AI identity security risks: privilege creep, prompt injection, token theft

At a glance

What this is: This is Unosecur's analysis of three AI identity risks, with privilege accumulation, prompt injection and token theft presented as the main failure modes for non-human identities.

Why it matters: It matters because IAM, PAM and NHI programmes now have to govern AI agents as delegated actors whose access can grow, be manipulated or be stolen in ways human-focused controls do not handle well.

By the numbers:

• AI agents and automation are pushing the NHI-human identity gap as big as 90 to 1.

👉 Read Unosecur's analysis of AI identity security risks, privilege creep, prompt injection and token theft

Context

AI identity risk is the governance problem that appears when non-human identities begin behaving like active actors rather than static service accounts. In this article, Unosecur frames the issue around AI agents, API keys and service accounts that can expand scope, follow hostile prompts or expose tokens as part of ordinary operation.

The control gap is not simply more automation. It is that legacy identity models assume access is provisioned, reviewed and then stable enough to govern on a human cadence, while AI agents can change their effective privilege during the work itself. That makes NHI governance, Zero Trust and token handling part of the same problem space.

Key questions

Q: What breaks when AI agents are given broad inherited permissions?

A: Broad inherited permissions break the assumption that access is tied to a narrow business need. The result is larger blast radius, weaker accountability, and faster propagation of mistakes or abuse across connected systems. A single compromised or misconfigured agent can then touch far more data and workflows than the original task required.

Q: Why do prompt injection attacks create governance risk for AI agents?

A: Prompt injection creates governance risk because the model often sits in the control path between text input and tool execution. If attackers can change what the model treats as authoritative, they can influence access decisions, data exposure, or downstream actions without compromising a traditional account. That makes prompt provenance and instruction hierarchy part of AI identity governance.

Q: How should security teams handle stolen API keys and tokens in AI workflows?

A: They should assume the token is the real identity and revoke it immediately, then scope future tokens more tightly and shorten their lifetime. A stolen token can outlive the original AI session and let an attacker impersonate the agent or user with no further model interaction.

Q: Should organisations manage AI agents under the same lifecycle as other NHIs?

A: Yes, because the core risk is the same: an identity with access outlives the purpose for which it was granted. AI agents add more runtime action capability, so lifecycle controls need to cover approval, review, revocation, and offboarding in the same governance stream as service accounts and tokens.

Technical breakdown

Privilege accumulation in AI agents

Privilege accumulation happens when an AI agent receives new permissions as tasks evolve, obstacles appear or integrations multiply. In human IAM, privilege creep is usually reviewed on a cycle, but agents can operate continuously and request fresh scope whenever a task stalls. The article also notes that advanced agents may create new credentials or identities on the fly, which turns access sprawl into an operational by-product of execution. That is different from ordinary over-provisioning because the identity can actively expand itself or its delegated footprint while still appearing legitimate.

Practical implication: treat access expansion during agent runtime as a control event, not just a recertification issue.

Prompt injection and delegated authority

Prompt injection is an instruction-layer attack that causes an AI system to ignore its intended guardrails and follow attacker-supplied instructions instead. When the system also holds delegated identity permissions, the attack becomes an authorisation problem, not just a content problem. The AI can be persuaded to retrieve data, reveal secrets or perform actions in the name of the legitimate workflow. This is why prompt hygiene alone is not enough. The article points to the need for identity-side controls that stop an injected instruction from becoming destructive execution.

Practical implication: separate instruction handling from high-risk actions so hostile prompts cannot directly consume privileged access.

Token theft as identity impersonation

Token theft is the loss of a credential that proves an AI agent, service or user is authorised to act. The article highlights insecure storage, prompt leakage and interception in transit as the main paths. Once stolen, a token can be replayed without the original AI system being involved, which means the attacker inherits the trust relationship. For NHI programmes, that is a lifecycle problem as much as a secrets problem, because the damage persists until the token is revoked or expires and the exposure window may be invisible to conventional monitoring.

Practical implication: govern tokens as short-lived identities with revocation and scope checks, not as passive configuration data.

Threat narrative

Attacker objective: The attacker wants to use the AI system's delegated trust to exfiltrate data, perform unauthorized actions or impersonate the legitimate identity at scale.

1. Entry begins when an attacker uses prompt injection, insecure token handling or exposed credentials to gain a foothold in an AI-enabled workflow.
2. Credential access then occurs when the system reveals, stores or transmits an API key, token or authorization secret that can be replayed elsewhere.
3. Escalation follows when the AI agent acquires extra permissions over time, or when the stolen token grants broader access than the original task required.
4. Impact is achieved through data exposure, unauthorized system actions or impersonation of the agent or user behind the delegated identity.

Breaches seen in the wild

• CoPhish OAuth phishing via Copilot Studio: Datadog showed Copilot Studio agents on a Microsoft domain can front OAuth consent phishing and forward stolen tokens; no victims reported.

Read and download The State of NHI & AI Agent Breach Report 2026, covering 150+ breaches impacting Non-Human Identities including AI Agents.

