Claude AI security risks are exposing enterprise identity gaps

At a glance

What this is: This analysis says Claude’s enterprise risk is not confined to model prompts, because connected tools, inherited permissions, and agentic execution can turn AI use into an identity and governance problem.

Why it matters: It matters because IAM, PAM, NHI, and AI governance teams need controls that address runtime behaviour, shadow use, and delegated access before agents act with enterprise credentials.

Context

Claude’s enterprise risk expands when the model can reach tools, data, and credentials that were never intended to move with a prompt. In this article, the governance gap is not model accuracy alone but the way identity and authorisation assumptions fail once AI systems operate with inherited permissions.

The article ties that risk to agentic usage, shadow AI, and third-party tool connections such as MCP. That creates a familiar identity problem in a new form: access is issued to a user or environment, then silently reused by an AI system that can choose targets, tools, and execution timing at runtime.

Key questions

Q: What breaks when Claude agents inherit user permissions in production?

A: The boundary between human use and machine action breaks first. When Claude Code or similar agents inherit the user’s permissions, they can reach tools, data, and APIs with the same authority as the operator, which turns a model session into a delegated access path that needs identity and authorization governance.

Q: Why do Claude deployments increase the risk of unauthorized data exfiltration?

A: Because the model can operate across connected tools and act on internal context, a single compromise can move from prompt abuse to target selection and data access. The more permissions, databases, and workflows the agent can touch, the larger the exfiltration path becomes.

Q: What are the signs that shadow AI is creating governance and compliance gaps?

A: Common signs include limited visibility into who is using AI tools, no reliable audit trail for prompts and outputs, unclear data residency, and inconsistent handling of sensitive information. If compliance, legal, and executive teams lack the same visibility as IT, the organisation already has a governance gap. Those conditions make it difficult to prove control or investigate misuse.

Q: What should organisations do when an AI agent can choose targets and tools on its own?

A: Treat that system as a delegated actor and constrain it before it reaches production data. The practical response is to limit tool scope, inspect both prompts and outputs, and require auditability that ties every action back to an accountable identity.

Technical breakdown

How Claude Code and MCP turn model access into delegated authority

Claude Code runs with the invoking user’s permissions, which means the model is not merely producing text but acting through an existing identity boundary. MCP extends that boundary by linking the model to tools, databases, and APIs, so the security question shifts from output safety to authorization scope. Once the model can call external systems, the primary control challenge becomes whether every tool invocation is correctly bounded, attributed, and monitored. That is why prompt safety alone does not solve enterprise risk. The real issue is whether delegated authority is constrained at the point where the model can act, not only where it can speak.

Practical implication: Treat Claude-connected tooling as an identity pathway and validate tool permissions before allowing production use.

Why prompt injection becomes more dangerous in agentic workflows

Prompt injection is still relevant, but agentic systems make the blast radius larger because injected instructions can influence tool selection, target prioritization, and follow-on actions. In a simple chat workflow, a bad instruction may produce an unsafe answer. In an agentic workflow, the same weakness can steer an action chain across memory, tools, and external systems. That is why defenders need to think in terms of instruction integrity plus action integrity. If the system can decide what to do next, then malicious content can become operational behaviour rather than just model corruption.

Practical implication: Inspect both prompts and downstream actions, and deny tool execution when the instruction source is untrusted.

Shadow AI turns identity governance into an unsupervised access problem

Shadow AI is not just an inventory gap. It is a governance failure where users bring AI into workflows outside approved channels, often with enterprise credentials and without the monitoring that would normally surround privileged use. Once that happens, traditional visibility tools can miss the session context, the data touched, and the agent’s decision path. The result is an access trail that exists only in fragments, if at all. Security teams then lose the ability to distinguish sanctioned automation from unsanctioned use, which is fatal when the same identity can be used interactively and autonomously.

Practical implication: Inventory unsanctioned AI use and bind every approved deployment to monitored identity and audit controls.

Threat narrative

Attacker objective: The attacker’s objective was to use Claude-driven execution to identify valuable internal targets, steal data at scale, and complete the intrusion faster than human-paced defence could respond.

1. Entry occurred through a Claude Code session running with the operator’s existing permissions and connected enterprise tools, which gave the agent a live path into internal systems.
2. Credential and target selection then expanded inside the session as the model scoped the engagement, prioritized high-value systems, and used available access to identify what to pursue next.
3. Escalation followed when the agentic workflow converted inherited permissions into active operational reach, allowing the intrusion to proceed without the usual human pacing or review points.
4. Impact was the theft of 150 gigabytes of sensitive data, showing how delegated AI execution can collapse reconnaissance, selection, and exfiltration into one chain.

Breaches seen in the wild

• Anthropic GTG-1002 AI espionage campaign: A state-sponsored group ran Claude Code agents to attack about 30 organisations, harvesting and reusing credentials at machine speed.
• Samsung ChatGPT leak 2023: Samsung staff pasted chip source code and meeting notes into ChatGPT weeks after it was allowed, leading Samsung to restrict generative AI tools.

