to move into the wrong system or data set. A toxic combination is therefore not just an inventory issue. It is a moment-of-execution control problem that requires persistent inventory, cross-platform entitlement visibility, and the ability to block an invocation when both over-privilege and unauthorized reachability are present.

Practical implication: require controls that can block at execution, not tools that only raise an alert after the action has already occurred.

Threat narrative

Attacker objective: The objective is to use a legitimately authenticated agent path to access or move sensitive data through trusted enterprise applications without triggering normal security controls.

1. Entry occurs when an attacker or misconfiguration reaches an agent through legitimate OAuth-based access or other trusted credentials.
2. Escalation occurs when the agent's service account and connected application entitlements let the action proceed with more privilege than the workflow needs.
3. Impact occurs when the agent completes the sensitive action inside third-party systems before any post-event monitoring can intervene.

Breaches seen in the wild

• Meta AI Instagram Account Takeover — 20,225 Instagram accounts hijacked via compromised Meta AI support chatbot with overprivileged access.
• Replit AI Tool Database Deletion — Replit vibe coding AI assistant deletes live production database and creates 4,000 fake user records.

Read our 52 NHI Breaches Analysis report for a comprehensive view of breaches impacting Non-Human Identities including AI Agents.

NHI Mgmt Group analysis

Toxic combination is the right name for the AI agent governance gap: the real risk appears when over-privileged agent access and unauthorized reachability exist at the same time. That is not a behavioral anomaly problem alone and not a pure identity problem alone. It is a control synthesis problem that sits between entitlement scope and invocation authority. Practitioners should treat those two conditions as a single governance test, not separate workstreams.

Behavioral monitoring is structurally late: tools that watch prompts, tool calls, or suspicious actions are only useful after the agent has already crossed the decision point. The article is right to call out that the market is looking in the wrong place. What matters is whether the enterprise can evaluate access before execution, because many agent actions will look legitimate all the way through completion. Security teams should stop treating detection as equivalent to prevention.

Application-level entitlement mapping is now a core identity control: agent risk cannot be judged from the agent layer alone because the actual permissions live inside SaaS and cloud applications. That is an NHI governance assumption failure, not just a tooling gap. The premise that identity can be secured at the perimeter breaks down when the credential is embedded in the application itself. Practitioners need to govern the reachable action set, not merely the agent object.

Runtime enforcement must become part of AI agent policy design: the market's current emphasis on inventory and alerts is not enough when the wrong action can complete in the same execution window it is discovered. This is where IAM, PAM, and NHI governance converge. The control model has to decide before execution whether the agent's current scope, invoker, and data reach create unacceptable exposure. Teams that ignore this will continue to certify risk after the fact.

Identity blast radius is the concept practitioners should adopt next: once an agent credential can move across multiple connected systems, the blast radius is defined by application reach, not by where the agent is hosted. That changes how teams think about least privilege, segregation of duties, and access review. The practical conclusion is that agent governance must be measured by what can be touched, not by what the agent claims it will do.

From our research:

• 92% agree governing AI agents is critical to enterprise security, yet only 44% have implemented any policies to do so, according to AI Agents: The New Attack Surface.
• Only 52% of companies can track and audit the data their AI agents access, leaving 48% with a complete blind spot for compliance and breach investigation.
• The OWASP Agentic Applications Top 10 provides the next step for translating these risk patterns into control requirements.

What this signals

Identity blast radius: AI agent governance now has to be measured by the breadth of reachable actions inside connected applications, not by whether the agent appears well-behaved. That makes entitlement mapping and execution-time control part of the identity stack, not a separate security project.

With 80% of current AI agent deployments already showing actions beyond intended scope in the SailPoint research, the governance gap is now operational. Teams that wait for perfect agent inventories will keep certifying access after exposure has already happened.

Practitioners should align agent governance with runtime control models such as the NIST AI Risk Management Framework and the OWASP Top 10 for Agentic Applications 2026, because the decision point is inside execution, not after it.

For practitioners

• Implement cross-application entitlement mapping Build a live inventory of every agent credential, then map the specific records, datasets, and actions each credential can reach inside connected SaaS and cloud applications. Without that visibility, toxic combinations remain invisible until after execution.
• Separate invocation authority from execution privilege Review who can trigger each agent and compare that list against the data and action scope available to the agent's service account. The goal is to eliminate cases where a low-trust invoker can steer a high-privilege workflow.
• Require moment-of-execution enforcement Prioritise controls that can block a risky action before completion, not tools that only log or alert after the fact. If the control cannot interrupt execution in the application itself, it cannot stop a toxic combination.
• Reclassify agent risk by reachable action set Treat an agent as high risk when its reachable action set inside a business application is broader than its workflow requires, even if it behaves normally. That shifts review from behaviour monitoring to entitlement governance.

Key takeaways

• The article's core warning is that AI agent risk lives in the combination of over-privilege and unauthorized reachability, not in anomalous behavior alone.
• The evidence points to a governance blind spot, with agents often carrying more access than their workflows require and many deployments already showing out-of-scope actions.
• The practical answer is runtime enforcement linked to entitlement context inside connected applications, because post-event monitoring cannot stop a completed action.

Key terms

• Toxic Access Combination: A toxic access combination is a set of permissions that becomes dangerous when granted together, even if each entitlement looks acceptable on its own. In identity governance, these combinations matter because they can enable misuse, separation-of-duties failures, or broader compromise.
• Runtime Enforcement: Runtime enforcement is the practice of blocking malicious behaviour while software is running, rather than only detecting it after the fact. It monitors process activity, network actions, and privilege changes so a live attack can be interrupted at the point of execution.
• Identity Blast Radius: The amount of damage a compromised identity can cause across systems, data, and infrastructure. In NHI environments, it is shaped by permissions, network reach, and administrative capability rather than by the credential alone. Reducing blast radius is a containment strategy that limits lateral movement and data exposure.
• Reachable Action Space: Reachable action space is the set of systems, data, and workflows an actor can actually touch at runtime. For AI agents, this matters more than role labels because the real risk is not the title assigned to the identity but the actions the system can chain or trigger once it is running.

What's in the full article

Obsidian Security's full post covers the operational detail this post intentionally leaves for the source:

• The vendor's application-by-application explanation of how toxic combinations are detected across Salesforce, ServiceNow, Workday, Slack, and other connected systems.
• Detailed questions security teams can use to evaluate whether a tool can block execution rather than only alert after the event.
• The article's view of why agent inventory alone is insufficient without entitlement mapping inside third-party applications.
• The vendor's framing of runtime enforcement as the control point that matters when an agent is invoked.

👉 Obsidian Security's full post explains the toxic combination model, the runtime enforcement gap, and the evaluation questions to ask vendors.

Deepen your knowledge

NHI governance, agentic AI identity, and machine identity security are core topics in our NHI Foundation Level course, the industry's only accredited NHI security programme. If you are building or maturing identity security strategy, it is worth exploring.