Behavioral baselines fail to detect AI agent intent drift

At a glance

What this is: This is an analysis of why behavioral baselines fail to detect AI agent intent drift in ephemeral Kubernetes workloads.

Why it matters: It matters because IAM, NHI, and AI security teams need detection models that can follow dynamic agent behaviour without mistaking deployment churn for trust.

By the numbers:

• Only 5.7% of organisations have full visibility into their service accounts.
• 80% of identity breaches involved compromised non-human identities such as service accounts and API keys.
• 91.6% of secrets remain valid five days after the targeted organisation is notified, showing a critical gap in remediation procedures.

👉 Read ARMO's analysis of detecting intent drift in AI agents with runtime data

Context

AI agent detection fails when the system assumes identities, behaviours, and network paths stay stable long enough to learn a baseline. In Kubernetes, those assumptions collapse because pods are short-lived, model versions change quickly, and agent actions vary by prompt and tool chain. The result is not simply more noise, but a structural blind spot that lets malicious action blend into routine deployment churn.

For identity and access teams, the important question is not whether an agent is using tools, but whether the runtime security model can keep up with transient non-human identities. That makes this an NHI governance problem as much as a detection problem, because the identity unit often shifts from the pod to the Deployment, ServiceAccount, or workload policy that survives churn.

Key questions

Q: What breaks when behavioural baselines are used for AI agents in Kubernetes?

A: They break because the baseline never stabilises. Pods are short-lived, deployments change quickly, and agent behaviour varies by prompt and tool chain, so the detector stays in learning mode while attacks happen. The control failure is not bad calibration. It is that the environment does not provide the stable identity and time window baselines need.

Q: Why do AI agents make non-human identity governance harder?

A: AI agents make governance harder because they can request tools, act autonomously, and change behaviour across sessions while still relying on machine credentials. That increases the number of access paths security teams must supervise. The result is a stronger need for task-scoped access, explicit ownership, and continuous monitoring of what the agent can reach.

Q: How can security teams tell intent drift from ordinary anomaly noise?

A: By correlating sequences, not scoring single events. Intent drift shows up as a connected path from tool use to data access to external egress, while anomaly detection typically flags each step separately. If the detector cannot combine those steps into one story, it will miss the attack even when every event looks acceptable alone.

Q: Who is accountable when an AI agent makes the wrong change?

A: Accountability sits with the governance chain that approved the access model, not with the agent alone. Teams need a trace from requester to policy decision to identity issuance to action results. If that chain is missing, incident review becomes guesswork and access governance cannot be defended to auditors.

Technical breakdown

Why baseline learning breaks on ephemeral Kubernetes workloads

Behavioral baselines depend on stable entities, repeatable actions, and enough time for observation to converge. Ephemeral Kubernetes workloads break those prerequisites because pods are disposable, autoscaling changes the population continuously, and CI/CD constantly shifts the definition of normal. If the thing being observed is recreated before the model stabilises, the detector stays in learning mode instead of enforcement mode. That is why this class of tooling often produces confidence noise rather than usable threat discrimination.

Practical implication: anchor detection to workload identities and runtime signals that survive pod churn, not to per-pod memory of normal behaviour.

Intent drift is not the same as a behavioral anomaly

A behavioral anomaly is an outlier in a single event. Intent drift is a change in what the agent is trying to achieve, which only becomes visible across a sequence of actions such as tool invocation, data access, and external egress. Individual steps can remain locally normal while the chain is malicious. That is why scoring events in isolation misses the attack, especially when the agent’s actions look plausible one step at a time. The detection problem is therefore correlation across context, not thresholding isolated events.

Practical implication: evaluate controls on whether they correlate action chains across identity, application, and network layers, not on single-event anomaly scores.

Why runtime ground truth beats post-hoc baselines for agent detection

Runtime detection uses kernel, container, Kubernetes, and application context to describe what actually happened, not what a model thinks should happen after a learning window. In this article’s framing, the strongest architecture binds behavioural profiles to durable Kubernetes objects such as Deployments and ServiceAccounts, then correlates events into an attack story. That approach avoids the learning blind spot created by rolling updates and autoscaling. It also aligns better with NHI governance because the identity being managed is the workload and its privileges, not a transient pod.

Practical implication: design monitoring so that enforcement begins immediately at runtime and ties decisions to persistent workload identity objects.

Threat narrative

Attacker objective: The attacker wants the AI agent to carry out data access and exfiltration while remaining hidden inside normal-looking runtime noise.

1. Entry occurs when a crafted prompt alters the agent’s task from benign processing to malicious data retrieval and exfiltration.
2. Escalation happens when the agent uses legitimate tools and access paths to reach sensitive data and external endpoints without tripping single-event thresholds.
3. Impact is the silent loss of sensitive data because the alerting stack treats each step as normal learning-mode behaviour.

NHI Mgmt Group analysis

Behavioral baselines are the wrong control plane for ephemeral AI agents. They assume stable identity, consistent behaviour, and enough observation time to learn a dependable normal state. Ephemeral Kubernetes workloads violate all three assumptions, which means the tool spends more time learning than protecting. That is a control design failure, not a tuning issue. Practitioners should treat this as evidence that runtime identity and action correlation must replace per-pod normality models.

