AI agents are widening identity attack surfaces faster than safeguards

At a glance

What this is: NHI Mgmt Group's analysis, drawing on Semperis's research: AI agents are already being placed into sensitive identity workflows faster than organisations are establishing registration, authorisation and recovery safeguards.

Why it matters: IAM, IGA and PAM teams need to treat AI agents as governed identities now, because unchecked access to identity infrastructure expands blast radius before controls catch up.

By the numbers:

• The study surveyed 1,100 organisations across the U.S., U.K., France, Germany, Italy, Spain, Australia and Singapore.
• 93% already use or plan to use AI agents for sensitive security tasks such as password resets and VPN access.
• Only 32% are very confident they could regain control if AI exposes admin credentials.
• Only 65% of organisations say AI identities are fully registered, authenticated and authorised in a formal system.

Context

AI agents are being introduced into identity systems before most organisations have formalised how those identities are registered, authenticated, authorised and recovered. In this study context, the primary governance gap is not experimentation with AI itself, but the mismatch between new machine identities and existing control assumptions.

That matters most where AI touches Active Directory, Entra ID and Okta, because those systems sit close to authentication, privilege and administrative recovery. Once AI is allowed to handle password resets, VPN access or local credential access, the question shifts from productivity to who can still govern the identity layer when the agent misbehaves.

The article frames AI agents as non-human identities inside the enterprise identity fabric, and that is the right lens. These are not just tools with API access; they are identities that can widen blast radius unless they are explicitly governed as such.

Key questions

Q: What breaks when AI agents are given access without identity governance?

A: What breaks is accountability. The organisation may see actions, logs, and alerts, but it cannot reliably tie them to a governed identity with clear scope and revocation. That creates uncontrolled blast radius, especially when agents can reach sensitive systems through shared tokens, delegated service accounts, or broad API access.

Q: Why do AI agents stress identity infrastructure more than normal automation?

A: Because they can create continuous, machine-paced access demand that exceeds the assumptions built into most IAM systems. Normal automation is usually bounded and predictable. Agentic systems can vary timing, sequence, and tool use at runtime, which pushes identity services into a reliability and governance problem at the same time.

Q: How do organisations know if AI identity governance is working?

A: They should be able to answer three questions quickly: which agents exist, which credentials each one uses, and who is accountable for each identity’s lifecycle. If any of those answers require manual searching across teams, the governance model is still incomplete and the environment remains difficult to audit.

Q: Should organisations treat autonomous agents like human users or service accounts?

A: Organisations should not treat autonomous agents as simple human analogues. They behave like governed non-human identities with added runtime decision-making, so they need identity boundaries, action checkpoints, and clear accountability. Human-style certification cycles alone are too slow for systems that can complete sensitive work within one session.

Technical breakdown

Why AI agents change identity attack surface economics

An AI agent alters identity risk because it can be granted high-value access for operational convenience while acting at machine speed. That changes the cost of a mistake: a single over-privileged agent can touch password resets, VPN flows, admin credentials or local secrets before a human notices. In identity terms, the attack surface expands not only because access exists, but because decision speed and access scope now align inside the same runtime.

Practical implication: treat every agent with identity-system access as a governed non-human identity, not as a workflow helper.

Why formal registration and authorisation matter for agents

The study’s 65% registration figure is important because untracked AI identities cannot be recertified, offboarded or reviewed in any meaningful way. If an agent is allowed to authenticate into identity infrastructure without a formal system of record, accountability becomes ambiguous and recovery becomes guesswork. The control failure is not merely missing inventory, but the absence of an authoritative lifecycle for the identity itself.

Practical implication: require every AI agent to be registered, authenticated and authorised before it can reach identity or secrets systems.

Why recovery readiness is part of identity governance

Identity compromise behaves differently from ordinary endpoint compromise because the identity layer can become both the attack path and the recovery dependency. If an AI agent exposes admin credentials, teams may need to restore trust in authentication, privileges and trust boundaries at the same time. That is why resilience for identity systems cannot be separated from governance of the identities allowed to operate inside them.

Practical implication: test whether identity systems can be restored to a trusted state after agent misuse, not only after infrastructure failure.

Threat narrative

Attacker objective: The attacker aims to compromise identity infrastructure and use that access to expand control across critical systems.

1. Entry occurs when AI agents are granted access to sensitive identity workflows such as password resets, VPN access, SSH material or encryption keys.
2. Credential access follows when those agents can reach admin credentials or local secrets that were not scoped for machine-mediated use.
3. Escalation occurs when an exposed or misused identity path lets attackers accelerate compromise of identity infrastructure such as Active Directory, Entra ID or Okta.
4. Impact is the loss of trustworthy control over identity systems, which can turn a contained incident into prolonged access risk across the enterprise.

Breaches seen in the wild

• Okta support system breach 2023: A support service account credential saved in a personal Google profile let attackers take HAR files and hijack five Okta customers' sessions.
• CoPhish OAuth phishing via Copilot Studio: Datadog showed Copilot Studio agents on a Microsoft domain can front OAuth consent phishing and forward stolen tokens; no victims reported.

Read and download The State of NHI & AI Agent Breach Report 2026, covering 200+ breaches impacting Non-Human Identities including AI Agents.

