AI security risks in 2025 expose identity and data control gaps

At a glance

What this is: This analysis argues that the main AI security risks in 2025 come from dynamic model behaviour, poisoned data, prompt injection, and weak identity controls around AI agents and APIs.

Why it matters: For IAM, NHI, and security teams, the key issue is that AI systems now behave like high-privilege non-human actors, so access governance, authentication, and monitoring must extend into AI runtime and pipeline controls.

By the numbers:

• 92% agree governing AI agents is critical to enterprise security, yet only 44% have implemented any policies to do so.
• 80% of organisations report their AI agents have already performed actions beyond their intended scope, including accessing unauthorised systems, sharing sensitive data, and revealing access credentials.
• When AWS credentials are exposed publicly, attackers attempt access within an average of 17 minutes, and as quickly as 9 minutes in some cases.

👉 Read Obsidian Security's analysis of the top AI security risks facing enterprises in 2025

Context

AI security risks are no longer confined to model accuracy or abstract future scenarios. In practice, they now cover access governance, data exposure, and attack paths that exploit the way AI systems learn, ingest data, and interact with tools, which makes identity and privilege management part of the AI security problem.

The article frames AI systems as dynamic attack surfaces rather than static software. That matters for enterprise security because AI agents, APIs, and training pipelines can be compromised through the same governance gaps that affect NHI, especially when authentication, monitoring, and least privilege are not applied consistently.

Key questions

Q: How should security teams govern AI agents that can access enterprise systems?

A: Security teams should govern AI agents as non-human identities with explicit ownership, scoped privileges, and continuous monitoring. The control set should include inventory, task-bound credentials, audit trails, and revocation paths. If an agent can call tools or touch production systems, it belongs in the same governance model as service accounts and other machine identities.

Q: Why do AI agents create more risk than traditional automation?

A: AI agents create more risk because they can interpret context, choose actions, and invoke tools autonomously. Traditional automation follows fixed rules, but an agent can be manipulated into using its own authority in unintended ways. That makes permission scope, tool boundaries, and monitoring more important than model accuracy alone.

Q: What breaks when training data is poisoned before model deployment?

A: The model learns altered patterns as if they were legitimate, so the compromise becomes part of normal behaviour. That can produce targeted misclassification, broad accuracy loss, or stealthy behaviour changes that survive validation and only surface after deployment. The core failure is not just bad output. It is loss of trust in the learning pipeline.

Q: Who is accountable when an AI system makes a harmful decision?

A: Accountability should follow the identity chain that authorized, configured, or triggered the action, including the human owner, the platform team, and any delegated agent or tool account. If the organisation cannot name that chain, the governance model is too weak for regulated AI use.

Technical breakdown

Adversarial machine learning and model manipulation

Adversarial machine learning uses carefully crafted inputs to make a model produce the wrong output while appearing normal to a human reviewer. The attack works because neural networks respond to patterns in ways that can be nudged by small perturbations, and those perturbations can be optimised mathematically to increase prediction error. In enterprise settings, this affects fraud detection, vision systems, and natural language systems that make operational decisions. The important point is that the model may still look healthy from a basic uptime perspective while silently making poor decisions.

Practical implication: defenders need behavioural and output-level validation, not just infrastructure monitoring, for any model that influences business decisions.

Data poisoning in AI training pipelines

Data poisoning is the insertion of malicious or misleading samples into training data so that the model learns the attacker’s intended behaviour. This is especially dangerous in continuous learning and federated setups because corrupted inputs can become part of the model’s future baseline. Unlike a simple runtime exploit, poisoning can survive deployment, testing, and even some retraining cycles. The governance challenge is integrity across the full pipeline, from ingestion to preprocessing, versioning, and release, because every stage can alter what the model learns.

Practical implication: teams should verify data lineage, sign model artefacts, and treat training datasets as governed security assets.

Prompt injection and weak AI agent identity controls

Prompt injection manipulates an LLM or agent by embedding instructions inside user content, documents, or web pages that the system processes. When the model is connected to tools, the risk expands from bad text output to action execution, data retrieval, and credential exposure. The identity problem is that many AI agents operate with persistent or overbroad permissions even when the prompt source is untrusted. That turns the agent into a high-risk NHI unless access is tightly scoped, continuously verified, and separated from sensitive workflows.

Practical implication: enforce least privilege and continuous verification on every AI agent that can call tools or access enterprise data.

Threat narrative

Attacker objective: The attacker wants to corrupt AI behaviour or use AI access paths to extract data, trigger unauthorized actions, or widen compromise into connected enterprise systems.

1. Entry occurs through adversarial inputs, poisoned training data, exposed integrations, or prompt injection delivered through content the AI system trusts.
2. Escalation follows when the AI model or agent is induced to reveal sensitive data, bypass guardrails, or invoke tools with excessive privilege.
3. Impact occurs when compromised AI behaviour leads to data theft, bad business decisions, credential exposure, or downstream compromise of connected systems.

NHI Mgmt Group analysis

AI security is now an identity governance problem as much as a model risk problem. The article correctly shows that the most dangerous AI failures are not limited to adversarial inputs. They also arise when agents, APIs, and pipelines operate with weak authentication, overbroad permissions, or unclear ownership. That puts AI systems squarely into NHI governance territory because their runtime access must be managed like any other high-risk non-human identity.

