AI security best practices are failing at the agentic AI edge

At a glance

What this is: This is an independent analysis of AI security best practices, with a clear warning that generative AI controls do not scale to agentic AI or its endpoint-level access patterns.

Why it matters: It matters because practitioners now have to govern AI systems as active data-access actors, not just applications, which changes how identity, access, monitoring, and data controls are designed across AI and broader security programmes.

By the numbers:

• 63% of breached organizations either have no AI governance policy or are still developing one.
• 39.7% of AI interactions involve sensitive data.
• 57% of employees use personal GenAI accounts for, s for work purposes.

👉 Read Cyberhaven's AI security best practices guide for operational control detail

Context

AI security is no longer just about protecting prompts or model outputs. The larger governance problem is that AI systems now touch sensitive data, cloud services, endpoint devices, and third-party APIs in ways that legacy control sets were not designed to model, especially when agentic AI can act at machine speed.

For identity and access teams, the real issue is whether existing IAM, PAM, and data controls can distinguish between a human session, a model interaction, and an autonomous agent performing work. Cyberhaven's article is strongest where it shows that the boundary between AI security and identity governance is already collapsing in operational environments.

Key questions

Q: How should security teams govern employee AI use without blocking productivity?

A: Start with visibility into sanctioned and shadow AI use, then apply runtime policies that inspect intent and context rather than only keywords. The goal is to allow legitimate work while preventing sensitive data from leaving controlled boundaries. Teams usually need ownership, approved models, and enforceable logging before they can scale access safely.

Q: Why do AI agents complicate existing IAM and PAM controls?

A: AI agents complicate IAM and PAM because they often inherit delegated credentials, operate across multiple systems, and keep acting after the initial approval moment has passed. Human session assumptions, periodic reviews, and static privilege models do not reflect that behaviour. The result is a governance gap between what was granted and what the agent can actually do.

Q: What do security teams get wrong about AI-generated code risk?

A: They often focus on catching insecure output after code is written, which is too late for AI-native workflows. The more important control point is the moment the agent is allowed to initiate the action. If that step is not governed, testing becomes a detection layer rather than a prevention layer.

Q: How can organisations tell whether their AI security model is actually working?

A: They should test whether the control stack can explain who acted, what data was touched, and what purpose the action served. If those three signals cannot be correlated in one incident view, the model is likely monitoring access without governing behaviour. That is a visibility gap, not a complete AI security posture.

Technical breakdown

Why generative AI controls break at agentic AI scale

Generative AI is usually mediated by a human, a browser, and a bounded session. That makes it possible to inspect prompts, control inputs, and apply application-layer policy. Agentic AI changes the control plane because the agent can run locally, maintain persistent context, call APIs, read files, and act without waiting for a human to approve each step. Traditional DLP and network inspection miss much of that behaviour because the agent is working at the operating system layer. The security problem is not just more AI usage. It is a different runtime model with different enforcement points.

Practical implication: security teams need endpoint-level observability and policy enforcement that follow the agent, not the browser session.

How data lineage and DSPM support AI security governance

AI systems are data pipelines as much as they are models. Training data, retrieval documents, embeddings, prompts, cached outputs, and interaction histories all become part of the security boundary. Data security posture management helps discover where sensitive data lives, how it moves into AI workflows, and whether controls exist to prevent overexposure. Without data lineage, security teams cannot tell which sources influenced a model response or whether sensitive material crossed into an unsanctioned workflow. That makes incident response, auditability, and regulatory defensibility weaker.

Practical implication: map AI data flows explicitly and extend classification, retention, and access policy into every AI-adjacent store.

Model access management and AI governance risk

Model integrity is only one part of the problem. Who can query a model, which tools it can invoke, and what context it can retain all shape the attack surface. Role-based access controls matter, but they need to be paired with strong authentication, behavioural monitoring, and lineage tracking so security teams can see when use drifts away from approved intent. In practice, many organisations still govern AI as if it were a static application. It is not. The combination of dynamic inputs, continuous updates, and third-party integrations makes AI governance an access problem as much as a model problem.

Practical implication: treat AI platforms, APIs, and agent frameworks as governed access surfaces with audit requirements, not just application inventory items.

Threat narrative

Attacker objective: The attacker objective is to abuse AI-enabled trust and access paths to extract sensitive data or manipulate downstream operations through compromised or overexposed AI workflows.

1. Entry begins when employees adopt unsanctioned GenAI tools or when AI agents are deployed onto endpoints with broad access to files and APIs.
2. Credential or context abuse follows when those systems inherit standing access, cached data, or local privileges that were never scoped for autonomous use.
3. Impact occurs when sensitive information, model inputs, or operational actions escape the intended boundary and create data leakage, compliance exposure, or unintended changes.

NHI Mgmt Group analysis

AI security is now an identity and access problem, not just a model-risk problem. Once AI systems can read files, invoke tools, and persist context, the security question shifts from output quality to who or what is authorised to act. That brings IAM, PAM, and NHI governance into the AI stack whether teams planned for it or not. Practitioners should treat agent permissions, service credentials, and delegation paths as first-class control objects.