Intent drift creates a non-human identity governance problem, not just a detection problem. When an AI agent’s objective changes mid-execution, the issue is not merely suspicious behaviour. It is that the workload is acting with delegated identity and privilege in ways that conventional event scoring cannot interpret correctly. This is where NHI governance intersects with AI security: the meaningful control is the ability to bind privilege, execution, and audit to durable workload identity objects.

Action-chain correlation is the right named concept for this category. Action-chain correlation means detecting a malicious sequence by connecting tool use, data access, and egress across layers instead of evaluating each event in isolation. That concept matters because intent drift is only visible in sequence, not in any single alert. Teams should use this lens when deciding whether runtime telemetry is sufficient for AI agent oversight.

Deployment-level identity is a more defensible unit of control than pod-level observation. A pod is too transient to anchor security meaningfully when autoscaling and rolling updates are constant. A Deployment or ServiceAccount persists across churn and gives the security stack something stable to govern, monitor, and enforce. For identity teams, this reinforces that workload identity must be the control boundary, not the container instance.

Runtime-first detection is becoming the governance baseline for agentic systems. As AI agents take on more tool use and autonomous sequencing, organisations will need controls that answer what the system did in real time, not what it resembled after a learning period. This shifts the centre of gravity from anomaly thresholds to immediate observability, policy enforcement, and identity-bound telemetry.

What this signals

Action-chain correlation is the programme shift this article points to: teams should stop treating alert volume as the core problem and start treating sequence visibility as the control objective. That changes how telemetry is designed, how detections are tuned, and how incidents are triaged when agents operate across prompt, tool, and network layers.

The identity consequence is equally clear. When non-human identities are ephemeral but their privileges persist, the governance gap moves from authentication to runtime authorisation and audit. Teams should align that work with the NHI Lifecycle Management Guide and the Ultimate Guide to NHIs so the workload identity model matches the actual operating model.

For AI-specific threat modelling, map these controls to the OWASP Top 10 for Agentic Applications 2026 and the NIST AI Risk Management Framework. The practical signal is simple: if your detection stack still depends on a learning period, it is not ready for autonomous or semi-autonomous workloads.

For practitioners

• Bind detection to durable workload identities Attach behavioural profiles and policy decisions to Deployments and ServiceAccounts so that pod recycling does not reset security state.
• Measure action chains, not isolated events Correlate tool invocation, sensitive data access, and outbound egress into one investigation path so intent drift is visible even when each step looks normal.
• Eliminate learning windows in production Treat any detector that depends on a long observation phase as unsuitable for ephemeral agent workloads and move to immediate runtime enforcement instead.
• Map AI agent privileges to NHI controls Review which ServiceAccounts, API credentials, and external tool permissions an agent can reach, then constrain them to the smallest durable scope possible.
• Validate investigation output before rollout Require an attack-story output that combines kernel, container, Kubernetes, and application context before you allow an AI agent detector into production.

Key takeaways

• Behavioral baselines fail here because ephemeral AI agents erase the stability they need to learn a trustworthy normal state.
• The meaningful detection problem is intent drift across action chains, not isolated event outliers or alert thresholds.
• Identity teams should anchor governance to durable workload objects and runtime correlation, not to transient pod behaviour.

Key terms

• Intent Drift: A mismatch between the original purpose of an agent session and the outcome produced by a later chain of actions. It matters because each step can be individually permitted while the overall behaviour still becomes unsafe or non-compliant.
• Behavior Baseline: A record of normal activity for a non-human identity, including typical consumers, resources, and actions over time. Baselines help security teams detect when an identity is being used in an unusual way and provide the context needed to enforce least privilege safely in dynamic environments.
• Action-Chain Correlation: The practice of linking separate runtime events into one sequence that reveals intent or attack progression. It matters when no single event is clearly malicious, but the combined path from tool invocation to sensitive access to egress shows compromise.
• Runtime Detection: Runtime detection is the practice of monitoring behaviour while a system is operating so suspicious actions can be flagged or contained. It is useful for visibility, but it does not replace preventive identity controls because it reacts after the access path has already been used.

What's in the full article

ARMO's full blog covers the operational detail this post intentionally leaves for the source:

• The pod-level and Deployment-level behavioural modelling approach used to survive Kubernetes churn
• The runtime story-generation workflow that correlates kernel, container, Kubernetes, and application signals
• The learning-period failure modes observed in rolling deployments, autoscaling, and canary releases
• The performance and deployment considerations for running eBPF-based runtime detection in production

👉 The full ARMO post covers runtime correlation, pod churn failure modes, and the attack-story workflow in more detail.

Deepen your knowledge

The NHI Foundation Level course, the industry's only accredited NHI security programme, covers NHI governance, workload identity, secrets management, and identity lifecycle controls. It is designed for practitioners who need to connect identity control to real operational risk across modern environments.