AI agent sprawl is exposing toxic access combinations in apps

At a glance

What this is: This is an analysis of how AI agent sprawl is creating hidden access drift, toxic privilege combinations and audit blind spots across business apps.

Why it matters: It matters because IAM, governance and security teams need to understand how agent-owned access differs from human access, especially when permissions, data movement and accountability no longer line up cleanly.

By the numbers:

• AI agent activity grew 300x in 2025.
• Nearly 40% of agents carry medium-to-critical risk factors.
• The average environment contains over 800 risky agents.
• Agents receive 10× more access than they actually require.

Context

AI agent sprawl is not just a deployment issue. It is an access governance problem in which agents are granted permissions across business applications faster than ownership, review and revocation processes can keep up. The result is hidden privilege growth inside systems that were designed around human users and human review cycles.

The core failure is that these agents sit between identity, entitlement and data movement controls without a reliable system of record. When access is assembled through ad hoc integrations and shared credentials, the security programme loses the ability to explain who owns the access, why it exists, or how much data it can move. That is the governance gap this article exposes.

For IAM and NHI teams, the question is no longer whether agents exist. The question is whether the organisation can govern their lifecycle, scope and audit trail with the same discipline it expects for service accounts, privileged users and other non-human identities.

Key questions

Q: What breaks when AI agents are given broad enterprise access without tight governance?

A: Broad access turns AI agents into high-speed execution paths that can move data, spend money, modify records, or delete assets before operators can intervene. The failure is not only misuse by an attacker. The system itself can exceed intended scope during normal task completion, so the real control problem is bounding authority before runtime action begins.

Q: Why do AI agents create risk even when they stay within approved permissions?

A: AI agents can be authorised correctly and still produce harmful outcomes because permission is not the same as intent or behavioural appropriateness. If an attacker manipulates the session mid-flight, the agent may keep acting inside scope while exfiltrating data, taking destructive steps, or chaining actions that no human would have approved.

Q: How can security teams tell whether agent access is actually under control?

A: Look for evidence that the team can trace every tool call, secret use, and cross-system action back to a named owner and a valid approval path. If an agent can reach messaging, browser, and infrastructure tools without a revocation chain, access is not truly governed. Control exists only when the runtime can be stopped as fast as it can act.

Q: Who is accountable when an AI agent keeps running after its creator leaves?

A: The accountable owner must be the organisation, not the departed employee. If the agent’s credential was tied only to a personal account, offboarding the user does not guarantee the token is revoked. That is a governance failure in lifecycle design, because ownership and revocation should follow the agent itself, not just the human who created it.

Technical breakdown

How toxic access combinations emerge in AI agent sprawl

A toxic access combination forms when individually acceptable permissions stack into a higher-risk capability than any single grant suggests. In this article’s examples, an agent may have read access to broad content, write access to downstream systems, and visibility to shared links or inherited credentials. None of those grants is automatically anomalous on its own. The problem appears when the agent can combine them across applications, making the effective privilege set larger than the original business intent. That is why point-in-time access reviews miss the risk: they inspect entitlements in isolation, not emergent behaviour across the application layer.

Practical implication: Map agent permissions as combined pathways, not isolated grants, and review the resulting end-to-end data movement path.

Why chained workflows hide agent behaviour from traditional visibility

Chained workflows break the assumption that one actor equals one action trail. In the planning-to-coding-to-deployment example, each agent behaves as expected, but the chain as a whole executes a malicious instruction without human review. Traditional visibility tools struggle here because they are tuned to observe events, not delegated intent carried across multiple automation handoffs. The control failure is not just missing logging. It is the absence of a way to correlate who initiated the first step, which intermediate agent accepted it, and how that decision propagated through subsequent systems.

Practical implication: Correlate agent-to-agent handoffs as a single governance path so delegated actions can be traced end to end.

Why ownership and auditability collapse when agents outlive their creators

An agent connected through a personal OAuth token can survive the user who created it, even after the user’s SSO account is deactivated. That creates a lifecycle mismatch between the human owner and the non-human access grant. The token may still be valid, yet no one can easily tie it back to a current accountable owner or a live access review. In governance terms, the agent becomes an orphaned non-human identity with active privileges, which is especially dangerous because the access looks legitimate even while the accountability chain has broken.

Practical implication: Tie every agent credential to lifecycle ownership and offboarding so access cannot outlive the accountable user or team.

Threat narrative

Attacker objective: The attacker aims to turn legitimate agent workflows into a scalable path for data exfiltration, privilege abuse or operational disruption without triggering normal human review.

1. Entry occurs when employees connect personal or team-built agents to enterprise apps using broad credentials, shared links or delegated OAuth access.
2. Privilege escalation follows as separate permissions accumulate across apps, allowing the agent to see or move more data than any single user should control.
3. Lateral movement happens through chained workflows that pass instructions and outputs across planning, coding and deployment agents without human review.
4. Impact appears when the combined agent path enables unauthorized data exposure, mass file movement, or uncontrolled administrative action at machine speed.

