TL;DR: AI systems are now connected to MCP, plugins, cloud platforms and multi-agent ecosystems, which expands the attack surface beyond conventional software and makes prompt injection, shadow AI, data poisoning and supply chain abuse harder to contain, according to Akto. Static security models are no longer enough when tools can act, retrieve and expose data at runtime.
At a glance
What this is: Akto’s analysis says 2026 AI security risk is being driven by dynamic, tool-connected systems that outgrow static control models and need runtime governance.
Why it matters: IAM, NHI and AI security teams need to treat agents, tools and connected services as governed identities because runtime permissions and trust boundaries now define the attack surface.
By the numbers:
- 78% of CISOs say AI-driven threats are already having a major impact on their organisations.
Context
AI security now sits at the intersection of model behaviour, runtime access and connected infrastructure. Once assistants and autonomous agents can call tools, query data stores and trigger workflows, traditional controls that assume fixed application logic stop mapping cleanly to the actual risk surface.
The governance gap is not just technical. Security teams must understand who or what is authorised at runtime, how prompts and tool calls are monitored, and where shadow AI or unapproved agents introduce unmanaged access paths. That makes identity, privilege and policy enforcement central to AI security rather than adjacent concerns.
Key questions
Q: What breaks when AI agents rely on static data residency controls?
A: Static controls break because they assume data follows a declared path, while AI agents choose tools, retrieve content, and delegate work at runtime. That creates unplanned processor changes, border crossings, and legal-basis mismatches. The practical failure is not just noncompliance. It is the inability to prove where personal data actually went when regulators ask for evidence.
Q: Why do mobility AI systems increase identity and access risk?
A: Mobility AI systems increase identity and access risk because they connect cloud services, edge devices, vendor support paths, and machine-to-machine control loops. Each connection adds credentials, trust relationships, and potential abuse paths. If those identities are weakly governed, compromise can move from digital access into operational disruption or unsafe physical behaviour.
Q: What do security teams get wrong about Shadow AI?
A: They often treat Shadow AI as an approval problem for software, when it is usually also an identity problem. The hidden risk can be an undocumented token, an over-permissioned service account, or an autonomous agent with unreviewed reach. Inventory the identity layer before you decide the tool is the issue.
Q: What is the difference between prompt injection and normal user input?
A: Normal user input is meant to request a service, while prompt injection is designed to override instructions, steer behaviour or expose hidden context. In AI systems with tool access, that difference matters because the payload can change what the agent does, not just what it says. That makes context isolation and instruction hierarchy essential controls.
Technical breakdown
Why static controls fail for agentic AI systems
Agentic AI systems do not behave like conventional software because they can choose actions, call tools and continue workflows with limited human intervention. That means the security boundary moves from a fixed application layer to a runtime decision layer where prompts, memory, external tools and plugins all influence behaviour. Static allowlists and one-time reviews miss the fact that a model can take a different action on each invocation. The real control problem is governing dynamic authority, not just blocking known bad inputs.
Practical implication: security teams need runtime policy enforcement around agent actions, not just pre-deployment testing.
How prompt injection and tool abuse turn trust into risk
Prompt injection works by placing malicious instructions inside content that the model later treats as relevant context. In connected environments, that can steer a model to reveal data, ignore safety rules or call a tool it should not access. When agents have broad permissions, the attack is no longer limited to bad output. It becomes unauthorised execution through a trusted workflow, which is why identity, authorisation and context isolation matter as much as model safety.
Practical implication: limit tool permissions by task scope and isolate untrusted content from instruction channels.
Why shadow AI and third-party integrations widen the attack surface
Shadow AI appears when employees or teams use AI tools without security oversight, while third-party integrations add external dependencies that can expose data or behaviour. In both cases, the issue is not only model risk but unmanaged access. If a chatbot, assistant or plugin can reach enterprise data, the organisation has introduced a new identity and trust relationship that may never pass through normal review. That is why discovery, governance and access monitoring must cover AI systems as first-class assets.
Practical implication: inventory AI tools, agents and integrations the same way you inventory service accounts and APIs.
Threat narrative
Attacker objective: The attacker’s objective is to turn a trusted AI workflow into an execution path for data exposure, unauthorised actions or broader enterprise compromise.
- Entry occurs when attackers use prompt injection, shadow AI use or malicious content to influence an AI system that is already connected to enterprise tools.
- Credential harvesting or trust abuse follows when the agent accepts the injected context, reuses its authorised access or interacts with linked services on the attacker’s behalf.
- Impact occurs when the agent reveals data, performs unsafe actions or propagates malicious instructions across workflows and downstream systems.
Breaches seen in the wild
- Samsung ChatGPT leak 2023: Samsung staff pasted chip source code and meeting notes into ChatGPT weeks after it was allowed, leading Samsung to restrict generative AI tools.
Read and download The State of NHI & AI Agent Breach Report 2026, covering 200+ breaches impacting Non-Human Identities including AI Agents.
NHI Mgmt Group analysis
Static control models are now structurally misaligned with agentic AI. The problem is not that traditional controls are weak in general, but that they assume stable applications and predictable decision paths. Agentic systems introduce runtime choice, external tools and mutable context, which means control has to move closer to execution time. For identity teams, that makes authorisation, session scope and delegated trust the decisive issues, not periodic review alone.
Agentic AI identity is becoming a governance discipline, not a feature checklist. Once AI systems can act across enterprise apps, the core question becomes what identity they use, what authority they inherit and when that authority expires. That shifts the market from tool-centric security to lifecycle governance for AI agents. Practitioners should treat agent identity as an access management problem with security consequences, not as an abstraction.
