AI agents on endpoints expose an ungoverned identity layer

At a glance

What this is: This is an analysis of why AI agents on employee endpoints create a security gap beyond the model, with the key finding that agentic fabric components hold the real access and decision power.

Why it matters: It matters because IAM, NHI, and PAM teams now have to govern agent behaviour, delegated access, and runtime context, not just accounts, tokens, and endpoint telemetry.

By the numbers:

• 92% agree governing AI agents is critical to enterprise security, yet only 44% have implemented any policies to do so.
• 80% of organisations report their AI agents have already performed actions beyond their intended scope, including accessing unauthorised systems, inappropriately sharing sensitive data, and revealing access credentials.

👉 Read Backslash Security's analysis of AI agents on employee endpoints

Context

AI agentic fabric is the collection of instructions, memory, connectors, skills, hooks, MCP servers, and sub-agents that gives an agent its practical power on an employee endpoint. The security problem is that these components extend identity, access, and execution far beyond the model itself, while most endpoint controls still assume software behaves in predictable, process-level ways.

That assumption breaks IAM and NHI governance at the endpoint boundary. Once an agent can be told mid-conversation to install a skill, connect to a server, or use a credentialed connector, security teams need visibility into delegated authority, not just device posture or application presence.

The article's starting position is typical of enterprise agent adoption: teams can see the model and the endpoint, but not the full agentic fabric that links them. That visibility gap is where access abuse, shadow AI, and over-scoped delegation accumulate.

Key questions

Q: What breaks when organisations rely only on EDR to control AI activity?

A: EDR can miss the browser-mediated steps where users paste data, approve access, or move between SaaS tools and AI services. That creates a control gap between endpoint telemetry and actual risk. Without browser-level controls, organisations may have logs from the device but still lack context on prompt content, data disclosure, and policy violations.

Q: Why do AI agents complicate access governance more than ordinary automation?

A: AI agents complicate access governance because they can branch at runtime, wait on external services, and continue later with the same operational context. That means privilege is not just granted at launch, it persists across a live session that must be observable, resumable, and attributable.

Q: How can security teams tell when an agentic control model is failing?

A: The clearest sign is when approved components behave safely on paper but unsafe outcomes still occur in practice. Repeated manual approvals, untracked tool use, missing session traces, and unexplained data movement all indicate that the policy boundary is too shallow for the agent's actual runtime behaviour.

Q: How should organisations govern AI agent tool access as connectors change?

A: Organisations should treat connector updates like identity change events. Every new tool should start disabled, be classified against the trust ladder, and be added to a signed policy export before it can act. That keeps the access model aligned with the live system instead of the last review cycle.

Technical breakdown

What the agentic fabric on an endpoint actually is

The agentic fabric is the layered control surface around an AI agent. Instructions define behaviour, memory preserves context, connectors and MCP servers extend access, skills add reusable capability, hooks trigger at specific workflow moments, and sub-agents delegate tasks. Each layer can be individually legitimate, but the security risk emerges when they combine into a runtime access path that is broader than any single component appears to be. Traditional endpoint security sees artefacts and activity, but not the agent's combined authority graph.

Practical implication: Map agentic components as a governed access chain, not as isolated endpoint software.

Why EDR misses agentic risk on the endpoint

EDR is built to flag malware-like behaviour, suspicious processes, and known compromise patterns. AI agents often stay inside approved applications and sanctioned workflows while still making unsafe or unexpected decisions. That means the telemetry may look normal at the process level even when the agent has been manipulated by prompt injection, a malicious skill, or an over-broad connector. The gap is contextual, not merely behavioural: the tool call may be valid, but the agent's decision to make it may not be.

Practical implication: Treat EDR as necessary telemetry, then add agent-aware policy and audit context above it.

Why composability risk is the real governance problem

Composability risk appears when individually acceptable components become dangerous in combination. A filesystem-capable skill, persistent memory, and a broad OAuth connector may each pass review on their own, yet together create an exfiltration or destructive-action path. This is an identity governance problem because the combined effect changes the agent's effective privilege boundary at runtime. The issue is not just malicious code, but assembled authority that exceeds what any single control reviewed.

Practical implication: Review agentic fabric combinations as a single policy object before allowing runtime access.

Threat narrative

Attacker objective: The attacker wants to manipulate the agent's delegated authority so it performs unsafe actions while appearing to operate normally.

1. Entry begins when a user or webpage persuades the agent to install a new skill, trust a connector, or act on injected instructions inside an otherwise legitimate session.
2. Escalation follows when the agent combines memory, connectors, MCP servers, and hooks into a broader runtime authority set than the operator intended.
3. Impact occurs when that expanded authority enables credential theft, data exposure, destructive actions, or silent exfiltration without a conventional malware signature.

Breaches seen in the wild

• Meta AI Instagram Account Takeover — 20,225 Instagram accounts hijacked via compromised Meta AI support chatbot with overprivileged access.
• Replit AI Tool Database Deletion — Replit vibe coding AI assistant deletes live production database and creates 4,000 fake user records.

Read our 52 NHI Breaches Analysis report for a comprehensive view of breaches impacting Non-Human Identities including AI Agents.

NHI Mgmt Group analysis

Endpoint security no longer governs the real unit of risk when the agentic fabric becomes the access layer. Instructions, memory, connectors, skills, hooks, MCP servers, and sub-agents create a composite identity surface that endpoint tooling was never designed to understand. That means the governance problem is not device monitoring alone, but control over how delegated runtime authority is assembled and used. Practitioners should treat agentic fabric as an identity domain in its own right.

