Enterprise AI security threats expose gaps in legacy IAM controls

At a glance

What this is: NHI Mgmt Group's analysis, drawing on WitnessAI's blog post: Enterprise AI is creating six active threat vectors, including prompt injection, shadow AI, and autonomous agent misuse, while legacy IAM and DLP controls miss conversational context and runtime intent.

Why it matters: IAM, PAM, and NHI teams need to treat AI workflows as a governed identity surface because the security failure is happening at execution time, not just at authentication or data loss detection.

Context

Enterprise AI security is no longer a niche application issue. As copilots, chatbots, and AI agents move into production, the security problem shifts from protecting a single interface to governing a growing set of actions, data paths, and delegated permissions across the enterprise.

The core gap is that legacy IAM and DLP were built for human-paced, structured workflows. They are weak at understanding conversational context, user intent, and agent behaviour, which means they cannot reliably govern AI systems that can query data and trigger actions at runtime.

Key questions

Q: How should security teams govern AI-enabled workflows that can act on their own?

A: Treat them as identity-governed execution paths, not just software features. Assign a named owner, define least-privilege access, log every tool call, and require revocation paths for credentials and tokens. If the workflow can touch production systems or sensitive data, its permissions must be reviewed with the same discipline used for privileged machine identities.

Q: Why do legacy IAM controls struggle with AI-driven environments?

A: Legacy IAM was built for relatively stable identities and slower review cycles. AI-driven systems change context quickly, chain actions, and make decisions at machine speed, which makes periodic certification and static roles too slow to contain risk. Continuous evaluation is now the practical requirement.

Q: What are the signs that shadow AI is creating unmanaged exposure?

A: Common signs include sensitive prompts sent to external copilots, unapproved plugins in the browser or IDE, and AI tools handling internal documents outside the governed stack. If teams cannot inventory those tools and sessions, they do not have a complete view of the attack surface.

Q: What is the difference between conversational AI and authenticated agentic AI?

A: Conversational AI generates responses and recommendations, while authenticated agentic AI is allowed to take controlled actions in enterprise systems on behalf of a user or organisation. The difference is not the model itself, but whether the surrounding identity and access layer can authorize real work safely. Without that layer, AI remains informative but not operational.

Technical breakdown

Why conversational context breaks legacy data controls

Large language models do not maintain a clean boundary between system instructions and user-supplied content, which is why prompt injection works. The problem is not simply malicious text, but that the model may treat untrusted content as operationally relevant input. Traditional DLP is also limited because AI can rephrase, summarise, or restructure sensitive material, so the original keywords or patterns disappear. That makes content-based inspection a poor fit for AI-mediated data movement.

Practical implication: move from string-matching controls to context-aware inspection before prompts and outputs reach the model.

How AI agents extend identity beyond authentication

An AI agent is not just a conversational interface. It can call tools, query databases, execute code, and trigger workflows, often inheriting the permissions of the user or system that deployed it. That creates a non-human identity problem because access is no longer only about who logged in, but about what the agent can do after authentication. Human-centric IAM struggles here because it was not designed to validate intent, enforce pre-execution approval, or attribute every action back to its human origin.

Practical implication: govern agent permissions as delegated runtime authority, not as a simple login event.

Why shadow AI and supply chain exposure create blind spots

Shadow AI expands risk because employees can use external tools, browser assistants, and unapproved plugins without a formal enterprise control path. AI supply chains add another layer of exposure because third-party models and dependencies can enter production with limited integrity verification. Together, these conditions create an attack surface that is both distributed and difficult to inventory. The security issue is not only malicious use, but unmanaged use and unverified provenance in the same workflow.

Practical implication: inventory AI tools and third-party dependencies before trying to write policy around them.

Threat narrative

Attacker objective: The attacker aims to turn trusted AI workflows into a channel for data theft, unauthorized action, and enterprise-wide abuse of delegated access.

1. Entry begins when users, plugins, or retrieved content introduce malicious instructions into an AI workflow, or when unapproved AI tools handle sensitive data outside governed channels.
2. Credential or permission abuse follows when an agent inherits broad access and uses approved integrations to call APIs, query databases, or move data beyond the intended scope.
3. Impact occurs as unauthorized actions, data exfiltration, workflow compromise, or account takeover happen at machine speed before human oversight can intervene.

Breaches seen in the wild

• Langflow Flodrix botnet 2025: Attackers used Langflow's unauthenticated code endpoint to dump AI servers' environment variables and enlist them in the Flodrix botnet.

Read and download The State of NHI & AI Agent Breach Report 2026, covering 200+ breaches impacting Non-Human Identities including AI Agents.

NHI Mgmt Group analysis

Legacy IAM assumes a human-paced request model, and that assumption breaks when an AI system can act at runtime. The article shows that enterprise AI now queries, calls tools, and triggers workflows in ways that human-centric access models were never designed to supervise. That means the governance problem is not just broader access, but a different execution rhythm. Practitioners need to treat AI behaviour as a separate identity plane, not a variant of user access.

