Independent analysis by NHI Mgmt GroupSource article: WitnessAI, “Multi agent security: risks & how to secure AI agent systems” (May 2, 2026)

TL;DR: Multi agent AI systems plan, delegate, and act across enterprise infrastructure without human approval, creating security risks that traditional request-response controls were not designed to handle, according to WitnessAI. The governance gap is not just visibility, but the collapse of assumptions about stable privilege, trusted handoffs, and human-paced review.

At a glance

What this is: NHI Mgmt Group's analysis, drawing on WitnessAI's blog post: Autonomous agents create an identity governance gap because they plan, delegate, and act across systems faster than traditional controls can track.

Why it matters: It matters because IAM, PAM, and NHI programmes now have to govern delegated machine actions, not just identities that wait for human approval, or they will miss where privilege, trust, and accountability collapse.

Context

Multi-agent AI security is about governing systems where autonomous agents plan, delegate, and act across enterprise infrastructure without waiting for human approval. In identity terms, that changes the control problem from who may sign in to what a machine principal can do, how far its delegated trust can spread, and when oversight can still intervene.

The article’s central point is that existing security models were built for request-response interactions and human-paced review. Once agent chains start sharing memory, calling tools, and handing outputs to other agents, stable privilege assumptions and simple audit trails stop being enough for NHI governance.

This is not just a visibility problem. It is a governance problem that spans NHI, agentic AI, and the human stakeholders who approve or inherit the risk when delegated actions cross system boundaries.

Key questions

Q: What breaks when multi-agent AI systems are governed like single-model deployments?

A: Single-model governance assumes one prompt, one response, and a human-visible decision boundary. In multi-agent systems, delegated subtasks, shared memory, and chained tool calls create trust paths that cross multiple steps before anyone can review them. The result is that static approvals and one-time policy checks miss the point where risk actually turns into action.

Q: Why do autonomous AI systems create more identity risk than normal automation?

A: Normal automation follows a fixed path, but autonomous systems can interpret goals, choose actions, and continue without waiting for a person. That makes intent less predictable and review cycles less useful. The risk increases when the system can broaden scope or trigger actions that affect data, money, or compliance.

Q: How can security teams know if agent skill controls are actually working?

A: Look for evidence that skills are inventoried, risk rated, scanned before execution, and tied to a policy manifest or approval record. If teams cannot show which skills are live, who owns them, and what actions they can trigger, the programme is still operating on trust rather than control.

Q: Who should be accountable when an AI agent causes a security incident?

A: Accountability should sit with the human owner, platform team, or business function that granted and operated the agent. The identity may act independently, but governance cannot detach responsibility from the delegation chain. Programs should define ownership, escalation, and remediation paths before deployment so responsibility is clear when the agent's behaviour changes.

Technical breakdown

Why multi-agent systems break human-paced security controls

Multi-agent systems are orchestrated networks of autonomous agents that decompose goals, delegate subtasks, and pass outputs to downstream agents. That architecture introduces persistent memory, chained tool calls, and trusted handoffs that do not map cleanly to request-response security models. A control that assumes a person will approve each action cannot reliably govern a machine that selects the next step at runtime. The result is not just more volume, but a different trust model in which one agent’s output becomes another agent’s instruction. Practical implication: security teams need controls that operate during execution, not only at provisioning time.

Practical implication: move governance from static approval to runtime enforcement across agent handoffs.

Lethal Trifecta in multi-agent AI security

The article describes a combination of three conditions that make multi-agent environments especially exposed: access to sensitive data, exposure to untrusted content, and the ability to communicate externally. When those conditions coexist, an attacker can plant hidden instructions in incoming content, cause an agent to process confidential material, and then use the agent’s own outbound channels to move the data out. This is not a single vulnerability so much as a structural exposure pattern created by normal system design. Practical implication: treat the presence of all three conditions as an active control boundary that must be governed together.

Practical implication: classify and constrain any agent that can read sensitive data, ingest untrusted content, and send data out.

How prompt injection cascades through agent chains

Prompt injection becomes more dangerous in multi-agent environments because compromised outputs can become trusted inputs for the next agent in the chain. The article points to EchoLeak as an example of zero-click prompt injection where an assistant accessed internal files and sent content to an attacker-controlled server without user interaction. The important technical point is that the agent was not broken in the classic sense. It was manipulated into using its legitimate permissions against itself and passing the result onward. Practical implication: inspect both inputs and outputs at each handoff, not just the first prompt.

Practical implication: validate trust boundaries at every handoff, including tool metadata and downstream outputs.

Threat narrative

Attacker objective: The attacker’s objective is to convert legitimate agent trust and permissions into multi-step access, data movement, and unintended execution across enterprise systems.

  1. Entry occurs when an attacker supplies hidden instructions through untrusted content, tool metadata, or another compromised agent output.
  2. Credential or permission abuse follows when the agent uses its legitimate access to read sensitive data or invoke tools on the attacker’s behalf.
  3. Escalation happens as the compromised output propagates through agent handoffs, turning one manipulated step into a broader chain of trusted actions.
  4. Impact is achieved when the agent’s authorized channels are used to exfiltrate data, trigger unintended actions, or move compromise across downstream systems.