Visibility into the model is not visibility into the agent. Security programmes that stop at the application layer will miss the actual permissions, token use, and tool graph that determine what the agent can do. This is a classic IAM blind spot, but in agentic environments it becomes more acute because the same session can pivot across local and cloud resources. The implication is that identity governance must follow the agent's execution path, not the software label.

Composability is the new privilege problem. The article's central insight is that safe-looking pieces can form unsafe authority when combined mid-session. That is the same governance failure that NHI teams see when over-privileged service accounts accumulate access over time, except the agent can assemble the risk dynamically. Practitioners need to review the assembled privilege boundary, not each component in isolation.

Human approval is not a durable control when agent actions become repetitive and contextual. The cited approval rates show how quickly confirmation can become ritual rather than governance. For identity teams, that means approval gates cannot be the only line of defence for agent actions that can chain tools, retrieve data, and execute within a single session. The practical conclusion is to move from confirmation-based oversight to policy-enforced runtime boundaries.

Agentic endpoint governance will increasingly converge with NHI governance and zero trust control design. The same questions now apply across human, machine, and autonomous actors: what is authorised, when it is authorised, and how much context is needed to trust the action. That convergence does not make the problem simpler, but it does make the governance model more coherent. Teams that already manage secrets, connectors, and least privilege have the strongest foundation for agentic control.

From our research:

• 92% agree governing AI agents is critical to enterprise security, yet only 44% have implemented any policies to do so, according to AI Agents: The New Attack Surface report.
• Only 52% of companies can track and audit the data their AI agents access, leaving 48% with a complete blind spot for compliance and breach investigation.
• That governance gap also affects machine identity strategy, as the State of Non-Human Identity Security shows how visibility gaps persist across connected access paths.

What this signals

Agentic fabric will force endpoint and identity teams to converge on runtime governance. Once agents can install skills, attach connectors, and delegate work mid-session, the old split between endpoint telemetry and identity policy becomes too thin to defend. Teams should expect more controls to move from static allowlists toward policy enforcement that understands the assembled access chain.

Shadow AI on endpoints is likely to look like ordinary sanctioned software for a long time. The more dangerous pattern is not always an unapproved app, but an approved tool used under the wrong account or with the wrong delegated scope. That makes account provenance, connector scope, and session traceability more important than app inventory alone.

Agentic endpoint security will be measured by whether you can explain a decision after the fact. If the organisation cannot reconstruct instructions, tool calls, and delegated context, it cannot prove whether an outcome was malicious, accidental, or simply overscoped. That is where the governance model shifts from prevention only to provable accountability.

For practitioners

• Inventory the full agentic fabric Catalogue instructions, memory stores, MCP servers, skills, hooks, connectors, and sub-agents on employee endpoints so you can govern the assembled access path, not just the application name.
• Classify connector and skill combinations as policy objects Review high-risk pairings such as filesystem-capable skills plus persistent memory plus broad OAuth connectors as one runtime boundary, then approve or deny the combination as a unit.
• Add agent-aware audit logging Log instructions, tool calls, connector use, and the reasoning trail that links them so investigations can separate manipulation, overscoped action, and genuine error.
• Limit repetitive approval loops Use runtime policy and scoped permissions for frequent agent actions so security does not depend on approval fatigue or habituated confirmation behaviour.

Key takeaways

• The article's core warning is that endpoint security sees activity, but not the agentic authority that drives it.
• The strongest evidence is that safe-looking components can combine into unsafe behaviour, especially when connectors, memory, and skills overlap.
• Identity teams should govern the assembled agentic fabric as a runtime access boundary, because human approval and EDR alone do not close the gap.

Key terms

• Agentic Fabric: Agentic Fabric is an identity security control layer designed for AI agents and other machine identities. It discovers hidden agents, credentials, and protocol servers, then applies governance and protection around them. In practice, it aims to expose risk, enforce ownership, and support real-time remediation across automated environments.
• Composability Risk: Composability risk is the security problem that appears when individually acceptable components become dangerous together. In agentic systems, a skill, a memory store, and a connector may each look safe alone, yet collectively create a path to data exposure, destructive action, or policy bypass.
• Shadow AI: AI agents, copilots, or connected tools operating without full visibility or governance from security teams. Shadow AI becomes an identity problem when those systems authenticate with unmanaged tokens, service accounts, or OAuth apps that can reach production resources.
• Agent-Specific Audit Trail: An agent-specific audit trail records the instructions, tool calls, connector use, and context that led to an AI agent's action. It is stronger than ordinary endpoint logging because it explains intent and sequence, which are essential for determining whether the outcome was malicious, overscoped, or accidental.

What's in the full article

Backslash Security's full analysis covers the operational detail this post intentionally leaves for the source:

• How the agentic fabric maps across endpoint components, including instructions, hooks, connectors, and sub-agents.
• Examples of runtime failure modes, including prompt injection, malicious skills, and unsafe connector combinations.
• The approval and audit limitations the article observes in real agent workflows.
• The webinar context and the vendor's endpoint protection approach for practitioners who need implementation detail.

👉 The full Backslash Security post covers the agentic fabric, approval limits, and endpoint audit gaps in more detail.

Deepen your knowledge

NHI governance, agentic AI identity, and machine identity security are core topics in our NHI Foundation Level course, the industry's only accredited NHI security programme. If you are building or maturing an identity security programme, it is worth exploring.