Palo Alto Networks’ Koi acquisition shifts AI agent endpoint security

At a glance

What this is: This is a vendor announcement about Koi joining Palo Alto Networks, with the central claim that agentic AI on the endpoint creates an attack surface that existing security tools were not designed to govern.

Why it matters: IAM, PAM, and NHI teams need to treat agentic endpoint activity as an identity and privilege problem because tools that act in-session can bypass assumptions built around stable user and workload identities.

Context

Agentic endpoint security is the problem of governing software tools that act on behalf of users or systems directly on endpoints, often with broad access to files, terminals, or enterprise services. The article argues that coding agents and autonomous endpoint tools expand the attack surface because conventional security stacks were built around stable identities and predictable execution paths, not tools that decide and act in-session.

For identity programmes, the important change is not just that these tools use credentials. It is that their access profile can change during a task, making entitlement, observability, and remediation harder to model with standard human IAM or classic device controls. That puts the issue at the intersection of NHI governance, endpoint security, and emerging agentic AI controls.

The article is best read as a market signal about where security control planes are moving, not as proof that one product category has solved the issue. The governance question is whether organisations can explain, constrain, and revoke agentic access fast enough to match how these tools actually operate.

Key questions

Q: What breaks when coding agents inherit a developer's full access?

A: The agent stops being a bounded helper and becomes a high-trust actor with permissions that outlive the task. That creates excessive privilege, secret exposure, unsafe workflow edits, and poor accountability. The failure is not that the model is clever. The failure is that the authorization model assumes a human pace and human judgment where neither exists.

Q: When should organisations use runtime authorization for AI agents?

A: Use runtime authorization when agent behavior can change based on context, tools, or delegated workflows. Static approvals are too coarse when an agent can act across multiple systems in minutes. Runtime checks help keep privilege proportional to the current task and reduce the chance that a one-time approval becomes persistent excess access.

Q: How can teams tell whether agentic access controls are actually working?

A: Look for evidence that every privileged action is logged with actor type, target resource, and policy decision, and that denied requests are being blocked before execution. If you can only see the login and not the downstream action, the control is too weak for agentic use.

Q: How should IAM teams respond when human approval is part of agent execution?

A: Treat approval as a runtime control, not a post-denial exception. The policy should be able to hold, retry or resume actions based on a qualifying approval event before the agent completes the next step. That keeps human oversight inside the workflow rather than outside it.

How it works in practice

Why agentic endpoint access breaks static identity assumptions

Endpoint security traditionally assumes that the subject of control is either a person, a device, or a workload with relatively stable permissions. Agentic AI changes that because the software can take actions during a session, select tools, and interact with sensitive local or cloud resources in ways that are not fully predictable at provisioning time. That makes the access boundary less about the endpoint itself and more about runtime authority. Once the agent can create, modify, or exfiltrate data on its own initiative, the control question becomes whether the session is bounded, observable, and revocable in real time.

Practical implication: Model agentic endpoint access as runtime privilege, not as a one-time device enrollment event.

How endpoint AI tools create a new identity layer

AI coding agents sit between the user, the endpoint, and enterprise systems, which means they often inherit context from one identity and execute under another. That creates a layered trust model: the human may initiate the task, but the agent carries the effective authority to read code, call APIs, write files, or trigger downstream actions. In NHI terms, this is closer to delegated machine identity than to a conventional user session. The governance problem is that the effective actor can be broader than the nominal account that launched it, especially when the tool chains into editors, shells, CI systems, or cloud services.

Practical implication: Define which identity the agent actually exercises and restrict the downstream tools that identity can touch.

Why observability and remediation must move to the control plane

The article's emphasis on visibility and remediation matters because endpoint AI risk is difficult to contain if detection only happens after an action lands on disk or reaches a remote service. Effective governance needs to see the agent's prompts, tool use, file actions, and privilege boundaries as security events. That is why the control plane matters: it is the layer where policy, telemetry, and response can be applied before the agent's actions become persistent change. Without that, teams are left with post-hoc investigation rather than prevention or immediate suppression.

Practical implication: Collect agent activity telemetry at the point of privilege use, not only after endpoint damage is detected.