Shadow AI and undiscovered agents create the same governance blind spot as unmanaged service accounts. If teams cannot inventory AI tools, prompts, plugins and agent permissions, they cannot enforce policy or investigate misuse. The interesting parallel is with NHI governance: discovery comes before control, and unmanaged runtime access becomes the real risk surface. Practitioners should extend discovery and ownership models to every AI system with tool access.
Runtime trust boundaries will define the next phase of AI security. The decisive issue is not whether an AI model can answer correctly, but whether it can safely interact with data, tools and external services without crossing policy boundaries. This is where AI security, IAM and NHI security converge. Practitioners should assume that any connected AI capability needs continuous monitoring, least privilege and explicit offboarding.
From our research library:
- 67% of organisations still rely heavily on static credentials despite the risks they pose to agentic AI deployments, according to the 2026 Infrastructure Identity Survey.
- Read next: Agentic AI Identity Guide
What this signals
Agentic AI identity will become a control point, not a terminology debate. The more an assistant can call tools, the less useful it is to think of it as just another application. Identity teams will need to define ownership, scope and revocation for non-human actors that can act across systems, because those decisions now determine blast radius.
Agentic AI identity maturity will separate teams that can govern runtime access from teams that cannot. The practical divide is whether organisations can discover, authorise and monitor AI systems before they move data or trigger workflows. That is now a programme design issue, not an AI lab issue.
Static controls will continue to fail where agent permissions are broader than task scope. The organisations that adapt fastest will treat AI agents as governed identities with explicit lifecycle controls, continuous monitoring and offboarding discipline. That is the only way to reduce trust leakage as AI becomes more operational.
For practitioners
- Implement runtime access controls for AI agents Bind each agent to task-scoped permissions, separate instruction inputs from untrusted content, and require policy checks before tool execution.
- Inventory shadow AI and connected tools Discover all AI apps, assistants, plugins and agent workflows that can reach enterprise data, then assign owners and approval paths.
- Constrain third-party AI integrations Review every external model, API, plugin and dataset connection for data exposure, privilege inheritance and hidden execution paths.
- Adopt least privilege for agent and copilot access Remove broad standing access from copilots and agents, and force re-issuance of credentials only for the minimum required action.
Key takeaways
- AI security risk in 2026 is being driven by connected systems that act at runtime, not by isolated models that can be checked once and forgotten.
- Prompt injection, shadow AI and third-party integrations all exploit the same governance gap, which is uncontrolled trust across tools, data and execution paths.
- Practitioners need discovery, least privilege and runtime monitoring for AI agents, because static review processes do not control behaviour that changes while the workflow is running.
Standards & Framework Alignment
This section maps relevant standards and security frameworks to the operational risks and controls described in this guidance.
OWASP Agentic AI Top 10 addresses the attack and risk surface, while NIST AI RMF and NIST CSF 2.0 set the governance and control requirements practitioners need to meet.
| Framework | Control / Reference | Relevance |
|---|---|---|
| OWASP Agentic AI Top 10 | ASI03 — Identity & Privilege Abuse | Agent privilege and delegated tool access are central to the article's risk model. |
| ASI02 — Tool Misuse | Prompt injection and unsafe tool calls are the core attack paths described in the article. | |
| ASI10 — Rogue Agents | Shadow AI and unmonitored agents are a direct match for this threat pattern. | |
| Recommendation — Restrict agent privileges to the minimum task scope and review delegated access at runtime. Gate tool execution with policy checks and log every high-risk agent action. Discover, register and govern every AI agent that can reach enterprise data or workflows. | ||
| NIST AI RMF | MANAGE — Manage AI Risks | The article focuses on runtime controls, monitoring and governance across the AI lifecycle. |
| Recommendation — Operationalise continuous AI risk monitoring and response across deployment and inference. | ||
| NIST CSF 2.0 | PR.AA-05 — Access Permissions, Entitlements and Authorizations | Access permissions and authorisations are the main control gap when agents gain tool access. |
| Recommendation — Apply entitlement controls to AI agents and connected tools before granting production access. | ||
Key terms
- Agentic AI: Autonomous AI systems capable of planning, deciding, and taking actions, including calling APIs, writing code, and orchestrating other agents, with minimal human oversight. Agentic AI introduces new NHI risks as agents must authenticate to external services.
- Shadow AI: AI agents, copilots, or connected tools operating without full visibility or governance from security teams. Shadow AI becomes an identity problem when those systems authenticate with unmanaged tokens, service accounts, or OAuth apps that can reach production resources.
- Prompt Injection (Agentic): An attack where malicious instructions are embedded in content that an AI agent reads, causing the agent to execute unintended actions using its own legitimate credentials. A primary vector for agent goal hijacking and identity abuse.
- Runtime Protection: Runtime protection is a control model that observes application behavior while software is running and blocks unsafe actions as they occur. In Java estates, it helps distinguish active exploit paths from dormant vulnerable code, which is essential when patching is delayed or impossible.
Deepen your knowledge
The NHI Foundation Level course, the industry's only accredited NHI security programme, covers NHI governance, agentic AI identity and secrets management. It helps practitioners connect identity controls to the operational realities of machine-led access and runtime decision-making.
Published by the NHIMG editorial team on August 2, 2026.
Updated on October 12, 2026.
NHI Mgmt Group, the independent authority on Non-Human Identity, IAM, and Agentic AI security. nhimg.org