Prompt injection becomes materially more dangerous when the AI system can act. A text-only model can be misleading, but an agent with tool access can cross the line into unauthorized data retrieval or action execution. That is why the control gap is not just input filtering. It is the absence of tight authorization boundaries, session-scoped permissions, and monitoring around agent-to-tool delegation. Practitioners should treat every tool-enabled agent as a privileged execution path.

Data integrity is the hidden control plane behind AI trust. The article’s emphasis on poisoning and pipeline compromise reflects a broader pattern. If training and inference data are not governed, the model cannot be trusted no matter how accurate it appears in testing. AI governance debt: this is the accumulation of unowned datasets, unverified models, and undefined accountability across the lifecycle, and it will keep surfacing as operational risk until data lineage and release controls are enforced.

Traditional security stacks are necessary but not sufficient for AI systems. Static tooling does not see model drift, poisoned corpora, or delegated agent actions well enough to control risk. The market is moving toward specialised AI security posture management because enterprises need continuous visibility into behaviour, data access, and identity use. For security leaders, the immediate question is not whether AI is risky. It is whether governance can keep pace with the access these systems already have.

Identity-first AI security is becoming the practical baseline for enterprise adoption. The article’s zero-trust recommendations align with the reality that AI systems often sit between users, data, and tools. If those systems cannot be authenticated, scoped, and monitored as high-value identities, they become invisible escalation paths. Practitioners should assume that AI adoption without identity governance will increase blast radius faster than it increases productivity.

What this signals

AI governance debt is the operational reality most security teams are carrying into 2026. The gap is no longer whether AI systems are useful, but whether their access paths, data use, and delegated actions are visible enough to control before they become persistent risk.

Enterprises should expect AI security to converge with NHI governance, especially where agents call tools or touch sensitive data. The next control gap will be less about model quality and more about whether identity, privilege, and telemetry are enforced consistently across AI workflows.

The practical signal for programmes is simple: if you cannot inventory an AI system, define its permissions, and audit its actions, you do not yet have AI governance. That is the same maturity test identity teams have faced for years, now applied to machine actors.

For practitioners

• Implement identity controls for AI agents Inventory every AI agent, assistant, and automated workflow that can authenticate to enterprise systems, then assign each one an owner, scope, and expiry policy. Treat these entities as governed non-human identities, not just application features.
• Harden training and inference data pipelines Require data provenance checks, dataset versioning, and artifact signing across ingestion, training, validation, and deployment. If a model depends on external or continuously updated data, restrict who can modify that feed and log each change for review.
• Constrain tool-enabled agent actions Apply least privilege to every AI agent that can call APIs, query databases, or trigger workflows, and segment those permissions from human admin access. Use session-scoped credentials where possible so the agent cannot reuse broad access beyond the task.
• Build detection for abnormal model behaviour Monitor for unusual output patterns, unexpected data access, and sudden changes in tool usage across AI systems. Combine security telemetry with model telemetry so teams can distinguish drift from compromise and escalate only real anomalies.

Key takeaways

• AI security risks are becoming governance failures when agents, data, and tools are connected without identity controls.
• The scale problem is visible in the gap between stated concern and implemented policy, which leaves most AI access paths only partially governed.
• Security teams should treat AI agents as privileged non-human identities and apply lifecycle, telemetry, and least-privilege controls before adoption expands further.

Key terms

• AI Security Posture Management: A governance approach for discovering and tracking AI assets such as models, agents, datasets, vector stores, and related infrastructure. It becomes useful only when inventory is connected to runtime exposure and the identity that can actually reach the data.
• Adversarial Machine Learning: Adversarial machine learning is the deliberate manipulation of inputs, training data, or feedback so an AI model behaves in an attacker-chosen way. The issue is not broken infrastructure. It is that the model can remain functional while its decisions become unreliable, unsafe, or biased.
• Prompt Injection (Agentic): An attack where malicious instructions are embedded in content that an AI agent reads — causing the agent to execute unintended actions using its own legitimate credentials. A primary vector for agent goal hijacking and identity abuse.
• AI Agent Identity: The digital identity used by an autonomous AI agent to authenticate to external systems, APIs, and services. Managing AI agent identities is an emerging and rapidly evolving area of NHI security.

What's in the full article

Obsidian Security's full blog post covers the operational detail this post intentionally leaves for the source:

• Attack-by-attack breakdown of adversarial machine learning, data poisoning, and prompt injection
• Implementation blueprint for AI Security Posture Management across discovery, control, and monitoring
• Practical zero-trust guidance for AI agent access, including MFA, microsegmentation, and least privilege
• Examples of ROI and resilience metrics tied to AI security investment

👉 The full Obsidian Security post covers AI attack patterns, mitigation phases, and implementation guidance in more detail.

Deepen your knowledge

The NHI Foundation Level course, the industry's only accredited NHI security programme, covers NHI governance, machine identity security, and secrets management. It gives security and identity practitioners a practical foundation for governing AI agents and other non-human identities.