Persistent context creates a new governance gap we call context retention risk. AI agents that store searchable local history or cache interaction fragments hold sensitive state longer than most review processes expect. That undermines assumptions behind periodic access review because the risk lives in retained context, not just active entitlement. Practitioners need to govern where context is stored, how long it persists, and who can reuse it.

Data-centric controls are becoming the practical boundary for AI governance. The article is right that blocking AI at the network layer is rarely enough, especially when agents operate locally or through approved enterprise tools. Security teams need controls that follow data into training sets, retrieval stores, embeddings, and endpoint workflows. The implication is clear: data classification, lineage, and access policy now sit at the centre of AI governance.

AI security programmes will increasingly fail where shadow AI meets unmanaged NHI. Unsanctioned tools and autonomous agents both introduce blind spots, but the deeper problem is that each depends on credentials, API access, and delegated authority that traditional inventories do not track well. That creates a governance overlap between AI security and NHI management that many programmes still miss. Practitioners should align AI discovery with identity discovery, not run them as separate exercises.

Framework alignment matters, but only if it maps to real enforcement points. NIST AI RMF, CSA guidance, and related standards are useful, but they do not replace the need to identify which identities, permissions, and data paths are actually in play. The article's strongest practical message is that governance succeeds when standards are translated into concrete control ownership across identity, data, and endpoint teams.

What this signals

Context retention risk: AI programmes now need controls for how long an agent can hold sensitive context, not just what it can query. When persistent local history, cached prompts, and tool outputs accumulate, the programme's real exposure shifts from session control to memory control. Practitioners should align endpoint policy, retention rules, and audit logging so retained AI context remains governable.

The operational signal for security leaders is that AI adoption will increasingly surface as an access governance problem before it looks like a model-risk issue. That is why the most useful references are still identity-first resources such as the Ultimate Guide to NHIs and the NIST SP 800-63 Digital Identity Guidelines, especially where authentication, delegated access, and assurance levels intersect.

For practitioners

• Implement endpoint visibility for AI agents Inventory desktop agents, coding assistants, and local AI processes, then monitor what data they can read, what commands they issue, and which APIs they reach. Use that visibility to distinguish human workflows from machine-executed actions and to flag agent activity that exceeds policy.
• Extend IAM governance to AI tool access Review AI platforms, agent frameworks, and service integrations as governed access paths. Require strong authentication, least privilege, and named ownership for every model, API key, or delegated workflow so access can be revoked without disrupting unrelated work.
• Build data lineage into AI security controls Classify training data, retrieval documents, embeddings, and cached outputs, then trace where each data set enters and exits AI workflows. Tie that lineage to retention, logging, and incident response so teams can reconstruct exposure paths after misuse or leakage.
• Treat shadow AI discovery as identity discovery Discover unsanctioned AI tools at the same time as service accounts, tokens, and third-party integrations. The aim is to identify where AI usage depends on unmanaged credentials or excessive delegated access before those paths become a persistent attack surface.

Key takeaways

• AI security fails when teams govern models but ignore the identities and access paths behind them.
• Agentic AI introduces persistent context, OS-level access, and delegated authority that traditional controls do not fully cover.
• Practitioners should connect AI discovery, data lineage, and identity governance before agent adoption expands further.

Key terms

• Agentic AI: Autonomous AI systems capable of planning, deciding, and taking actions — including calling APIs, writing code, and orchestrating other agents — with minimal human oversight. Agentic AI introduces new NHI risks as agents must authenticate to external services.
• Data Security Posture Management: Data Security Posture Management, or DSPM, is the continuous discovery and monitoring of where sensitive data lives, how it is exposed, and where policy gaps exist. Its value rises when it feeds remediation rather than generating findings alone, especially in environments where AI expands the number of data paths.
• Shadow AI: AI agents, copilots, or connected tools operating without full visibility or governance from security teams. Shadow AI becomes an identity problem when those systems authenticate with unmanaged tokens, service accounts, or OAuth apps that can reach production resources.
• Data Lineage: The record of how data moves across systems, applications, and workflows. In security operations, lineage shows where sensitive data propagates, which identities touch it, and how a compromise could spread across connected environments.

What's in the full article

Cyberhaven's full guide covers the operational detail this post intentionally leaves for the source:

• Step-by-step control mapping for securing generative AI and agentic AI across cloud and endpoint environments.
• Specific examples of AI security controls for DSPM, DLP, model access management, and incident response.
• The article's practical distinctions between browser-bounded tools and OS-level agents, including how to detect each.
• Source-linked benchmarks and implementation framing that help teams translate policy into deployment decisions.

👉 Cyberhaven's full guide covers AI control distinctions, deployment risks, and the implementation checklist in detail.

Deepen your knowledge

The NHI Foundation Level course, the industry's only accredited NHI security programme, covers NHI governance, machine identity security, and secrets management. It helps practitioners build the control thinking needed to govern AI-linked identities and access paths.