Mythos-era AI agents raise the stakes for identity security

At a glance

What this is: Delinea argues that Mythos-era AI agents raise the stakes for identity security by making vulnerability discovery faster while leaving identity control as the main constraint on damage.

Why it matters: IAM and PAM teams need to treat AI agents as privileged identities because faster compromise paths increase the value of scoped access, continuous authorisation, and session control across NHI and human programmes.

By the numbers:

• Mythos achieved a 72% exploit success rate.

Context

The core issue is not that AI changes the existence of vulnerabilities, but that it compresses the time between discovery and exploitation. Once a system can find and weaponise weaknesses autonomously, identity security becomes the control plane that determines how far an attacker, or an AI agent acting with legitimate access, can move.

In NHI governance terms, the article treats AI agents as privileged identities rather than as generic automation. That matters because a privilege model built for stable human sessions does not map cleanly to runtime decisions, delegated actions, and machine-speed access paths.

The central claim is straightforward: if organisations cannot continuously govern who or what holds access, what it can reach, and what it does during a session, then faster vulnerability discovery simply creates faster pathways to the same breach outcomes.

Key questions

Q: What breaks when AI agents are given broad standing access?

A: Broad standing access breaks governance because the agent can move from one task to another without a fresh authorization check. That creates a control gap between intended scope and actual runtime behaviour. The result is weak accountability, limited containment, and audit trails that show activity without explaining why the activity was allowed.

Q: Why do faster vulnerability discoveries still leave identity as the main control point?

A: Because discovery only changes how quickly an attacker can reach a foothold. The real impact depends on which credentials, entitlements, and sessions are available after entry, so identity control determines whether the compromise stays local or becomes an enterprise breach.

Q: What are the signs that AI governance is failing in the enterprise?

A: Common warning signs include rapid growth in AI use without matching policy coverage, sensitive files being copied into personal accounts, and a large share of AI apps carrying high or critical risk. Another indicator is weak visibility into who is using which tools and what data they are sending. If teams cannot answer those questions, governance is not working as intended.

Q: When should organisations rotate secrets used by AI agents?

A: Rotate secrets immediately when they are shared across multiple systems, exposed in logs or code, or used by agents with broad access. In agentic environments, rotation is not just a hygiene task. It is a containment control that limits how far compromised credentials can spread through tools, workflows, and dependent services.

Technical breakdown

Why autonomous vulnerability discovery changes the identity attack surface

Mythos-class systems collapse the time between finding a flaw and demonstrating exploitability. That does not create a new class of vulnerability, but it changes the attacker economics by making discovery and weaponisation more scalable and less dependent on human operator time. For identity teams, the important shift is that access control no longer sits only at onboarding or initial authentication. The risk now spans the entire path from initial compromise to post-compromise movement, especially where credentials, tokens, or broad entitlements are already present.

Practical implication: evaluate identity controls by how much they limit post-compromise reach, not just by how well they block initial entry.

Why AI agents behave like privileged NHIs

An AI agent that can hold credentials, reach multiple systems, and execute tasks across an environment is not just an application feature. It is a non-human identity with privilege, scope, and blast radius. The governance problem is that many organisations still lack full inventory, ownership, and session visibility for these agents, which means they cannot reliably say what exists, what it can access, or what actions it has already taken. That is the same structural problem seen in unmanaged machine identity, only with more dynamic behaviour.

Practical implication: classify every production AI agent as a privileged NHI and bring it under inventory, scoping, and session-level oversight.

Why runtime authorisation matters more than perimeter checks

Traditional controls often validate access at the start of a session and then rely on logs after the fact. That model assumes the identity will remain within a predictable operating pattern. With AI agents, the safer assumption is false: an agent can start with legitimate access and then move into actions that exceed the original intent or risk posture. Runtime authorisation shifts the control point to each action, combining identity, resource sensitivity, and live context before allowing continuation. This is especially important when the same session can traverse data, systems, and administrative functions.

Practical implication: move from one-time access approval to continuous, action-by-action authorisation for agent sessions.

Threat narrative

Attacker objective: The objective is to turn faster exploit discovery into broader access, deeper movement, and higher-impact compromise by abusing credentials and standing privilege.

1. Entry occurs when a vulnerability is discovered and converted into working exploit code faster than a human team can respond.
2. Credential access follows when the attacker or agent reaches accounts, tokens, or standing access that were already present in the environment.
3. Escalation happens when those privileges are used to move across systems, expand reach, or abuse broad entitlements during the same session.
4. Impact comes from the resulting breach path, where access and movement matter more than the original flaw because identity controls failed to contain the session.

Breaches seen in the wild

• CoPhish OAuth phishing via Copilot Studio: Datadog showed Copilot Studio agents on a Microsoft domain can front OAuth consent phishing and forward stolen tokens; no victims reported.
• AI LLM hijack breach: attackers used stolen AWS access keys to hijack Anthropic LLM models on Bedrock.

Read and download The State of NHI & AI Agent Breach Report 2026, covering 200+ breaches impacting Non-Human Identities including AI Agents.

