TL;DR: Agentic AI systems introduce memory, tool, autonomy and multi-agent risks that traditional input-output security models miss, while Mandiant's M-Trends 2026 shows attackers collapsing the time from initial access to impact to as little as 22 seconds. Lumia Security argues that discovery, least privilege and runtime observability now matter more than post-hoc review when agents can act continuously.
At a glance
What this is: NHI Mgmt Group's analysis, drawing on Lumia Security's blog post: Agentic AI creates five security risks that traditional enterprise controls often miss, because memory, tools, autonomy and inter-agent communication expand the attack surface beyond input-output inspection.
Why it matters: IAM, PAM and security teams need to treat AI agents as governed identities with bounded authority, because their runtime access can outpace human review and conventional control assumptions.
Context
Agentic AI changes the problem from controlling prompts to governing software that can remember, choose tools and execute work across systems. That matters because the control surface is no longer a single interaction, but an identity with persistent context and delegated authority.
Existing security models struggle when an AI system can act continuously, call APIs, write code and pass work to other agents. Once that happens, discovery, privilege scope and runtime monitoring become governance problems as much as technical ones.
Key questions
Q: What breaks when agentic AI is deployed without formal security policies?
A: Without formal policies, agentic AI can accumulate access, generate defects, and trigger unsafe actions faster than security teams can govern them. The result is not just more alerts but an expanding remediation backlog, unclear accountability, and higher breach exposure when agents reach code, secrets, or production systems. Governance has to exist before scale, not after incidents prove the gap.
Q: Why do autonomous agents create a different risk model than traditional human-driven workflows?
A: Autonomous agents collapse reviewable steps into a fast interpret, decide, retrieve, act loop. That means one misread instruction can cascade across data, tools, and access before a human notices. The risk is not just intent, but scale and speed. When an agent runs with real privileges, a small mistake can produce operational damage, data exposure, or misleading actions.
Q: What are the signs that agentic security controls are not keeping up?
A: Warning signs include alerts that arrive after changes are already propagated, remediation that depends on a human to approve every action, and agent workflows that can affect infrastructure without explicit per-task authority. If audit trails exist but enforcement does not, the programme is observing risk rather than controlling it.
Q: What should security teams do when agent actions must be governed, not just observed?
A: They should enforce identity where the workload runs, use short-lived credentials, and reserve perimeter tools for visibility rather than control. That approach is most important for regulated data, production changes, and spend-bearing automations. If the business cannot tolerate ambiguous attribution, the control model is not strong enough yet.
Technical breakdown
Why memory poisoning persists across sessions
Agent memory is persistent context, not just a transcript. When an attacker seeds poisoned content through a document, data source or early interaction, that content can shape later reasoning long after the original input is gone. The security problem is persistence: the compromise survives session boundaries and can influence downstream decisions in ways that look like normal drift. This makes rollback, source validation and forensic traceability central to defence, because the system may continue acting on corrupted context even when no live attack is visible. See the Agentic AI Identity Guide.
Practical implication: Treat agent memory as a security-sensitive data store and validate what can enter it.
How tool misuse turns agent permissions into attack paths
Tool use is where agentic systems become operationally powerful and dangerous. An agent linked to email, code, finance or CRM tools can act on legitimate credentials while being steered by malicious prompts, poisoned context or manipulated tool output. The key failure is permission inheritance: if the agent receives the deployer's broad access by default, the tool layer becomes a privilege amplifier. Runtime policy enforcement matters because the misuse happens at the moment of action, not after the fact. See the AI Agent Authorisation Guide.
Practical implication: Separate agent permissions from human permissions and enforce function-level policy on every tool call.
Why multi-agent systems need step-level observability
Multi-agent systems create propagation risk because one compromised agent can hand off corrupted context to others before any human sees the issue. The failure is not just the bad decision, but the speed and opacity of that decision chain. Basic SIEM logging often captures only the start and end state, which is insufficient when the real problem is hidden in the intermediate handoffs, reasoning steps and inter-agent messages. Integrity controls for inter-agent communication matter because the network itself becomes part of the attack surface. See the AI Agent Observability, Audit and Incident Response Guide.