NHI Mgmt Group analysis

Privilege accumulation in AI agents is the AI-era form of privilege creep, but the governance failure is deeper than over-assignment. Humans accumulate access between reviews; agents can acquire it during execution, sometimes by generating new credentials to finish the task. That means access certification no longer sees the whole lifecycle of privilege, only a snapshot after the fact. The practitioner conclusion is that runtime scope changes now belong inside identity governance, not outside it.

Prompt injection breaks the assumption that instructions and authorisation are separable. The article shows that a malicious prompt can turn a legitimate AI workflow into a data-leak or action-taking channel, even without stolen passwords. This is not just an application-security concern. It is a delegated-access problem in which identity permissions are consumed by attacker-controlled instructions. Practitioners need to recognise that control of the prompt path is now part of access control design.

Token theft creates identity impersonation without requiring AI compromise. If a token is logged, transmitted badly or coerced out of the system, the attacker can act as the agent or user until the token is revoked. That makes token custody, scope and expiry central governance issues, not implementation details. The practitioner implication is that ephemeral, tightly scoped credentials reduce the blast radius of AI delegation.

Access review processes were designed for identities whose privilege persists long enough to be reviewed. That assumption fails when an AI agent can expand its access, execute a task and expose a token within the same session. The implication is that governance has to move from periodic review of static entitlements to control over issuance, delegation and runtime boundaries.

AI identity programmes should be built as NHI governance programmes first and AI programmes second. The article's three risks are not separate categories so much as one trust problem expressed three ways: privilege growth, instruction abuse and credential theft. That makes ownership, lifecycle offboarding and scope control the core operating model. Practitioners should govern AI agents as first-class NHIs with explicit accountability.

From our research library:

• 80% of identity breaches involved compromised non-human identities such as service accounts and API keys, according to the Ultimate Guide to NHIs.
• Read next: Ultimate Guide to NHIs

What this signals

Runtime identity governance is now the critical control plane for AI agents. Access that can be expanded, consumed and discarded inside a task cannot be managed safely through human-style review cadences. The programme shift is from entitlement review to issuance-time control, with offboarding and token revocation built in from the start.

Privilege creep has become execution-time creep for AI systems. The control question is no longer only who approved the access, but whether the workflow itself can create new trust relationships while it runs. That pushes identity teams to govern delegation chains, not just accounts.

Prompt injection and token theft converge in the same risk pattern. A hostile instruction can make a privileged agent disclose the very token that lets it act, which means secret handling and instruction handling are no longer separable disciplines. Teams should assume AI workflows need both NHI lifecycle controls and runtime containment.

For practitioners

• Define runtime privilege boundaries Set explicit maximum scopes for AI agents and prevent task completion from creating new standing permissions unless a separate approval path exists.
• Treat prompt paths as trust boundaries Separate untrusted input, tool invocation and sensitive action execution so a crafted instruction cannot directly trigger privileged behavior.
• Shorten token lifetime and scope Issue narrow, short-lived tokens for AI workflows and revoke them as soon as the task or delegation ends.
• Track credential creation and reuse Inventory every token, key and agent identity created by automation so leftover credentials do not become hidden entry points.
• Review AI agent offboarding Add explicit offboarding for AI agents, including token revocation, secret invalidation and removal of inherited permissions when a workflow changes.

Key takeaways

• AI agents create identity risk because they can accumulate access, follow hostile instructions and expose tokens while still appearing to operate normally.
• The article's core warning is that non-human identity governance must move from static review models to runtime control of delegation and credentials.
• Teams need explicit ownership, tighter token scope and offboarding rules for AI agents if they want to contain the blast radius of delegated access.

Key terms

• Privilege Accumulation: Privilege accumulation is the gradual buildup of access beyond what a system originally needed. In AI environments, it often happens when agents and automation are granted broad permissions for convenience, then retain those permissions as use cases expand, creating a larger blast radius than the programme intended.
• Prompt Injection (Agentic): An attack where malicious instructions are embedded in content that an AI agent reads, causing the agent to execute unintended actions using its own legitimate credentials. A primary vector for agent goal hijacking and identity abuse.
• Token Theft: An attack where a valid authentication token is stolen and replayed by an attacker to gain unauthorised access. Short token lifespans and token binding are the primary mitigations.
• Delegated Identity: Delegated identity is when one actor acts on behalf of another with explicit permission and bounded authority. In AI-assisted commerce, it requires clear consent, limited scope, and traceable records so the retailer can distinguish authorised delegation from unauthorised automation.

What's in the full article

Unosecur's full blog covers the operational detail this post intentionally leaves for the source:

• The article's deeper explanation of privilege accumulation in AI agents and why it differs from ordinary privilege creep
• The prompt injection example involving Slack's AI assistant and the conditions that made the leak possible
• The token theft discussion covering insecure storage, interception and replay risk for delegated AI credentials
• The FAQ section's practical guidance on orphaned agents, static credentials and automated authentication workflows

👉 Unosecur's full post expands on the Slack prompt injection example, token exposure paths and AI agent privilege growth.

Deepen your knowledge

NHI governance, agentic AI identity, and machine identity security are core topics in our NHI Foundation Level course, the industry's only accredited NHI security programme. If you are building or maturing an IAM programme, it is worth exploring.