NHI Mgmt Group analysis

Mythos-class capability does not change the attacker’s goal, but it changes the economics of reaching it. Faster autonomous vulnerability discovery compresses the gap between exposure and exploitation. That makes identity controls the real limiter on damage, because the question is no longer whether a flaw exists but how far access can travel once it is found. The practitioner implication is to measure security by containment depth, not discovery speed.

AI agents are already operating as privileged NHIs, which means they belong in identity governance, not in an undefined automation bucket. They hold credentials, execute across systems, and create blast radius just like other non-human identities, but often without the ownership and review discipline applied to service accounts. This is the governance gap the article exposes. The practitioner implication is to govern agents with the same lifecycle, access, and accountability expectations used for other privileged identities.

Standing privilege is the failure mode that survives faster exploitation. Mythos can shorten the path to compromise, but it does not remove the need for a privileged account to exist in the first place. Where access persists beyond immediate task need, the attacker inherits a ready-made escalation path. The practitioner implication is to treat standing privilege as the condition that turns faster discovery into material breach impact.

Continuous authorisation is the named concept this era forces into the foreground. Identity programmes that only authenticate at session start are assuming that access remains safe until after the fact, which is no longer defensible when agents and AI-driven attacks can drift mid-session. That assumption already fails for privileged human access; it fails even harder for AI agents acting at machine speed. The practitioner implication is to redesign governance around runtime decisions, not static grants.

Identity visibility now has to span human, machine, and AI actors in one control model. The article is right to reject a narrow focus on zero-days, because the dominant breach outcome still comes from credentials and overexposure after entry. Once AI agents are added to the environment, the inventory problem becomes a trust problem: if you cannot enumerate what exists, you cannot prove what is safe. The practitioner implication is to unify discovery and entitlement governance across all actor types.

From our research library:

• Only 44% of organisations have implemented any policies to manage their AI agents, despite 92% agreeing that governing AI agents is critical to enterprise security, according to the 2026 Infrastructure Identity Survey.
• 54% of organisations are actively deploying AI agents across workflows, yet only 21% report a mature governance model for agentic AI.
• Read next: Agentic AI Security Guide

What this signals

Continuous authorisation will matter more as AI agents become normal infrastructure actors. The key governance shift is not simply adding more identities to the catalogue, but changing the decision point from login time to action time. Programmes that still rely on static approval models will struggle to explain why an agent was allowed to continue once its behaviour changed mid-session.

Identity blast radius is now the practical metric for AI agent governance. If a privileged agent can reach too many systems, then every weakness in its credentials, scope, or oversight becomes a multiplier. That means IAM, PAM, and NHI teams need one shared view of session risk instead of separate control assumptions that leave gaps between them.

Only 44% of organisations have implemented any policies to manage their AI agents, despite 92% agreeing that governing AI agents is critical to enterprise security. according to the 2026 Infrastructure Identity Survey That gap suggests the market understands the problem faster than most programmes can operationalise it.

For practitioners

• Continuously discover every privileged identity Build a current inventory of human admins, service accounts, and AI agents, then map each to owners, privileges, and reachable systems. This is the only way to see indirect privilege chains before an attacker or agent uses them.
• Eliminate standing privileges where possible Replace persistent access with task-scoped access for accounts that can reach sensitive systems, especially where agents or automated workflows operate across multiple services.
• Broaden secrets brokering and vaulting Vault long-lived credentials, inject them only at connection time, and minimise where secrets can persist in agent workflows or administrative tooling.
• Authorize every agent action at runtime Use policy engines to evaluate the agent’s identity, the target resource, and live risk context on each action rather than only at session start.
• Treat AI agents as first-class privileged identities Apply the same governance expectations to AI agents that you already use for privileged humans, including scoped credentials, full session records, and defined accountability for each agent role.

Key takeaways

• Faster autonomous vulnerability discovery raises exposure, but the decisive control remains how tightly identity and session rights are constrained after entry.
• AI agents behave like privileged NHIs when they can hold credentials and execute across systems, so they need inventory, ownership, and scoped access.
• Continuous authorisation and task-scoped access reduce blast radius far more effectively than static approval or post-event review alone.

Key terms

• Privileged AI system: An AI system that can access sensitive operational data, influence security decisions, or trigger downstream actions. It should be treated like any other privileged control surface, with explicit access management, change control, output validation, and auditability.
• Continuous authorization: Continuous authorization is the practice of rechecking access as a session unfolds instead of trusting a single login decision. It matters for AI workflows because the request, context, retrieved data, and downstream action can all change between prompt and execution, making static approval too blunt.
• Standing Privilege: Standing privilege is access that remains active even when no immediate task requires it. For NHI programmes, it is a common failure mode because long-lived credentials and persistent roles create unnecessary exposure. Reducing standing privilege usually means tighter expiry, on-demand access, and clearer review of who or what still needs access.
• Identity Blast Radius: The amount of damage a compromised identity can cause across systems, data, and infrastructure. In NHI environments, it is shaped by permissions, network reach, and administrative capability rather than by the credential alone. Reducing blast radius is a containment strategy that limits lateral movement and data exposure.

Deepen your knowledge

NHI governance, agentic AI identity, and machine identity lifecycle are core topics in our NHI Foundation Level course, the industry's only accredited NHI security programme. If you are building or maturing an IAM programme, it is worth exploring.