AI-level attackers are limited by permissions posture, not just flaws

At a glance

What this is: Sonrai Security argues that as attackers gain more AI-assisted discovery capability, permissions posture will determine whether an intrusion stays narrow or becomes an environment-wide compromise.

Why it matters: For IAM and NHI practitioners, the issue is not just preventing initial access but limiting what service accounts, agents, and other identities can reach once compromise occurs.

👉 Read Sonrai Security's analysis of AI attackers and permissions-driven blast radius

Context

Permissions posture is the difference between an intrusion that is contained and one that spreads across cloud resources. In NHI governance terms, the risk is not limited to human users; service accounts, AI agents, and other machine identities often carry the broadest access in the environment. When those identities are over-privileged, a single compromise can move from detection to impact very quickly.

The article frames a familiar cloud problem through an AI-accelerated threat model: attackers will keep improving discovery, but many organisations still rely on accumulated permissions that were never cleaned up. That makes least privilege, access review, and quarantine of unused identities central controls for NHI governance, not after-the-fact hardening. The starting position described here is common, not unusual.

Key questions

Q: What breaks when non-human identities have more access than they need?

A: When non-human identities carry excess access, a single compromise can move from a local incident to broad cloud control. Over-privileged service accounts, tokens, and AI agents can reach storage, compute, and IAM functions that were never necessary for their job. The result is larger blast radius, faster lateral movement, and much harder containment.

Q: Why do service accounts and AI agents increase lateral movement risk?

A: Service accounts and AI agents often operate with persistent permissions across multiple systems, which makes them useful stepping stones after compromise. If their access is broader than the task requires, attackers can pivot through cloud resources, manipulate infrastructure, or access sensitive data without needing to steal additional credentials.

Q: How do security teams know whether least privilege is actually working?

A: Least privilege is working when identities have narrowly scoped permissions, unused credentials are removed or quarantined, and repeated access reviews consistently shrink entitlements. A good signal is whether a compromised identity would be unable to move beyond one bounded workflow. If broad resource reach still exists, the control is not effective.

Q: What should teams do first after finding over-privileged cloud identities?

A: Contain the highest-risk identities first by removing wildcard permissions, restricting access to critical resources, and quarantining unused credentials. Then validate operational dependencies before restoring any access. The goal in the first 24 to 72 hours is to reduce blast radius, not to complete a perfect remediation programme.

Technical breakdown

Why permissions posture determines blast radius

Blast radius is the amount of damage a compromised identity can reach. In cloud environments, that radius is defined less by the initial entry point than by the permissions attached to service accounts, tokens, and AI agents. If an identity has wildcard access across storage, compute, and IAM, compromise becomes a platform-wide problem. If access is narrowly scoped, the same compromise may be limited to a single workflow or dataset. This is why identity governance is a containment control, not just an administrative exercise.

Practical implication: Map each non-human identity to its actual reachable resources and remove any permission that does not support a required task.

Why least privilege matters more when attacks are AI-assisted

AI-assisted attackers compress the time between discovery and exploitation. That matters because manual remediation and policy cleanup usually move slower than adversary tooling. The technical issue is not that AI changes the underlying IAM model, but that it raises the tempo of finding weak identities, stale entitlements, and permission sprawl. When the attacker can inspect more of the environment faster, every unnecessary permission becomes easier to turn into lateral movement or data access.

Practical implication: Prioritise automated entitlement reduction and continuous access review instead of waiting for annual IAM cleanup cycles.

How cloud identity sprawl creates security debt

Identity sprawl happens when organisations create more service accounts, API keys, certificates, and agent credentials than they can govern. Over time, permissions accumulate, unused identities linger, and exceptions become normalised. That creates security debt, because each dormant or over-permissioned identity expands the attack surface without adding operational value. In NHI programs, this is where governance fails first: not at creation, but at lifecycle control, access review, and retirement.

Practical implication: Build lifecycle controls that detect unused identities, quarantine them, and enforce default-deny patterns for new machine identities.

Threat narrative

Attacker objective: The attacker aims to turn a single identity compromise into broad cloud control with minimal resistance.

1. Entry occurs through a compromised workload, AI agent, or other identity that already has access to cloud resources.
2. Escalation happens when broad permissions let the attacker move from one service to storage, compute, or IAM management functions.
3. Impact is realised when the attacker can exfiltrate data, alter infrastructure, or use the environment as a launch point for further compromise.

Breaches seen in the wild

• Moltbook AI agent keys breach — Moltbook breach exposed 1.5M AI agent keys.
• AI LLM hijack breach — attackers used stolen AWS access keys to hijack Anthropic LLM models on Bedrock.

Read our 52 NHI Breaches Analysis report for a comprehensive view of breaches impacting Non-Human Identities including AI Agents.