Breaches seen in the wild

• CoPhish OAuth phishing via Copilot Studio: Datadog showed Copilot Studio agents on a Microsoft domain can front OAuth consent phishing and forward stolen tokens; no victims reported.
• Langflow Flodrix botnet 2025: Attackers used Langflow's unauthenticated code endpoint to dump AI servers' environment variables and enlist them in the Flodrix botnet.

Read and download The State of NHI & AI Agent Breach Report 2026, covering 200+ breaches impacting Non-Human Identities including AI Agents.

NHI Mgmt Group analysis

Agent sprawl is becoming an access governance problem before it becomes an AI governance problem. The article shows that the immediate risk is not model reasoning or prompt quality, but unmanaged entitlement growth across SaaS and business apps. When agents are allowed to inherit broad access without ownership discipline, the identity layer becomes the weakest point in the AI stack. Practitioners should treat every new agent as a governed identity, not a feature toggle.

Toxic access combinations are a new form of identity blast radius. A single permission may look reasonable, but the combination of read scope, write scope, shared distribution and chained workflows creates a larger effective attack surface. That means the relevant unit of analysis is not the agent account alone, but the cross-application path it can activate. Security teams need to think in terms of compound privilege, not isolated entitlements.

Human-paced access controls cannot keep up with machine-speed delegation. Access review cadences assume a stable identity, a stable purpose and enough time for review before meaningful damage occurs. AI agents break that assumption because they can be created, shared, linked and overextended far faster than periodic certification cycles can react. The implication is not merely more review, but a rethink of where authorization evidence is collected and how soon it must be enforced.

Ownerless agent access is a lifecycle failure, not a monitoring gap. The article’s orphaned-token scenario shows that deprovisioning the human account does not necessarily revoke the non-human credential. That exposes a broken premise in lifecycle governance: the system assumes offboarding the person also ends the access. In practice, practitioners must govern the agent as the durable identity object and the user as only one part of its accountability chain.

Application-layer context is now decisive for NHI governance. The article makes clear that SIEM, CASB and perimeter controls can miss how agent permissions stack into harmful combinations inside applications. That shifts the centre of gravity toward entitlement context, behavioural correlation and lifecycle ownership. The organisations that will govern agents well are the ones that can explain what the agent can do, what it actually did and who still owns that access.

From our research library:

• 53% of security leaders expect AI to run major portions of their infrastructure autonomously within the next three years, according to the 2026 Infrastructure Identity Survey.
• 19% of organisations give AI systems dramatically more access than human employees, nearly one in five granting unrestricted privilege, according to the 2026 Infrastructure Identity Survey.
• Read next: Agentic AI Identity Guide

What this signals

Identity blast radius is now an application-layer problem: agents do not need to be malicious to create material exposure. When permissions, sharing settings and chained workflows combine, the effective access path can outrun the controls designed for human users and leave security teams reacting after the fact.

Governance programmes should shift from reviewing isolated entitlements to proving that agent ownership, credential scope and data movement are still aligned. If the organisation cannot explain those three things together, it does not yet have control over the agent estate.

For practitioners

• Inventory all active AI agents Build a current register of agents, their owners, connected apps and credential types so no workflow is invisible to security or IAM teams.
• Review agent permissions as combined pathways Assess whether read, write and sharing privileges create compound access that exceeds the business purpose of the agent.
• Bind agent credentials to lifecycle ownership Require a named accountable owner, a revocation path and an offboarding event for every agent credential, including OAuth tokens and linked integrations.
• Trace chained workflows end to end Correlate planning, execution and deployment handoffs so delegated actions can be reconstructed when an agent moves data or changes state.

Key takeaways

• The article’s core warning is that AI agent sprawl turns ordinary permissions into compound access paths that widen blast radius across business apps.
• Obsidian Security says AI agent activity grew 300x in 2025, nearly 40% of agents carry medium-to-critical risk, and the average environment contains over 800 risky agents.
• The control problem is lifecycle and context, not just visibility: teams need ownership, revocation and end-to-end tracing for every agent.

Key terms

• Toxic Access Combination: A toxic access combination is a set of permissions that becomes dangerous when granted together, even if each entitlement looks acceptable on its own. In identity governance, these combinations matter because they can enable misuse, separation-of-duties failures, or broader compromise.
• Agent ownership: The assignment of accountable business and technical responsibility for an AI agent or automated workflow. Ownership should include approval authority, review cadence, and a clear connection to the identity that the agent uses, so that access and liability do not disappear when the workflow scales.
• Identity Blast Radius: The amount of damage a compromised identity can cause across systems, data, and infrastructure. In NHI environments, it is shaped by permissions, network reach, and administrative capability rather than by the credential alone. Reducing blast radius is a containment strategy that limits lateral movement and data exposure.
• Chained workflow: A chained workflow is a sequence where one automated or agentic action triggers another, expanding the blast radius beyond the original request. In agent governance, chained workflows are high risk because a single decision can propagate across multiple systems without fresh human review.

Deepen your knowledge

NHI governance, agentic AI identity, and machine identity lifecycle are core topics in our NHI Foundation Level course, the industry's only accredited NHI security programme. If you are building or maturing an IAM programme, it is worth exploring.