AI security best practices are failing at the agentic AI edge

At a glance

What this is: Cyberhaven argues that AI security best practices are failing at the agentic edge because endpoint agents behave differently from browser-bound generative AI tools and evade legacy control assumptions.

Why it matters: IAM, PAM, NHI, and AI security teams need to rethink governance when software agents act with persistent context, OS-level access, and machine-speed autonomy that old DLP and network controls cannot reliably see.

By the numbers:

• 39.7% of AI interactions involve sensitive data, according to Cyberhaven.
• Roughly half of all developers were using desktop-based coding assistants by late 2025, according to Cyberhaven.
• Nearly 23% of enterprises had adopted agent-building platforms by early 2026, according to Cyberhaven.

Context

AI security becomes a governance problem when the protected object is no longer just a model or a prompt flow, but a software agent with local execution rights, persistent memory, and access to files and APIs. Legacy security programs assume human-paced sessions, known applications, and traffic that can be inspected at the network boundary, which is why those controls miss agentic behaviour.

Cyberhaven's core point is that the security boundary has shifted from the browser to the endpoint and from the session to the agent's local context. That matters to IAM and NHI teams because agentic systems start to look like non-human identities with delegated access, yet they are often governed with controls built for human users or conventional SaaS applications.

Key questions

Q: What breaks when AI controls depend on replacing the browser?

A: Control coverage weakens when security depends on forcing employees into a new browser. Users often route around disruptive controls, which creates blind spots for unmanaged AI accounts, shadow usage, and data movement that happens in mainstream browsers.

Q: Why do autonomous AI agents create more access risk than task bots?

A: Autonomous AI agents create more access risk because they can combine persistence, reactivity, and initiative. A task bot usually executes a narrow command, but an agent can preserve context, request more access, and act on changing conditions. That wider behavioural range increases the chance of overreach, unintended data exposure, and difficult-to-trace actions.

Q: What signs show that agentic AI is escaping identity governance?

A: The clearest signs are agents appearing without inventory, connectors being added without review, and permissions that remain broad after deployment. If teams cannot say which agents exist, what they can touch, and how they are offboarded, governance is already behind the environment.

Q: Should organisations treat AI service sessions like privileged non-human identities?

A: Yes, when those sessions can consume paid usage, call tools, or reach sensitive data. They should be owned, monitored, and reviewed as governed identities, because their operational value and blast radius can be as high as a service account or API token.

Technical breakdown

Why agentic AI breaks browser-centric control models

Generative AI tools usually sit behind a browser or application interface, so security teams can monitor traffic, apply DLP, and rely on session boundaries. Agentic AI is different because it runs locally, interacts with the operating system, and can call APIs or read files without a browser-mediated checkpoint. That means the security plane shifts from network inspection to endpoint observability, and the audit model must follow the agent's actions rather than the user's prompts.

Practical implication: Treat endpoint-level visibility as mandatory for agentic AI because browser and network controls no longer define the real trust boundary.

Persistent local context changes the data risk model

Traditional AI controls often assume that sensitive information is exposed during a prompt and then disappears with the session. Agentic systems store interaction history locally as a persistent context window, effectively creating a searchable record of files, fragments, and task history that can be reused across actions. That persistence expands the blast radius of any sensitive data the agent encounters, because the risk is no longer just what is typed, but what the agent remembers and reuses.

Practical implication: Classify agent memory and local context stores as governed data surfaces, not harmless runtime artifacts.

Non-human identity governance is now part of AI security

When an agent can spawn processes, access the filesystem, and invoke external services, it is functioning like a non-human identity with delegated authority. The control challenge is not simply authentication, but scope, lifecycle, and use constraints for an identity that can act continuously without human pacing. That is why AI security, IAM, and NHI governance now intersect directly: if the agent's access is not explicitly bounded, the control failures will look like overprivileged service accounts, unmanaged secrets, and poor offboarding discipline.

Practical implication: Apply identity lifecycle and privilege governance to agents as if they were high-risk machine identities with sensitive operating permissions.

Threat narrative

Attacker objective: The objective is to move sensitive data through an autonomous system that can access, retain, and reuse it outside the governance model built for human users.

1. Entry occurs when an agent is installed on an endpoint and granted local access to files, clipboard data, and process execution through legitimate software permissions.
2. Credentialed access then expands as the agent uses that operating context to call APIs, read sensitive content, and persist interaction history across tasks.
3. Impact follows when the agent processes or exposes sensitive data outside the intended policy boundary, bypassing network DLP and leaving security teams with limited visibility.

Breaches seen in the wild

• Samsung ChatGPT leak 2023: Samsung staff pasted chip source code and meeting notes into ChatGPT weeks after it was allowed, leading Samsung to restrict generative AI tools.
• DeepSeek database exposure 2025: An unauthenticated DeepSeek ClickHouse database exposed over a million log lines with plaintext chat history and API keys in 2025.