Intent-based governance is the missing layer between static policy and runtime AI action. Keyword-based controls can miss harmful behaviour because conversational systems do not express intent in predictable strings. The article’s central point is that enterprises must understand what the user or agent is trying to accomplish, not only what words appear in the prompt. That shifts governance from content filtering to contextual authorisation.

Runtime guardrails matter more than pre-deployment testing once agents can trigger downstream actions. The article makes clear that pre-release review alone cannot contain AI systems that take dynamic actions after a prompt is received. Bidirectional controls, inspecting both inputs and outputs, are now part of the control surface. The practitioner conclusion is that AI governance has to operate at the moment of action, not after the session ends.

Shadow AI turns unsanctioned use into an inventory problem as much as a policy problem. If teams do not know which models, copilots, plugins, and agent connections are active, they cannot meaningfully govern their exposure. This is a visibility failure first, then a control failure. The governance takeaway is that discovery and policy must be coupled, or the control model will always trail the actual attack surface.

AI security is converging on a unified operating model across human and digital workers. The article’s strongest strategic signal is that enterprise AI is forcing IAM, NHI governance, and runtime security into one operating view. That does not erase human identity controls, but it does extend governance to autonomous behaviour and delegated machine action. Practitioners should expect the security model to become more continuous, more contextual, and less dependent on static role assumptions.

From our research library:

• Only 44% of organisations have implemented any policies to manage their AI agents, despite 92% agreeing that governing AI agents is critical to enterprise security, according to the 2026 Infrastructure Identity Survey.
• 54% of organisations are actively deploying AI agents across workflows, yet only 21% report a mature governance model for agentic AI.
• Read next: Agentic AI Security Guide

What this signals

Enterprise AI now requires runtime governance, not only access management. Security teams should expect AI copilots, agents, and shadow tools to become part of the identity control plane, because the decisive risk is what these systems can do after they are authenticated. Discovery, policy, and enforcement need to track the same session.

Intent is becoming a governance signal. When AI systems can summarise, rephrase, and act across multiple tools, policy based only on keywords or static roles will keep missing high-risk behaviour. Teams should prepare for controls that evaluate purpose, context, and delegated authority together.

AI security exposure is increasingly a visibility problem before it is a blocking problem. Without inventory of models, plugins, and agent connections, organisations cannot know which actions to inspect or which policy boundaries are being crossed. The operating model has to start with discovery and then move to enforcement.

For practitioners

• Discover every AI workflow and agent connection Build an inventory that includes copilots, browser assistants, embedded IDE tools, agent API calls, and shadow AI use across the business. Without discovery, policy will miss the actual places where prompts, data, and tool calls intersect.
• Shift from keyword rules to intent-based policy Classify prompts and outputs by conversational context and likely purpose rather than by prohibited words alone. This is the difference between filtering text and governing behaviour.
• Apply pre-execution and response guardrails Inspect prompts before they reach a model and inspect outputs before they reach users or trigger actions. Treat both directions as part of the same control path.
• Govern agent permissions as delegated runtime authority Map each AI agent’s tool access, database access, and workflow triggers back to a named human owner, then constrain sensitive actions with approval checkpoints and attribution logging.

Key takeaways

• Enterprise AI creates a control problem that legacy IAM and DLP cannot solve because they were built for human-paced, predictable workflows.
• The six threat vectors described in the article show that risk now moves through prompts, agents, shadow tools, and supply-chain dependencies, not only through overt breaches.
• Practitioners need a unified model that discovers AI use, evaluates intent, and governs runtime action if they want adoption without losing control.

Key terms

• Agentic AI: Autonomous AI systems capable of planning, deciding, and taking actions, including calling APIs, writing code, and orchestrating other agents, with minimal human oversight. Agentic AI introduces new NHI risks as agents must authenticate to external services.
• Shadow AI: AI agents, copilots, or connected tools operating without full visibility or governance from security teams. Shadow AI becomes an identity problem when those systems authenticate with unmanaged tokens, service accounts, or OAuth apps that can reach production resources.
• Prompt Injection (Agentic): An attack where malicious instructions are embedded in content that an AI agent reads, causing the agent to execute unintended actions using its own legitimate credentials. A primary vector for agent goal hijacking and identity abuse.
• Intent-based classification: Intent-based classification evaluates what a user or system is trying to do, not just what text or file is present. In AI governance, it distinguishes routine work from risky interaction by reading context, purpose, and sensitivity. That matters when regulated data is handled conversationally rather than through formal file transfer.

Deepen your knowledge

NHI governance, agentic AI identity, and machine identity lifecycle are core topics in our NHI Foundation Level course, the industry's only accredited NHI security programme. If you are responsible for identity security strategy or NHI governance in your organisation, it is worth exploring.