NHI Mgmt Group analysis

Permissions posture is now the primary containment variable in NHI security. Attackers will continue to improve discovery, but the more durable control is still what an identity can reach after compromise. That shifts NHI governance away from static entitlement ownership and toward continuous containment. Practitioners should treat blast-radius reduction as a core control objective, not a secondary hardening task.

Identity sprawl creates security debt that cannot be paid down manually at cloud scale. Years of accumulated service accounts, tokens, and exceptions make policy-by-policy cleanup too slow for current threat tempo. The practical lesson is that automation must support entitlement reduction, quarantine, and review if least privilege is going to be more than a policy statement. Teams that cannot operationalise this will inherit risk they cannot see.

AI-assisted attack speed exposes the gap between discovery and remediation. The faster attackers identify weak identities, the less value there is in remediation programs that depend on periodic review. That makes lifecycle governance, default-deny onboarding, and unused-identity retirement central to modern IAM. The field should stop treating machine identity sprawl as an edge case and start treating it as the norm.

Least privilege is becoming a resilience control, not just an access control. In environments with aggressive automation, the question is no longer whether compromise happens, but how much authority the compromised identity carries. That is a material shift for NHI programs because it ties governance directly to incident containment and recovery time. Practitioners should align identity scope to operational need before exposure does it for them.

From our research:

• 70% of organisations grant AI systems more access than they would give a human employee performing the exact same job, according to the 2026 Infrastructure Identity Survey.
• 69% of security leaders agree identity management must fundamentally shift to address agentic AI systems.
• For the next step: OWASP NHI Top 10 helps teams map identity scope, privilege, and tool-use risk before agents become a bigger attack surface.

What this signals

Identity sprawl is becoming the operational weak point in agentic environments. With 67% of organisations still relying heavily on static credentials, the governance problem is no longer hypothetical, it is already embedded in day-to-day cloud operations. Teams should expect more pressure to replace long-lived secrets with tighter lifecycle controls and narrower access scope.

Blast-radius reduction will become the practical test of IAM maturity. The question for most programmes is not whether they have policies, but whether a compromised identity can still move meaningfully through the environment. That makes access review, quarantine, and default-deny onboarding the controls most likely to separate mature from exposed environments.

As AI systems take on more autonomous work, identity governance has to shift from periodic certification to continuous control. That is where the NHI lifecycle, access scope, and workload identity rules converge. Practitioners should prepare for a world where the speed of change matters as much as the correctness of the entitlement model.

For practitioners

• Inventory every non-human identity and its effective reach Map service accounts, API keys, certificates, and AI agent credentials to the cloud resources they can touch. Remove permissions that are not required for a defined task, and flag identities with wildcard access or cross-domain reach for immediate review.
• Automate quarantine for unused or dormant identities Establish controls that detect inactive machine identities, isolate them quickly, and require explicit re-approval before reactivation. This reduces the value of long-lived credentials and limits the blast radius of stale access paths.
• Enforce default-deny for new machine identities Require new service accounts and agent credentials to start with minimal access, then add permissions only after operational need is verified. Pair that with recurring access review so exceptions do not become permanent privileges.
• Use access review to target the biggest exposure first Prioritise identities that can reach storage, compute, and IAM management functions, since those paths usually determine whether a compromise stays contained. Review broad permissions before low-impact entitlements.

Key takeaways

• Over-privileged non-human identities turn a compromise into a blast-radius problem, not just an access problem.
• AI-assisted attack speed makes manual IAM cleanup too slow to rely on for cloud and NHI governance.
• The most effective response is continuous least-privilege enforcement across service accounts, tokens, and AI agents.

Key terms

• Blast Radius: Blast radius is the amount of damage a compromised identity can cause once an attacker gets in. In cloud and NHI environments, it is shaped by permissions, resource scope, and whether access is tightly limited to a task or broadly distributed across systems.
• Identity Sprawl: Identity sprawl is the accumulation of service accounts, API keys, certificates, tokens, and agent credentials faster than an organisation can govern them. Over time, it creates dormant access paths, oversized permissions, and hidden risk that traditional review cycles often miss.
• Least Privilege: Least privilege means granting each identity only the access needed to complete a specific job, and nothing more. For non-human identities, that requires lifecycle controls, access review, and removal of broad or persistent permissions that increase compromise impact.
• Non-Human Identity: A non-human identity is any machine or software credential used by systems, workloads, or autonomous agents. It includes service accounts, tokens, API keys, and certificates, all of which need governance because they can carry access far beyond a single application or workflow.

Deepen your knowledge

Permissions posture and least privilege for non-human identities are core topics in our NHI Foundation Level course, the industry's only accredited NHI security programme. If you are building governance for cloud identities and AI agents from a similar starting point, it is worth exploring.

This post draws on content published by Sonrai Security: The Conversation No one is Having About Claude Mythos. Read the original.