Anthropic Claude’s expanding agent surface changes identity governance

At a glance

What this is: Claude’s agent ecosystem has expanded from developer-only use to employee desktops, mobile-triggered tasks and managed agents, creating a broader identity and governance problem around tool access and data handling.

Why it matters: IAM, NHI and security teams need to treat AI agents and their connectors as governed identities because runtime permissions, approvals and auditability now determine exposure across human workflows and autonomous execution.

By the numbers:

• 53% of MCP servers expose credentials through hard-coded values in configuration files.

👉 Read Noma Security's analysis of Claude agent governance and runtime risk

Context

Claude agent usage is no longer confined to a narrow developer workflow. The article describes a shift from Claude Code on engineering machines to desktop access for business users, phone-triggered task initiation, and managed agents that operate continuously with their own permissions. For identity teams, that means the question is not whether AI is present, but which identities, connectors and tools are now acting on behalf of the organisation.

The governance gap is straightforward: existing IAM and NHI controls were built around stable subjects, predictable approval points and review cycles that assume access persists long enough to be inspected. Here, the access path moves across human users, non-human connectors and autonomous execution within one operating surface, which makes inventory, policy enforcement and auditability the real control plane.

Key questions

Q: How should teams govern AI agents that use MCP?

A: Treat each connected agent as a non-human identity with an owner, a scope, and a review cycle. The practical control set is familiar: least privilege, secret rotation, access expiration, and auditability across the systems the agent can reach.

Q: Why do AI agents complicate access governance more than ordinary automation?

A: AI agents complicate access governance because they can branch at runtime, wait on external services, and continue later with the same operational context. That means privilege is not just granted at launch, it persists across a live session that must be observable, resumable, and attributable.

Q: What breaks when remote task triggers are allowed for AI agents?

A: The problem is not the trigger alone, but the thinning of the approval chain. A mobile start action can set off work that executes unattended on another device, which makes it harder to tie the action to a clear operator, a fixed context and a reviewable decision point. Containment depends on pre-execution policy.

Q: What should security teams do before deploying managed agents?

A: Assign each managed agent an owner, a purpose and a narrow permission set before it goes live. Then verify the task flow, the downstream systems it can reach and the data it can touch. If a background agent can act continuously without a bounded scope, it should be treated as an identity risk, not a feature.

Technical breakdown

MCP servers as delegated tool access

Model Context Protocol servers act as the bridge between Claude and external tools, data sources and services. In practice, they are delegated access points, because the agent inherits whatever permissions the server exposes and can act through them without separate human intervention for each step. That makes the MCP layer an identity and trust boundary, not just an integration pattern. If a server is installed by an individual employee, pulled from an unvetted source, or granted broader permissions than the use case requires, the agent can inherit excessive reach instantly. Governance therefore has to treat MCP enrolment, approval and scope as part of identity control, not application plumbing.

Practical implication: inventory every MCP server, classify its permissions and block unapproved connections before agent execution begins.

How desktop AI changes the access model

Desktop AI environments such as Cowork move the agent into the end-user workstation and give it direct access to files, folders, web pages and enterprise connectors. The technical shift is that task execution is no longer a single prompt-response exchange. The agent can browse, transform, fill forms and move data across systems in sequence, which creates a longer attack path and a wider opportunity for prompt injection or data leakage. Because the user may only see the initial task request, the real security issue is invisible mid-task behaviour. That makes telemetry, session capture and policy enforcement essential to understand what the agent actually touched.

Practical implication: instrument desktop AI sessions end to end so file operations, connector use and web actions remain auditable.

Remote task triggering and managed agents widen blast radius

Dispatch and managed agents change the timing model of agent governance. Dispatch lets a user start work from a mobile device while the task executes on the desktop, and managed agents run continuously in the background with their own permissions. Both patterns reduce the value of point-in-time approval because the trigger, execution and outcome are no longer co-located with a human operator. That makes the identity of the initiator, the scope of the task and the runtime context all part of the control problem. When agents can act unattended, the governance question becomes whether policy is enforced before action, not after the session ends.

Practical implication: tie each initiated task to the originating identity and enforce policy before runtime tool access is granted.

Threat narrative

Attacker objective: The objective is to steer a legitimate agent into revealing data, carrying out unauthorised actions or expanding access beyond the approved task.

1. Entry occurs when an employee installs Claude Code, Cowork or a connected MCP server and grants it access to files, tools or enterprise systems.
2. Escalation follows when the agent inherits broader tool permissions than the task actually needs, allowing untrusted content or hidden instructions to redirect its behaviour.
3. Impact occurs when the agent exfiltrates data, executes unintended commands or mutates records across connected systems at a scale the operator did not anticipate.

Breaches seen in the wild

• Meta AI Instagram Account Takeover — 20,225 Instagram accounts hijacked via compromised Meta AI support chatbot with overprivileged access.
• Replit AI Tool Database Deletion — Replit vibe coding AI assistant deletes live production database and creates 4,000 fake user records.

Read our 52 NHI Breaches Analysis report for a comprehensive view of breaches impacting Non-Human Identities including AI Agents.

NHI Mgmt Group analysis

Claude’s expansion from developer tool to enterprise workforce utility turns agent governance into an identity programme problem. Once non-technical employees can launch workflows, every approval, connector and data path becomes part of access governance rather than productivity enablement. The control question is no longer who can use the tool, but which identities can delegate actions to it and under what scope. That is a classic IAM boundary shift, and practitioners should treat it as one.