Read and download The State of NHI & AI Agent Breach Report 2026, covering 200+ breaches impacting Non-Human Identities including AI Agents.

NHI Mgmt Group analysis

Agentic AI security is now an identity governance problem, not just a model-risk problem. Once software can act continuously with delegated access, the control question becomes who or what can act, for how long, and with what scope. That is the same governance logic IAM and PAM teams use for human admins and service accounts, but the actor is now an agent. Practitioners should govern agents as high-risk non-human identities, not as mere application features.

Endpoint control is the new enforcement point for agentic AI. Browser-level inspection and network DLP were designed for human interaction patterns, not for local processes that can read files, spawn tasks, and invoke APIs directly. The operational implication is that visibility has to move closer to the device and the process layer, where agent actions actually occur. Security programmes that stop at network monitoring will miss the most material agent behaviours.

Persistent agent context creates a form of governance debt. When memory and interaction history live locally, sensitive data may remain available long after the original task has ended. That creates an ongoing exposure window that traditional session-based controls do not measure well. Practitioners should treat agent memory, logs, and cached context as governed stores with clear retention and access rules.

AI security programmes need to absorb NHI-style lifecycle discipline. The article points to a named concept we can call agentic control-plane drift: the gap that appears when governance remains tied to prompts and browsers while the real control plane has moved to local execution and delegated authority. That drift will keep producing blind spots until teams align AI governance with identity, data, and endpoint control together.

Data-centric governance is the only control strategy that scales across generative and agentic AI. The article correctly separates human-paced prompt interactions from machine-paced autonomous execution, which means the policy objective cannot be just tool approval. Practitioners need a data-first model that follows information across models, agents, endpoints, and APIs. The field should expect more overlap between AI governance and NHI governance, not less.

From our research library:

• 28% of secrets incidents now originate outside code repositories, in Slack, Jira, and Confluence, and are 13% more likely to be categorised as critical than code-based leaks, according to the State of Secrets Sprawl 2026.
• Read next: AI Agent Identity Security Buyer's Guide

What this signals

Agentic control-plane drift: the governance model still assumes AI risk sits at the prompt or browser, but autonomous agents now execute at the endpoint with local authority. That mismatch forces security teams to move controls closer to process activity, data lineage, and delegated identity boundaries.

The practical programme effect is that AI security and NHI governance can no longer be separated cleanly. Teams need inventory, ownership, least privilege, and revocation discipline for agents in the same way they already expect for other machine identities, or they will keep missing the control plane where risk actually appears.

For practitioners

• Map agentic systems as non-human identities Inventory every desktop agent, coding assistant, and autonomous workflow that can read files, call APIs, or spawn processes. Assign owners, define scope, and record the systems and datasets each agent can touch.
• Move enforcement to the endpoint layer Add endpoint visibility that can observe process-level behaviour, local file access, clipboard use, and API invocation by agents. Use those signals to detect behaviour that network DLP cannot see.
• Classify agent memory as governed data Treat local context windows, cached prompts, and interaction histories as controlled data stores with retention limits, access restrictions, and review requirements.
• Apply least privilege to agent credentials Limit each agent to the minimum filesystem, API, and application permissions needed for its task, and revoke access when the task or environment changes.
• Extend incident response to agent-specific events Update response playbooks for model tampering, data exfiltration through AI interfaces, unusual inference patterns, and unauthorized agent behaviour on endpoints.

Key takeaways

• AI security fails when organisations keep applying browser and network controls to agents that execute locally with persistent context.
• The article shows that agentic systems change the control boundary from sessions to endpoints and from prompts to delegated runtime authority.
• Security teams need identity governance, endpoint observability, and data-centric controls together if they want to govern AI agents effectively.

Key terms

• Agentic AI: Autonomous AI systems capable of planning, deciding, and taking actions, including calling APIs, writing code, and orchestrating other agents, with minimal human oversight. Agentic AI introduces new NHI risks as agents must authenticate to external services.
• Persistent context: Persistent context is stored reasoning that remains available to a system across multiple executions. Here it means the agent carries prior investigative logic into future pull requests, which improves continuity but also requires governance so obsolete assumptions do not become embedded policy.
• Endpoint Visibility: Endpoint visibility is the ability to observe activity directly on laptops, desktops, and servers so defenders can see malicious behaviour, credential use, and execution in context. In remote work environments, it becomes a primary control because network location alone no longer tells you whether a device is safe.
• Non-Human Identity (NHI): A digital identity assigned to a non-human entity such as a software application, service account, API key, bot, machine, or AI agent that enables it to authenticate and interact with systems without direct human involvement. NHIs now outnumber human identities in most enterprises by 25 to 50 times.

Deepen your knowledge

NHI Foundation Level course, the industry's only accredited NHI security programme, covers NHI governance, machine identity security, and secrets management. It helps security and identity practitioners build the lifecycle discipline that agentic AI governance increasingly depends on.