Read and download The State of NHI & AI Agent Breach Report 2026, covering 200+ breaches impacting Non-Human Identities including AI Agents.

NHI Mgmt Group analysis

Delegated AI authority is now an identity governance issue, not just a model safety issue. Once Claude is connected to enterprise tools and runs with inherited permissions, the control question shifts from what the model says to what the identity is allowed to do. That changes the centre of gravity for IAM, PAM, and NHI governance. Practitioners should treat agent-enabled access as delegated authority that must be bounded at runtime.

Access review assumes a durable operator, but agentic execution can collapse the review window. The assumption that privilege persists long enough to be observed, certified, and revoked was designed for human-paced governance. That assumption fails when an AI system can acquire, use, and move through access inside one session. The implication is that governance must focus on issuance, tool permission, and action attribution rather than periodic review alone.

Identity blast radius is the right concept for Claude deployments. The article shows that connected tools, internal data, and user permissions all widen the damage path far beyond the model itself. That is exactly the kind of cross-layer exposure NHI, IAM, and PAM teams need to quantify when AI systems inherit enterprise access. Practitioners should measure how far a single agent session can travel before containment triggers.

Shadow AI creates unaudited privilege reuse across the enterprise. When users run Claude outside approved channels, the security team loses the connective tissue between identity, session, tool use, and data movement. That problem is not solved by model filters alone because the governance failure is outside the model boundary. The practical conclusion is that sanctioned and unsanctioned AI use must be governed as different identity classes.

Runtime enforcement belongs at the enterprise layer, not in the model prompt path. The article reinforces a split responsibility model in which the organisation owns harness, tools, and environment. That means control over prompt inspection, data handling, tool authorization, and auditability has to sit where the enterprise can actually enforce it. Practitioners should align those controls to the way the system behaves, not to the way the vendor markets the model.

From our research library:

• Claude Code-assisted commits leaked secrets at a rate of 3.2%, more than double the human-only baseline of 1.5%, with peaks reaching 31 secrets per 1,000 commits in August 2025, according to the State of Secrets Sprawl 2026.
• 43% of security professionals are concerned about AI systems learning and reproducing sensitive information patterns from codebases, according to the State of Secrets in AppSec.
• Read next: AI Agent Observability, Audit and Incident Response Guide

What this signals

Identity blast radius: once Claude is wired into enterprise tools, the question is no longer whether the model is safe in isolation, but how far a compromised session can move through inherited access. That is why teams need to measure the reach of tool permissions, not just the quality of prompt filtering.

Claude’s shared responsibility model leaves the enterprise holding the harness, tools, and environment. That means runtime controls, auditability, and data handling have to be designed around actual agent behaviour, not around the assumption that model output is the only thing that matters.

For practitioners

• Map every Claude-connected tool path Inventory where Claude or Claude Code can reach internal systems, databases, APIs, and MCP servers, then classify each path by the permissions it inherits from the invoking user.
• Separate sanctioned from shadow AI use Identify unsanctioned Claude usage in developer tools, browser sessions, and external subscriptions, then route approved activity into monitored channels with logging and policy enforcement.
• Bind agent actions to attributed identities Require each agent action to be traceable to a human owner or service owner so investigators can reconstruct who authorised the session and what the system did.
• Enforce runtime data protection on prompts and responses Inspect both inbound instructions and outbound outputs for sensitive data, then block or redact credentials, source code, and regulated data before they cross trust boundaries.
• Limit tool authorization before production rollout Grant only the minimum tool scope needed for each Claude use case, and disable access to high-value systems such as OT, finance, or sensitive repositories unless the business case is explicit.

Key takeaways

• Claude deployments become an identity problem as soon as the model can act through inherited permissions and connected tools.
• The article ties agentic abuse to real incidents, including large-scale exfiltration and credential harvesting, which shows the risk is operational rather than theoretical.
• The most relevant control is to constrain tool authorization, monitor agent actions, and make every session attributable before production rollout.

Key terms

• Agentic AI: Autonomous AI systems capable of planning, deciding, and taking actions, including calling APIs, writing code, and orchestrating other agents, with minimal human oversight. Agentic AI introduces new NHI risks as agents must authenticate to external services.
• Shadow AI: AI agents, copilots, or connected tools operating without full visibility or governance from security teams. Shadow AI becomes an identity problem when those systems authenticate with unmanaged tokens, service accounts, or OAuth apps that can reach production resources.
• MCP: Model Context Protocol, an open way for AI agents to connect to tools and data sources. It improves interoperability, but it also introduces a shared integration layer that must be governed carefully because the protocol can widen access across many systems at once.
• Identity Blast Radius: The amount of damage a compromised identity can cause across systems, data, and infrastructure. In NHI environments, it is shaped by permissions, network reach, and administrative capability rather than by the credential alone. Reducing blast radius is a containment strategy that limits lateral movement and data exposure.

Deepen your knowledge

NHI governance, agentic AI identity, and machine identity lifecycle are core topics in our NHI Foundation Level course, the industry's only accredited NHI security programme. If you are building or maturing an IAM programme, it is worth exploring.