Read and download The State of NHI & AI Agent Breach Report 2026, covering 200+ breaches impacting Non-Human Identities including AI Agents.

NHI Mgmt Group analysis

Stable privilege is the wrong governance assumption for multi-agent systems: The article shows that enterprise identity infrastructure was designed for human principals who can be reviewed, certified, and offboarded on a stable schedule. That assumption fails when agents delegate work, chain tool calls, and move across systems at machine speed. The implication is that identity governance has to account for delegated action paths, not just named accounts.

Trust propagation is the new identity blast radius: Once one agent or integration is compromised, downstream agents often treat its output as trusted input. That turns a localized issue into a systemic one because trust extends through the chain instead of stopping at the first boundary. Practitioners should read this as a governance problem about where trust is allowed to travel.

Multi-agent security creates a runtime governance gap: Static approvals and pre-deployment checks cannot keep pace with agents that change behaviour as tasks unfold. The article’s strongest contribution is its focus on runtime defense, because the failure is not simply that controls are missing, but that controls arrive too early in the lifecycle. The implication is that governance must move into live execution.

Accountability must span legal, compliance, HR, and security when agents are operational: The article correctly treats multi-agent security as a cross-functional governance issue rather than a narrow security-tool problem. Human owners still matter, but the system behaviour is executed by non-human identities that can act faster than review cycles. That makes accountability a programme design issue, not an after-the-fact reporting task.

Runtime visibility becomes the named control gap for agentic AI: The practical failure mode here is not a lack of alerts, but a lack of usable lineage across prompts, tool calls, and handoffs. Without that lineage, organisations cannot reconstruct how an outcome occurred or determine which delegation step crossed the boundary. Practitioners should treat runtime traceability as foundational governance, not optional telemetry.

From our research library:

What this signals

Identity governance has moved from account review to action-path review: Multi-agent systems should be governed by the paths they can take through tools, data, and delegated handoffs, not only by the accounts they use. That is a material shift for IAM, PAM, and NHI programmes because the control point is increasingly the runtime decision, not the stored credential.

Runtime lineage is becoming the differentiator between detection and explanation: If an organisation cannot tie an agent’s prompt, tool use, and output together, it will struggle to explain how an incident happened or which delegated step failed. The practical programme implication is to make lineage a core governance requirement before scale arrives.

Shadow AI should now be treated as shadow NHI: Agents deployed outside IT and security oversight often carry active permissions and can operate at machine speed. That means discovery, ownership, and policy binding need to start with the non-human identity itself, not with the interface a person happened to use.

For practitioners

  • Map every agent to a governed non-human identity Assign each agent a scoped identity, minimum standing permissions, and a clear owner so delegated actions are not anonymous or open-ended.
  • Enforce runtime controls on tool use Apply policy at execution time for tool calls, outbound communication, and sensitive data access rather than relying on one-time setup approvals.
  • Build lineage across agent handoffs Record prompts, tool selections, outputs, and downstream recipients so incident teams can trace how one agent’s action influenced the next step.
  • Classify and contain shadow AI deployments Inventory agents created outside security oversight, then bind them to the same policy engine as approved systems before they reach production data.
  • Test for prompt-injection propagation Red-team multi-step chains to see whether hidden instructions survive across agents, especially where memory, tool metadata, and shared context are present.

Key takeaways

  • Multi-agent AI creates an identity governance problem because delegated machine actions do not fit the assumptions behind human-paced access review.
  • The article’s core risk is not only visibility but trust propagation across agent handoffs, tool calls, and shared context.
  • Runtime enforcement, lineage, and explicit ownership are the controls most likely to limit blast radius when autonomous agents are already operating.

Key terms

  • Multi-Agent System (MAS): An environment in which multiple autonomous AI agents interact, collaborate, and delegate tasks. MAS dramatically increases NHI complexity, each agent requires a managed identity, and a single compromise can propagate across the entire mesh.
  • Trust Handoff: A trust handoff is the point where one component produces output and another component accepts it as safe enough to act on. In agentic systems, these handoffs matter more than the agent process alone because the security failure often happens when a host tool executes or consumes agent-created artefacts.
  • Runtime Guardrail: A control applied while an AI agent is operating, not just during configuration or review. Guardrails can block dangerous tool calls, require approval for sensitive actions, or stop data leakage before it reaches systems or users.
  • Shadow AI: AI agents, copilots, or connected tools operating without full visibility or governance from security teams. Shadow AI becomes an identity problem when those systems authenticate with unmanaged tokens, service accounts, or OAuth apps that can reach production resources.

Deepen your knowledge

NHI governance, agentic AI identity, and machine identity lifecycle are core topics in our NHI Foundation Level course, the industry's only accredited NHI security programme. If you are building or maturing an IAM programme, it is worth exploring.
NHIMG Editorial Note
Published by the NHIMG editorial team on June 6, 2026.
Updated on October 8, 2026.
NHI Mgmt Group, the independent authority on Non-Human Identity, IAM, and Agentic AI security. nhimg.org