AI security in 2025: agents, compliance and model consolidation

At a glance

What this is: This is a 2025 retrospective on AI security that argues the centre of gravity has shifted from prompts and outputs to agent actions, retrieval controls, compliance, and model consolidation.

Why it matters: It matters because IAM, PAM, and AI governance teams now have to treat AI systems as runtime actors with scoped access and auditable behaviour, not just content generators.

Context

2025 AI security moved from monitoring prompts to governing actions, because AI agents began coordinating tools and data sources instead of only generating text. That shift matters for identity governance because the risk surface now includes runtime access, delegated execution, and retrieval paths, not just model output.

The article frames this as a year of measured progress in which compliance frameworks solidified, RAG security became formalised, and the market consolidated around a smaller set of frontier models. For IAM and NHI programmes, the central question is no longer whether AI can assist, but which identities, permissions, and audit trails it uses while acting.

Key questions

Q: How should security teams govern AI workflows that use multiple tools and data sources?

A: Security teams should govern AI workflows by placing explicit authorization at each decision point, not by relying on the permissions attached to the surrounding application or service account. The practical goal is to scope read, retrieve, and execute access separately so the workflow cannot inherit broader reach than it needs for the task.

Q: When does RAG create more security risk than benefit?

A: RAG becomes riskier when retrieval sources are unvetted, embeddings are mutable without control, or the system can reach sensitive repositories too broadly. In that state, the model may look accurate while its context is manipulated, overexposed, or untraceable.

Q: What are the signs that AI governance is still stuck at the prompt level?

A: The signs are narrow prompt logging, no visibility into tool calls, no permissions model for retrieval sources, and no audit trail for agent actions. If teams can describe outputs but cannot reconstruct the actions behind them, governance is incomplete.

Q: What should organisations prioritise first: model controls or compliance frameworks?

A: They should do both, but compliance frameworks should define the evidence, ownership, and approval structure while model controls enforce runtime behaviour. Without that alignment, organisations end up with technical safeguards that cannot satisfy audit, accountability, or incident reporting needs.

Technical breakdown

Agentic AI changes the identity model from output control to action control

Agentic AI systems do more than generate responses. They select tools, pull from multiple data sources, and execute tasks across applications, which means the security boundary moves from the model prompt to the runtime chain of actions. The article’s mention of MCP and orchestration APIs is important because those layers standardise how agents call external systems, making access scope and transaction logging part of the control surface. For identity teams, this is closer to governing a non-human operator than a chatbot.

Practical implication: govern agent permissions, tool access, and execution logging as first-class identity controls.

RAG security is an access control problem as much as a model problem

Retrieval-augmented generation reduces hallucination risk by grounding model outputs in external knowledge bases, but it also creates a new path for corpus poisoning, embedding manipulation, and retrieval hijacking. That makes RAG security a compound issue: the model may behave correctly while the retrieval layer exposes manipulated or over-broad content. The article’s emphasis on encryption, granular access control, and retrieval monitoring shows that the decisive control point is not only the model, but the integrity and permissioning of what it can retrieve.

Practical implication: treat retrieval sources, embeddings, and permissions as governed assets, not passive data inputs.

Compliance is becoming the governance layer for production AI

The article ties AI maturity to auditability, risk classification, and accountability under frameworks such as the EU AI Act and ISO/IEC 42001. That is a meaningful shift because compliance is no longer a documentation exercise after deployment. It is becoming the mechanism that forces organisations to define ownership, evidence, and control expectations before AI systems are allowed into production workflows. For security teams, this narrows the gap between policy intent and runtime behaviour.

Practical implication: align AI governance evidence, incident reporting, and accountability mapping before production rollout.

Threat narrative

Attacker objective: The objective is to abuse AI runtime access and retrieval trust so the system performs harmful or unauthorized actions at scale.

1. Entry occurs when an AI agent is given authenticated access to tools and data sources so it can operate beyond simple prompt-response use cases.
2. Escalation follows when the agent coordinates multiple systems and retrieval layers, expanding its effective scope across business workflows.
3. Impact lands when mis-scoped retrieval or over-permitted actions produce incorrect decisions, exposed data, or unintended downstream execution.

Breaches seen in the wild

• Langflow Flodrix botnet 2025: Attackers used Langflow's unauthenticated code endpoint to dump AI servers' environment variables and enlist them in the Flodrix botnet.
• DeepSeek database exposure 2025: An unauthenticated DeepSeek ClickHouse database exposed over a million log lines with plaintext chat history and API keys in 2025.