Practical implication: Log individual agent steps, handoffs and tool calls so investigations can reconstruct the chain of compromise.
Threat narrative
Attacker objective: The objective is to use trusted agent behaviour to reach business-impacting actions without needing to compromise every system directly.
- Entry begins when attackers influence an agent through poisoned context, a malicious prompt or a compromised content source that the system trusts.
- Credential access and privilege abuse follow when the agent executes tool calls using delegated access, often with permissions inherited from a human operator.
- Escalation and lateral movement occur as corrupted context or instructions propagate across connected agents, tools and downstream systems.
- Impact is reached when the agent triggers unauthorized transactions, data exposure, code execution or other business actions at machine speed.
Breaches seen in the wild
- Spain's first AI agent data breach 2026: Spain's AEPD logged its first breach notification attributed to an attacker's AI agent, which altered personal data and accessed invoices.
- AI agent retail card theft campaign 2026: AI agents breached 27+ retailers for about $25 each, used cloud keys and a Secrets Manager dump, and stole 600,000+ payment cards.
Read and download The State of NHI & AI Agent Breach Report 2026, covering 200+ breaches impacting Non-Human Identities including AI Agents.
NHI Mgmt Group analysis
Agentic AI governance debt is now a control gap, not a future concern. Organisations are deploying systems that can decide, act and chain tasks faster than existing approval and review models can absorb. That creates governance debt because the control design still assumes a human-readable sequence of decisions, while the actual system may complete work inside one runtime session. Practitioners should treat agent governance as an identity and privilege problem first, and a model problem second.
Shadow AI is the named concept that explains why agentic risk stays invisible. The article's strongest point is that organisations often do not know how many agents they have, where they run or what they can touch. Agentic AI identity matters here because an undiscovered agent cannot be provisioned, reviewed, logged or retired properly. The practitioner implication is blunt: discovery is the prerequisite for every other control.
Memory poisoning shows that persistent context is a long-tail attack surface. Unlike a one-off prompt attack, poisoned memory can shape later decisions across sessions and workflows. That means the failure mode is not just bad output, but corrupted state that survives long enough to affect business actions. Security teams should evaluate persistent context as part of their data and identity governance model, not as a model-only issue.
Least privilege for agents is not a translation of human IAM, it is a different policy problem. Agent permissions must be tied to task scope, tool scope and runtime context, not simply to the human who launched them. That becomes especially important when a business unit deploys an agent with full user rights and no formal review. Practitioners need a distinct authorisation model for non-human actors, otherwise delegated access becomes implicit overreach.
Agentic ecosystems need integrity controls, not just monitoring. Multi-agent communication, tool handoffs and supply chain dependencies all become part of the trust boundary. The more automation you add, the more you need authenticated handoffs, step-level logs and dependency provenance to preserve accountability. For practitioners, the implication is that agentic security is architecture work, not a post-deployment tuning exercise.
From our research library:
- Gartner predicts that by 2028, 33% of enterprise software applications will include agentic AI, up from less than 1% in 2024, and that 15% of day-to-day work decisions will be made autonomously.
- Read next: AI Agent Observability, Audit and Incident Response Guide
What this signals
Agentic governance will increasingly shift from review after execution to control at issuance time. Once agents can complete meaningful work inside a single session, the old assumption that access can be certified later stops holding. Security teams should expect policy to move closer to the moment of delegation, with runtime enforcement and step-level telemetry becoming the deciding controls.
Service-account thinking is no longer enough for AI systems that act continuously. The practical problem is not just whether an agent can authenticate, but whether its authority is bounded, observable and revocable in the middle of work. That is where agent identity maturity will separate experimental deployments from governable ones.
69% of security leaders agree identity management must fundamentally shift to address agentic AI systems, according to the 2026 Infrastructure Identity Survey. That shift is already visible in the control stack: inventory, privilege scoping, memory validation and communication integrity all have to work together, or the agent becomes the policy bypass.
