GenAI security in 2026: why AI agent governance is now central

At a glance

What this is: Akto frames GenAI security as a governance problem for AI agents, tool connections, and data flows, with the key finding that risk now sits in how systems act as much as in what they generate.

Why it matters: This matters because IAM, PAM, and NHI teams now have to govern machine-led access paths, not just human logins, as AI agents increasingly touch internal data and actions.

By the numbers:

• 61% of organisations are encountering new threats associated with large language models and generative tools.

Context

GenAI security is the control problem that emerges when models, agents, and retrieval layers begin interacting with sensitive data and live systems. The risk is no longer limited to harmful output; it also includes prompt injection, unauthorized tool use, data leakage, and unmanaged automation paths that traditional application security does not model well.

For IAM and NHI programmes, the important shift is that AI agents behave like non-human actors with delegated access, yet many enterprises still treat them as feature layers rather than identities with lifecycle, privilege, and audit requirements. That makes governance, not just filtering, the central security gap.

Akto's analysis is typical of the current market: once AI moves into workflows, the attack surface becomes an access and action problem, not only a content problem.

Key questions

Q: How should security teams govern AI agents that call internal tools from Kubernetes?

A: They should separate runtime containment from identity governance. Kubernetes can isolate execution, but the tool boundary still needs delegated identity, per-request authorization, and action-level logging. Without those controls, the agent behaves like an unscoped service account with model-driven output, which makes attribution and revocation much harder.

Q: Why do AI agents increase the risk of overpermissioning?

A: AI agents increase that risk because teams often expand scopes to unblock early use cases, then keep those permissions because the original need is hard to prove or remove. The access model becomes broader over time, and the agent inherits more privilege than anyone intended.

Q: What are the signs that shadow AI is creating governance and compliance gaps?

A: Common signs include limited visibility into who is using AI tools, no reliable audit trail for prompts and outputs, unclear data residency, and inconsistent handling of sensitive information. If compliance, legal, and executive teams lack the same visibility as IT, the organisation already has a governance gap. Those conditions make it difficult to prove control or investigate misuse.

Q: What should organisations review first before allowing GenAI into production?

A: Start with inventory and privilege. Identify every model, agent, connector, and data source, then decide which actions truly need to exist and which should require approval or be removed. Without that baseline, policy, monitoring, and compliance controls are all built on incomplete assumptions.

Technical breakdown

Prompt injection changes the trust boundary inside GenAI systems

Prompt injection works by embedding instructions in user-supplied or retrieved content so that the model treats hostile text as part of the task. The failure is architectural: the system has not cleanly separated trusted system instructions, user input, and external content. In agentic setups, that matters even more because injected instructions can redirect tool calls, data retrieval, or workflow actions. Security controls therefore need input isolation, instruction hierarchy, and output validation around the model's decision path, not just the prompt text.

Practical implication: constrain what retrieved or user-supplied content can influence before it reaches tool execution.

Over-permissioned tools create the real GenAI blast radius

When an AI agent can query documents, trigger tickets, call APIs, or modify systems, every connector becomes part of the attack surface. The risk is not that the model is clever; it is that the agent has been given more authority than its task requires. This is the same governance mistake seen in NHI design: access is granted at integration time and rarely re-scoped to the task boundary. Least privilege, explicit approval gates for sensitive actions, and connector inventory become core control requirements.

Practical implication: scope each AI tool permission to the narrowest task boundary and remove unused connectors.

Shadow AI and unmanaged workflows undermine auditability

Shadow AI appears when employees adopt external or internal AI tools without central oversight, then connect them to sensitive data or enterprise systems. From a governance perspective, this creates unaudited identity, data, and action paths that bypass normal security review. The problem is compounded when logs do not capture tool-level activity or when prompts, context, and actions are not retained together. Without that evidence, teams cannot explain what an agent saw, why it acted, or whether a workflow crossed policy boundaries.

Practical implication: build inventory and logging that ties prompts, tool calls, and downstream actions to one auditable record.

Threat narrative

Attacker objective: The attacker wants to turn a trusted AI workflow into a vehicle for data exposure, unauthorized action, or downstream manipulation.

1. Entry occurs when a user or external content seeds a GenAI workflow with malicious instructions or hidden data.
2. Credential or privilege abuse follows when an over-permissioned agent accepts those instructions and uses its connected tools or APIs.
3. Escalation happens as the agent retrieves sensitive context, triggers additional systems, or propagates the unsafe action through a workflow.
4. Impact is data leakage, unauthorized system action, or corrupted business output at enterprise scale.

Breaches seen in the wild

• CoPhish OAuth phishing via Copilot Studio: Datadog showed Copilot Studio agents on a Microsoft domain can front OAuth consent phishing and forward stolen tokens; no victims reported.
• Langflow Flodrix botnet 2025: Attackers used Langflow's unauthenticated code endpoint to dump AI servers' environment variables and enlist them in the Flodrix botnet.

