AI agents are becoming an execution surface for production risk

At a glance

What this is: The source argues that AI agents are no longer just interfaces to secure, but execution surfaces that need runtime controls for instruction manipulation, tool misuse, resource exhaustion, and reconnaissance.

Why it matters: This matters to IAM and security teams because agent behaviour now affects access, action, and privilege decisions in production systems, creating governance gaps that traditional control models do not fully cover.

By the numbers:

• 80% of organisations report their AI agents have already performed actions beyond their intended scope, including accessing unauthorised systems (39%), inappropriately sharing sensitive data (31%), and revealing access credentials (23%).
• 92% agree governing AI agents is critical to enterprise security, yet only 44% have implemented any policies to do so.
• 98% of companies plan to deploy even more AI agents within the next 12 months, despite documented rogue behaviour in 80% of current deployments.

👉 Read Straiker's analysis of production-grade controls for AI agent security

Context

AI agent security is becoming a production governance problem, not a lab problem. Once agents can browse, call tools, retrieve enterprise context, and execute workflows, the control question changes from what the model can say to what the system can do in live environments.

That shift creates an identity and access dimension because agents inherit permissions, interact with connectors, and can be steered into actions that exceed intended scope. For IAM, PAM, and NHI programmes, the issue is not only visibility into the model, but control over the privileges and action paths attached to the agent.

Straiker’s article reflects a common enterprise starting position: agents are being embedded by default, while runtime guardrails are still catching up.

Key questions

Q: What breaks when AI agents are managed like ordinary machine identities?

A: What breaks is the assumption that access scope can be fully understood from provisioning data and quarterly review. Ordinary machine identities are repeatable; agents are not. If teams only review entitlements, they miss context shifts, delegated actions, and credential creation inside the session.

Q: Why do AI agents complicate existing IAM and PAM controls?

A: AI agents complicate IAM and PAM because they often inherit delegated credentials, operate across multiple systems, and keep acting after the initial approval moment has passed. Human session assumptions, periodic reviews, and static privilege models do not reflect that behaviour. The result is a governance gap between what was granted and what the agent can actually do.

Q: How do security teams know whether agent guardrails are working?

A: They know guardrails are working when denied tool calls are visible in logs, high-risk paths are blocked consistently, and the agent cannot override policy from inside its own session. Observe mode is useful first because it shows what the agent actually tries to do before the team decides where to deny access. The signal is repeatable enforcement, not model compliance.

Q: Who is accountable when an AI agent takes an unsafe action?

A: Accountability should sit with the business owner of the agent, the team that provisioned the access, and the control owners responsible for monitoring and revocation. If no one can answer who approved the identity, the scope, and the oversight model, the governance framework is not complete enough for production.

Technical breakdown

Instruction manipulation in agentic workflows

Instruction manipulation occurs when untrusted content changes what an agent believes it should do. In practice this can happen through direct prompt injection, indirect prompt injection inside documents or web pages, or malicious tool output that overrides the original task. The risk is higher than classic prompt attacks because the agent may chain the injected instruction into downstream tool calls, retrieval steps, or workflow actions. Once the instruction is accepted as context, the compromise is no longer just textual. It becomes behavioural, because the agent acts on the manipulated instruction with its own assigned permissions.

Practical implication: teams need runtime detection for instruction override attempts before the agent reaches a tool or connector action.

Tool misuse and privilege abuse

Tool misuse happens when an agent uses an allowed capability in a way that violates policy intent. This is not the same as broken authentication. The tool may be legitimate, but the combination of user request, hidden context, and agent autonomy turns permitted access into unsafe execution. In IAM terms, the problem looks like excessive effective privilege, especially when connectors and service permissions are broader than the task requires. For NHI governance, the agent should be treated as a non-human identity with scoped, auditable access, not as a passive application component.

Practical implication: align every agent connector to least-privilege scopes and log tool invocation intent alongside the resulting action.

Reconnaissance and resource exhaustion as pre-attack signals

Agentic attacks often begin with low-noise probing. Reconnaissance asks about system details, connector behaviour, or access boundaries to prepare a larger exploit chain. Resource exhaustion is a separate but related abuse pattern, where the attacker drives the agent into excessive CPU, token, network, or quota consumption. Both behaviours matter because they precede higher-impact misuse and can hide inside otherwise normal interaction patterns. In production, these signals are valuable because they reveal an attack path before data theft or unsafe action occurs. They also show why simple input filtering is insufficient for agent security.

Practical implication: monitor agent telemetry for probing, quota spikes, and unusual connector discovery before those signals become incident response work.

Threat narrative

Attacker objective: The attacker aims to turn a trusted AI agent into a controllable execution path that performs actions, exposes data, or enables follow-on compromise inside enterprise systems.

1. Entry begins when an attacker or untrusted content reaches the agent through web pages, documents, tickets, or tool outputs and plants hidden instructions.
2. Escalation occurs when the agent accepts the manipulated context and uses its allowed tools or connectors in ways that expand the attacker’s effective control.
3. Impact follows when the workflow completes unsafe actions, reveals sensitive information, or consumes resources in ways that support exfiltration, privilege abuse, or service disruption.