Unapproved connector access is the new shadow NHI pattern in agentic environments. The article shows that users can add connectors and MCP servers faster than security teams can review them, which creates invisible delegated access paths. That pattern fits OWASP-NHI because the real risk is not the agent itself, but the credentials, permissions and external services attached to it. Teams should expect connector sprawl to become the first place governance breaks.

Identity does not select or combine tools dynamically mid-session was designed for systems that execute within predefined approval boundaries. That assumption fails when an agent can browse, fetch, transform and act across multiple tools in one runtime session without human gating. The implication is that least privilege cannot be reasoned about only at provisioning time, because the effective privilege set emerges during execution.

Session traceability is now a control requirement, not a forensic luxury. Noma’s emphasis on full interaction timelines reflects a deeper governance truth: once agent behaviour crosses prompts, tools and downstream impact, there must be a durable record tying each action to a user, task and environment. For security leaders, that is what separates auditable AI use from ungoverned automation.

Managed agents collapse the old distinction between endpoint risk and cloud risk. Endpoint AI, desktop AI and cloud-hosted managed agents now sit on a continuum of delegated identity. A policy model that treats them as separate silos will miss the common failure mode: access outlives the human trigger and persists in the machine execution layer. Practitioners should redesign governance around actor type and runtime context, not deployment location.

From our research:

• 98% of companies plan to deploy even more AI agents within the next 12 months, despite documented rogue behaviour in 80% of current deployments, according to AI Agents: The New Attack Surface report.
• Our research also found that only 52% of companies can track and audit the data their AI agents access, leaving 48% with a complete blind spot for compliance and breach investigation.
• For a deeper governance lens, see OWASP Agentic Applications Top 10 for the control patterns that map to agent behaviour.

What this signals

Identity blast radius: once employees can spawn, trigger and extend AI workflows across desktop, mobile and cloud surfaces, the governance unit becomes the session, not the user. Teams that still rely on annual access reviews will miss the shortest and most dangerous privilege windows, especially where connector permissions change faster than recertification cycles.

With 33% of organisations already reporting AI agents accessing inappropriate or sensitive data beyond intended scope, the operational signal is clear: policy enforcement must move upstream into the moment of connection and task initiation. That is the point where runtime controls and identity context have to meet, or the agent will outrun the review process.

The practical shift is to align AI governance with controls such as the OWASP Top 10 for Agentic Applications 2026 and the NIST AI Risk Management Framework, because the same session can now span prompt injection, delegated tool use and downstream action. Security leaders should plan for governance that follows the agent’s runtime path instead of the organisational chart.

For practitioners

• Inventory every Claude-connected identity path Map Claude Chat, Claude Code, desktop AI, Dispatch and managed agents to the identities, connectors and data sources they can reach. Require the inventory to include MCP servers, skills and any external service linked by employees or teams.
• Approve MCP servers before connection time Treat each MCP server as a delegated access point. Define which servers are approved, which require review and which are blocked, then enforce that policy at runtime so unapproved connections cannot pass data.
• Instrument full agent session telemetry Capture prompts, model responses, tool calls, file operations and downstream impacts in a single session timeline. Use that record to separate benign automation from policy violations and to support investigation when behaviour drifts.
• Rework AI governance around actor type Build separate control expectations for human-triggered use, non-human connectors and autonomous managed agents. The same approval process should not be reused unchanged for a desktop assistant, a remote dispatch flow and a background agent.

Key takeaways

• Claude’s expansion into desktops, phones and background agents turns AI from a point solution into an identity-governance problem.
• The main failure mode is delegated access that outgrows review processes, especially through MCP servers and unapproved connectors.
• Security teams need runtime policy, full session telemetry and actor-specific governance before agent sprawl outpaces control design.

Key terms

• MCP Server: An MCP server is a tool endpoint that connects an AI agent to external systems and data sources through Model Context Protocol. Because it extends what the agent can reach, it becomes part of the identity and access surface and must be reviewed like any other privileged connector.
• Agentic workflow: An agentic workflow is a sequence of tasks executed by an AI agent with some level of tool access and decision authority. In security terms, the workflow matters because it can span multiple systems, identities, and permissions, which makes attribution and revocation harder than with ordinary automation.
• Session-level telemetry: Security data captured from inside the browser session, such as logins, clipboard events, file transfers, extension changes, and OAuth consents. It is more useful than alert-only reporting because it preserves the context needed to explain how identity and data risks developed.
• Shadow AI: AI agents, copilots, or connected tools operating without full visibility or governance from security teams. Shadow AI becomes an identity problem when those systems authenticate with unmanaged tokens, service accounts, or OAuth apps that can reach production resources.

What's in the full article

Noma Security's full research covers the operational detail this post intentionally leaves for the source:

• Per-product coverage of Claude Chat, Claude Code, Cowork, Dispatch and managed agents across the Claude ecosystem
• Detection and response workflow detail for AI-DR profiles, including prompt injection, tool poisoning and sensitive data leakage
• Implementation specifics for AI-SPM discovery through MDM, local configuration files and endpoint telemetry
• Gateway integration details for Kong, Apigee, Azure, Portkey and LiteLLM deployments

👉 The full Noma Security post covers Claude coverage, MCP governance and session-level detection detail

Deepen your knowledge

NHI governance, agentic AI identity, and machine identity lifecycle are core topics in our NHI Foundation Level course, the industry's only accredited NHI security programme. If you are building or maturing an IAM programme, it is worth exploring.