Read and download The State of NHI & AI Agent Breach Report 2026, covering 200+ breaches impacting Non-Human Identities including AI Agents.

NHI Mgmt Group analysis

Agent governance is now an identity problem, not just an AI safety problem. Once AI systems can call tools, query data, and trigger workflows, they need lifecycle, privilege, and audit control comparable to other non-human identities. The article captures the market's real shift: risk is moving from model output to delegated action. Practitioners should treat AI agents as governed actors, not feature enhancements.

Prompt injection matters because it breaks instruction trust, not because it is a clever prompt trick. The underlying failure is that untrusted content can influence execution decisions inside the same trust zone as system instructions. That creates a policy boundary problem that classic filtering alone cannot solve. Teams should think in terms of separated trust domains and constrained action paths.

Over-permissioned connectors are the AI equivalent of standing privilege. The article repeatedly points to tool access, workflow links, and internal systems as the risk centre, which is exactly where blast radius forms. When an agent can act across documents, tickets, and APIs without narrow scoping, one compromised interaction becomes a multi-system incident. Practitioners should reframe AI governance around task-scoped authority.

Shadow AI creates governance debt long before it creates an incident. Untracked tools, weak logging, and informal integrations produce a control gap that will eventually appear as an audit or security failure. That gap is especially important in identity programmes because the organisation cannot govern what it cannot inventory. The next maturity step is traceability across prompts, tools, and actions.

Named concept: AI action-path governance. This article shows that the decisive control is no longer only who can query the model, but which downstream systems an agent can touch after inference. That concept joins identity, workflow, and data governance into one control problem. Practitioners should design around action-path boundaries, not model boundaries alone.

From our research library:

• 69% of security leaders agree identity management must fundamentally shift to address agentic AI systems, according to the 2026 Infrastructure Identity Survey.
• Read next: Agentic AI Identity Guide

What this signals

AI action-path governance: the next control frontier is not only model safety but the set of systems an agent can touch after inference. That means identity teams need to govern delegated access, task scope, and evidence together instead of treating the agent as a passive application component.

The operational signal is simple: if you cannot inventory the agent, its connectors, and its audit trail in one view, you do not yet have governable AI. That is where IAM, PAM, and NHI disciplines converge for GenAI programmes.

For practitioners

• Inventory all AI agents and connectors Map every deployed GenAI system, the tools it can call, the data sources it can reach, and the workflows it influences. Include shadow deployments and employee-managed tools so the inventory reflects actual access paths, not just approved projects.
• Scope agent permissions to task boundaries Remove broad connector access and force sensitive actions through explicit approval, policy checks, or separate execution paths. Treat each connector as a delegated privilege that must be justified by a specific use case.
• Separate user input from execution logic Apply instruction hierarchy, retrieval filtering, and output inspection so untrusted content cannot directly shape tool calls or backend actions. This reduces prompt injection impact before the workflow reaches sensitive systems.
• Log prompts, tool calls, and outputs together Keep a single audit trail that ties the prompt, the retrieved context, the tool invocation, and the resulting action to one session record. That evidence is essential for forensic review, compliance, and control validation.

Key takeaways

• GenAI security now fails most often at the boundary between model output and downstream action, where over-permissioned tools and weak workflow controls turn a prompt into an enterprise event.
• The article's evidence points to a governance shift, with 61% of organisations already seeing new LLM-related threats and the broader AI infrastructure leaking faster than the model layer itself.
• The most effective control is task-scoped agent authority, backed by inventory, approval gates, and audit trails that tie prompts to tool use and system actions.

Key terms

• GenAI Security Tools: GenAI security tools are products and controls used to manage the risks created by generative AI. They typically fall into two groups: tools that secure AI-assisted software development, and tools that govern enterprise use of GenAI to prevent data leakage, shadow AI, policy violations, and unsafe access patterns.
• Prompt Injection (Agentic): An attack where malicious instructions are embedded in content that an AI agent reads, causing the agent to execute unintended actions using its own legitimate credentials. A primary vector for agent goal hijacking and identity abuse.
• Shadow AI: AI agents, copilots, or connected tools operating without full visibility or governance from security teams. Shadow AI becomes an identity problem when those systems authenticate with unmanaged tokens, service accounts, or OAuth apps that can reach production resources.
• Agentic AI: Autonomous AI systems capable of planning, deciding, and taking actions, including calling APIs, writing code, and orchestrating other agents, with minimal human oversight. Agentic AI introduces new NHI risks as agents must authenticate to external services.

Deepen your knowledge

The NHI Foundation Level course, the industry's only accredited NHI security programme, covers NHI governance, agentic AI identity, machine identity security, IAM, and secrets management. It helps practitioners build the control language needed when AI systems begin acting like governed non-human identities.