NHI Mgmt Group analysis

AI agents are now part of the identity attack surface, not just consumers of it. When an agent can request resets, touch VPN access or sit near privileged secrets, the identity layer itself becomes the security boundary. That shifts governance from application-centric oversight to direct control of machine identities embedded in core IAM systems. Practitioners should stop treating agent access as temporary tooling and start treating it as a governed identity class.

Registration gaps create governance debt that compounds quickly. If AI identities are not fully registered, authenticated and authorised in a formal system, offboarding, review and incident reconstruction all fail at the same point. The article’s 65% figure shows that many organisations are already operating with incomplete lifecycle control over a new identity population. The practical consequence is not just blind spots, but an inability to prove who had access when it mattered.

Blast-radius control is becoming the decisive control variable for identity teams. The article shows that agents placed close to admin credentials and encryption keys can accelerate compromise before safeguards are mature. That means the first question is no longer whether AI can be useful, but how far one agent can move if its identity is abused. Practitioners should govern agent privilege by containment value, not by convenience.

Recovery readiness is now an identity governance requirement. Many resilience programmes assume the identity layer survives long enough to be inspected and repaired after an incident. AI agents collapse that assumption because they can interact with identity controls at machine speed and leave little time for manual intervention. The implication is that identity governance must include restoration of trustworthy control, not just prevention and monitoring.

AI identity governance will increasingly converge with NHI governance and privileged access discipline. The article’s best-practice framing is consistent with an NHI model: explicit identity, least privilege, just-enough access and trust-boundary segregation. That convergence matters because agentic behaviour makes weak lifecycle discipline visible faster than human-only systems do. Practitioners should align AI governance with the same rigor used for other high-value non-human identities.

From our research library:

• Only 44% of organisations have implemented any policies to manage their AI agents, despite 92% agreeing that governing AI agents is critical to enterprise security, according to the 2026 Infrastructure Identity Survey.
• 54% of organisations are actively deploying AI agents across workflows, yet only 21% report a mature governance model for agentic AI.
• Read next: Agentic AI Identity Guide

What this signals

Ephemeral agent privilege debt: AI agents often enter critical identity workflows before organisations have finished defining who owns them, what they may touch, and how they are removed. That creates a growing governance debt that shows up first in recovery, then in audit failure, and finally in blast-radius expansion.

The practical signal for IAM and PAM teams is that identity reviews must move closer to issuance time. If an agent can request resets, touch VPN access or access encryption keys, then access certification alone is too late to contain misuse.

For practitioners

• Classify AI agents as governed non-human identities Put every agent that touches identity infrastructure into the same inventory and ownership model you use for other high-value NHI credentials. Require named owners, purpose, scope and expiry before the agent can reach sensitive systems.
• Restrict agent access to just-enough identity functions Scope agent permissions to the smallest feasible set of identity tasks, especially password resets, VPN access and administrative workflows. Avoid giving agents standing access to admin credentials or encryption keys when a narrower delegation will work.
• Separate agent trust boundaries from human trust boundaries Do not let human and agent authentication paths blend by default. Where possible, segment identity stores, approval paths and audit trails so an agent compromise does not immediately inherit human trust assumptions.
• Test recovery of identity control after agent misuse Exercise scenarios where an AI agent exposes admin credentials or acts outside scope, then measure whether teams can restore a trustworthy identity state without depending on the compromised path.
• Monitor for anomalous agent behaviour around identity systems Use behavioural analytics to detect unusual agent activity such as repeated reset requests, unexpected privilege touchpoints or access patterns that do not match the agent’s declared purpose.

Key takeaways

• AI agents are widening the identity attack surface because they can be placed inside critical workflows before the surrounding governance model is complete.
• The study shows a material gap between adoption and control, especially around registration, authorisation and confidence in recovery after credential exposure.
• The control that matters most is not simply more monitoring, but tighter lifecycle governance, privilege scope and recovery readiness for AI identities.

Key terms

• AI Identity Scope: The set of resources, tools, and credentials an AI system can access in order to complete a task. Proper scope is narrower than generic user access because autonomous systems can chain actions quickly, making overbroad permissions far more damaging than in human-only workflows.
• Identity Attack Surface: Identity attack surface is the total set of accounts, tokens, login endpoints, trust paths, and supporting systems that can be probed for access. For password spraying, the risk grows with every externally reachable authentication path and every dormant or weakly protected identity.
• Recovery readiness: Recovery readiness is the ability to restore critical services safely, predictably, and in the right order after disruption. It depends on people, process, and access as much as it depends on backup technology. In identity-heavy environments, recovery readiness also includes knowing who can approve, execute, and validate restoration.
• Non-Human Identity Governance: Non-human identity governance is the practice of managing, controlling, and auditing every machine identity across its full lifecycle. It covers service accounts, API keys, tokens, certificates, and AI agent credentials, ensuring each has a defined owner, scoped privilege, rotation schedule, and revocation path. Without governance, NHIs accumulate silently and become the primary attack surface in cloud and automated environments.

Deepen your knowledge

NHI governance, agentic AI identity, and machine identity lifecycle are core topics in our NHI Foundation Level course, the industry's only accredited NHI security programme. If you are building or maturing an IAM programme, it is worth exploring.