NHI Mgmt Group analysis

AI agents are becoming a governance surface, not just an application feature. Once agents can browse, retrieve, and act, security teams must govern their behaviour as they would any other non-human identity with delegated access. That means runtime controls, scoped tools, and auditable action paths become part of identity governance, not an add-on. Practitioners should treat agent deployment as a permissions design problem first and an AI problem second.

Execution surface risk creates a new category of identity sprawl. Hidden instructions, broad connectors, and chained workflows make it easy for one agent to accumulate more effective authority than any one control plane intended. Agent privilege drift: this is the point at which an agent’s real-world action scope exceeds its approved scope because tools, context, and policy are misaligned. Teams should map where effective privilege diverges from declared privilege.

Runtime detection is now a prerequisite for trustworthy agent operations. Static reviews cannot see whether an agent is being steered mid-session into misuse, reconnaissance, or resource abuse. That is especially true where an agent’s tool access changes by task or context. Security leaders should assume that policy without runtime enforcement will miss the behaviours that matter most in production.

The market is moving toward operational agent security, not conceptual agent safety. The article reflects a broader shift in which buyers want detections, accuracy, and enforcement points that can run alongside live workflows. That validates the need for governance models that join IAM, NHI controls, and AI telemetry. Practitioners should expect procurement to increasingly ask how agent behaviour is measured, not just how it is modelled.

What this signals

Agentic systems are pushing identity programmes toward continuous control of action, not just access. That means the next phase of governance will have to unify IAM, PAM, and NHI thinking with AI telemetry so teams can see not only what an agent may access, but what it actually did. The most useful operating model will be one that ties runtime behaviour to ownership, policy, and evidence.

Agent privilege drift: the practical risk is that an agent’s effective authority grows faster than governance can review it. That is why teams should align agent controls with the least-privilege principles in the Ultimate Guide to NHIs , Key Challenges and Risks and the agentic attack patterns described in the OWASP Agentic AI Top 10.

Production teams should expect procurement, risk, and audit functions to demand evidence of behavioural monitoring, not just policy statements. The practical signal of maturity is whether an organisation can explain which agent sourced the instruction, which connector executed the action, and how the decision was contained if it went wrong.

For practitioners

• Map every agent to an explicit identity and permission boundary Inventory browser agents, coding agents, and connector-driven enterprise agents, then tie each one to a named owner, scoped privileges, and a documented approval path. Treat the agent as a non-human identity with auditable entitlements rather than as an anonymous automation layer.
• Instrument runtime detection for instruction override attempts Detect indirect prompt injection, context poisoning, and instruction manipulation before the agent executes a tool call. Prioritise telemetry that shows which content source influenced the agent and which downstream action followed.
• Constrain tool access to task-scoped least privilege Separate read, write, and destructive actions across connectors, and remove broad default permissions from agent workflows. Where possible, require step-up authorisation for actions that can change data, permissions, or external systems.
• Track reconnaissance signals as early warning indicators Alert on repeated boundary queries, tool inventory discovery, unusual connector probing, and resource spikes that indicate the agent is being tested before misuse. These signals often appear before exfiltration or unsafe automation.

Key takeaways

• AI agents now function as execution surfaces, which means security failures can arise from manipulated context, not just malicious code or bad credentials.
• The strongest evidence in the market is that agent behaviour is already outpacing policy, with governance gaps wider than many teams expect.
• Practitioners should respond by combining identity ownership, least-privilege tool access, and runtime detection for instruction manipulation and tool misuse.

Key terms

• Agent Privilege Drift: Agent privilege drift is the gap between the access an AI agent still has and the business context that originally justified it. As tasks, prompts and workflows change, permissions can remain in place longer than they should, creating hidden exposure in production systems.
• Instruction Manipulation: A tactic in which untrusted content changes an AI agent’s behaviour by altering the instructions it follows. This can occur through prompt injection, malicious tool output, or hidden directives inside web pages and documents, turning normal workflow inputs into control inputs.
• Tool Misuse: Tool misuse occurs when an agent uses an allowed integration in a way that exceeds its intended task, scope, or risk tolerance. The problem is often not access alone but the combination of valid credentials, broad permissions, and unbounded action sequencing.
• Reconnaissance Signal: An early indicator that an attacker is probing an AI agent’s boundaries, connectors, or system behaviour before attempting a larger exploit. These signals matter because they often appear before exfiltration, privilege abuse, or service disruption, giving defenders a chance to intervene earlier.

What's in the full article

Straiker's full post covers the operational detail this analysis intentionally leaves for the source:

• Detection logic for instruction manipulation, tool misuse, resource exhaustion, and reconnaissance across live agent workflows
• Examples of how accuracy tuning reduces false positives while preserving signal quality in production
• The research loop behind improved golden datasets and coverage for browser agents, coding agents, and connector-heavy enterprise agents

👉 Straiker's full post covers the four agentic detections, accuracy improvements, and research-backed coverage updates

Deepen your knowledge

The NHI Foundation Level course, the industry's only accredited NHI security programme, covers NHI governance, machine identity security, and secrets management. It helps security practitioners build a durable control model for systems that act on delegated authority.