For practitioners
- Implement agent discovery before expanding deployments Build an inventory of every agent across low-code platforms, SaaS tools and direct API integrations, including owners, data access and runtime location.
- Enforce task-scoped least privilege for each agent Separate agent permissions from the deploying user's permissions and restrict tool access to the minimum function needed for the task. See the AI Agent Authorisation Guide.
- Validate persistent memory and context sources Checkpoint agent memory, review what data sources feed it and maintain rollback points for corrupted or suspicious context.
- Log step-level agent execution Capture tool calls, inter-agent handoffs and reasoning steps so investigations can reconstruct how a decision chain formed.
Key takeaways
- Agentic AI changes the control problem from inspecting prompts to governing persistent, tool-using systems with delegated authority.
- The article's core risks are memory poisoning, privilege abuse, prompt injection, multi-agent propagation and supply-chain compromise.
- Discovery, task-scoped privilege and step-level observability are the controls most likely to reduce exposure in practice.
Related NHI Mgmt Group resources: Agentic AI Identity Guide · AI Agent Authorisation Guide · AI Agent Observability, Audit and Incident Response Guide · Top 10 Agentic AI Identity Issues
Standards & Framework Alignment
This section maps relevant standards and security frameworks to the operational risks and controls described in this guidance.
OWASP Agentic AI Top 10 and MITRE ATT&CK address the attack and risk surface, while NIST AI RMF sets the governance and control requirements practitioners need to meet.
| Framework | Control / Reference | Relevance |
|---|---|---|
| OWASP Agentic AI Top 10 | ASI03 — Identity & Privilege Abuse | The article centres on agents inheriting excess authority and misusing tool access. |
| ASI06 — Memory & Context Poisoning | Memory poisoning is one of the article's central risks. | |
| ASI07 — Insecure Inter-Agent Communication | The post highlights cascade risk across multi-agent handoffs and communication paths. | |
| Recommendation — Apply ASI03 controls to separate agent authority from human authority and constrain delegated privileges. Use ASI06 to validate persistent context and detect poisoning before it shapes future agent actions. Apply ASI07 to authenticate and integrity-check inter-agent messages and handoffs. | ||
| NIST AI RMF | GOVERN — AI Governance and Accountability | The post is fundamentally about AI governance and accountability for autonomous systems. |
| Recommendation — Establish governance ownership for agent inventory, delegated authority and incident accountability. | ||
| MITRE ATT&CK | TA0006; TA0008 — Credential Access; Lateral Movement | The attack paths described rely on credential abuse and propagation across connected systems. |
| Recommendation — Map agent abuse scenarios to TA0006 and TA0008 to improve detection of credential-driven spread. | ||
Key terms
- Agentic AI: Autonomous AI systems capable of planning, deciding, and taking actions, including calling APIs, writing code, and orchestrating other agents, with minimal human oversight. Agentic AI introduces new NHI risks as agents must authenticate to external services.
- Memory Poisoning (ASI06): An attack where malicious content is injected into an AI agent's memory or context, causing it to alter its behaviour in subsequent tasks, potentially exfiltrating secrets, escalating privileges, or acting against its intended purpose.
- Shadow AI: AI agents, copilots, or connected tools operating without full visibility or governance from security teams. Shadow AI becomes an identity problem when those systems authenticate with unmanaged tokens, service accounts, or OAuth apps that can reach production resources.
- Agent Identity: An agent identity is the set of attributes, credentials and permissions assigned to an autonomous software entity. It is treated as a non-human identity because it can authenticate, act on systems and accumulate access over time, which creates governance, audit and lifecycle obligations similar to other production identities.
Deepen your knowledge
The NHI Foundation Level course, the industry's only accredited NHI security programme, covers NHI governance, agentic AI identity and workload identity. It helps practitioners build the control thinking needed to govern non-human actors across identity, access and lifecycle.
Published by the NHIMG editorial team on October 27, 2026.
NHI Mgmt Group, the independent authority on Non-Human Identity, IAM, and Agentic AI security. nhimg.org