Read and download The State of NHI & AI Agent Breach Report 2026, covering 200+ breaches impacting Non-Human Identities including AI Agents.

NHI Mgmt Group analysis

2025 proved that AI security is now an identity problem as much as a model problem. Once agents can coordinate tools and data sources, the governance question shifts from what the model says to what it can do. That means permissions, delegation, and auditability sit inside the security perimeter, not outside it. Practitioners should treat agent runtime access as governed identity.

RAG security is the clearest example of governance moving down the stack. Retrieval hijacking and corpus poisoning show that the model may be intact while the knowledge path is compromised. The control failure is not just bad content, but ungoverned access to the context that shapes decisions. Retrieval trust debt: the longer organisations leave retrieval sources, embeddings, and policy enforcement unreviewed, the more they accumulate hidden exposure in production AI workflows. Practitioners need to govern retrieval as a security dependency, not a model feature.

Compliance frameworks are now forcing AI into operational accountability. The EU AI Act and ISO/IEC 42001 matter because they convert AI governance from aspiration into evidence-backed process. That pushes organisations toward clearer ownership, audit trails, and risk classification before systems reach broad deployment. For security leaders, compliance is becoming the mechanism that makes AI control measurable.

Market consolidation will push AI security from point fixes toward control planes. As enterprises standardise on fewer frontier models, security teams will need policy enforcement, access governance, and observability that work across model families rather than around one deployment. This raises the value of portable governance patterns and lowers tolerance for one-off controls. Practitioners should expect procurement and architecture reviews to favour integrated control coverage over isolated feature sets.

From our research library:

• AI-related credential leaks surged 81.5% year-over-year in 2025, with the surrounding AI infrastructure leaking 5x faster than core LLM providers, according to the State of Secrets Sprawl 2026.
• Only 23% of IT leaders were very confident in their organisation's ability to manage security and governance for GenAI deployments, according to a 2025 Gartner survey of 360 IT leaders.
• Read next: AI Agent Observability, Audit and Incident Response Guide

What this signals

Retrieval trust debt: once RAG systems are in production, every unreviewed knowledge source, embedding pipeline, and permission path becomes latent security debt. The practical shift is from trusting model responses to governing the context layer that shapes them.

The same governance pattern applies across human IAM, NHI, and autonomous actors: if a system can act, retrieve, and persist decisions, it needs identity-bound controls and audit evidence before scale amplifies the blast radius. That is why action monitoring, not prompt review, is now the more durable security model.

For practitioners

• Define runtime permissions for AI agents Map each agent to the tools, systems, and data sources it can access, and separate read, write, and execution privileges where possible.
• Govern retrieval sources and embeddings Inventory the knowledge bases, vector stores, and policy gates that feed production RAG flows, then review who can modify them and how integrity is checked.
• Add auditable action logs for agent decisions Capture tool calls, retrieval events, and downstream actions so investigators can reconstruct what the system actually did, not just what it generated.
• Align AI rollout with compliance evidence Tie production approvals to documented ownership, risk classification, incident reporting, and control evidence under the applicable governance framework.

Key takeaways

• AI security in 2025 moved beyond prompt monitoring because agents now execute actions through tools and connected data sources.
• RAG security exposed a new trust boundary around retrieval sources, embeddings, and access control, not just model quality.
• Compliance and auditability are becoming operational requirements for production AI, not post-deployment paperwork.

Key terms

• Agentic AI: Autonomous AI systems capable of planning, deciding, and taking actions, including calling APIs, writing code, and orchestrating other agents, with minimal human oversight. Agentic AI introduces new NHI risks as agents must authenticate to external services.
• Retrieval-augmented Generation: Retrieval-augmented generation is a pattern where an AI model pulls external information before generating output. The security challenge is that access rules can weaken when data is chunked, embedded, cached, or reused, so source permissions may not automatically follow the content into the model's context.
• Context-based access control: A policy model that authorizes access using the request’s identity, payload, origin, and intended action together. It is designed for systems where risk changes at runtime, especially AI agents and other NHI workloads that move through multiple tools and data sources.
• Model Context Protocol: Model Context Protocol is an open protocol that lets AI agents connect to tools and data sources. It expands what an agent can reach, so governance has to cover not only the model and its prompts, but also every system that can receive or return agent-driven data.

Deepen your knowledge

NHI governance, agentic AI identity, and machine identity lifecycle are core topics in our NHI Foundation Level course, the industry's only accredited NHI security programme. If you are responsible for identity security strategy or NHI governance in your organisation, it is worth exploring.