NHI Mgmt Group analysis

Agentic endpoint security is now an identity governance problem, not only an EDR problem. When a coding agent can read, write, and invoke enterprise resources during a live session, the security issue is no longer limited to endpoint compromise. The real question is who or what is authorised to act at runtime, and for how long. Practitioners should treat these tools as governed identities with bounded authority, not as ordinary software utilities.

Least privilege defined at install time is too static for agentic tools. Traditional entitlement models assume the actor's useful scope can be determined in advance. That assumption weakens when the tool decides which files, commands, or APIs to use during execution. The implication is that agent governance has to move from provisioned permission to task-scoped authorisation, with policy tied to observable context rather than a generic role.

Endpoint controls must be paired with identity controls if organisations want usable agentic AI. The article points to a control-plane approach because visibility alone does not constrain damage. Security teams need to know when an agent is acting, what authority it is borrowing, and where that authority can be revoked. That means endpoint security, NHI governance, and PAM now overlap at the session layer.

Agentic endpoint security will push the market toward runtime authorisation and auditability as default requirements. The article signals that security teams are no longer comparing simple detection features. They are re-evaluating whether products can govern non-human actors at execution time, across code, endpoint, and enterprise systems. That will validate control models built around dynamic privilege and challenge tools that still assume stable user sessions.

Agentic identities create an assumption gap that many programmes have not named yet. Access review processes were designed for privileges that persist long enough to be certified. That assumption fails when an AI coding agent can acquire authority, use it, and terminate the session before any review cycle begins. The implication is that governance has to start at issuance and session policy, not at quarterly recertification.

From our research library:

• Claude Code-assisted commits leaked secrets at a rate of 3.2%, more than double the human-only baseline of 1.5%, with peaks reaching 31 secrets per 1,000 commits in August 2025, according to the State of Secrets Sprawl 2026.
• Read next: AI Agent Identity Security Buyer's Guide

What this signals

Agentic endpoint governance will increasingly depend on task-bounded authority. Organisations cannot rely on static account reviews when a coding agent can take action and terminate its own access inside one workflow. The practical shift is toward policy that follows the task, not the account, and that is a material change for IAM, PAM, and NHI programmes.

Identity review cadences are misaligned with agent execution speed. Access review processes assume a privilege lasts long enough to be observed and certified, but autonomous tools and coding agents can complete work before governance cycles catch up. That means teams need live issuance controls, tighter session telemetry, and clear break-glass rules for non-human actors.

Agentic endpoint security is now a cross-domain control problem. Endpoint detection, secrets governance, and identity policy all have to meet at runtime if organisations want usable AI tooling without uncontrolled authority creep. The organisations that treat agent identity as an extension of ordinary user access will miss the governance gap this announcement highlights.

For practitioners

• Inventory agentic endpoint tools by effective authority List every coding agent, desktop agent, and autonomous endpoint tool that can read code, write files, invoke shells, or call enterprise APIs, then map the actual authority each one exercises.
• Bind agent access to task scope and session context Replace broad inherited access with task-scoped rules that define which repositories, commands, data sets, and downstream services an agent may touch during a live session.
• Instrument agent activity at the control plane Log prompts, tool calls, file writes, API requests, and policy denials so security teams can interrupt or contain agent behaviour before it becomes persistent change.
• Separate human initiation from machine execution rights Prevent the fact that a person started a task from automatically extending their full authority to the agent that completes it, especially where sensitive systems or secrets are involved.

Key takeaways

• Agentic endpoint tools expand the attack surface because they execute with authority during live sessions rather than as passive software components.
• The control problem is not only detection. It is deciding who or what may act, what scope that actor receives, and when that authority ends.
• Organisations that already align endpoint security with identity governance will be better placed to absorb agentic AI without creating unreviewed privilege paths.

Key terms

• Agentic Endpoint Security: A governance model for AI tools that act on endpoints with enough authority to access data, run commands, or trigger workflow changes. The focus is not just endpoint detection but runtime scope, identity context, and revocation when the task or session ends.
• Task-Bounded Authority: A permission model that limits a non-human actor to the exact scope needed for one task or session. For agentic systems, this matters because the useful authority may exist only while the task is running, so standing access creates avoidable overreach.
• Agentic Identity: An agentic identity is a non-human identity used by an autonomous system that can act, call tools, and access data with execution authority. It needs the same governance discipline as other privileged identities, plus runtime context, ownership mapping, and revocation paths.
• Runtime Authorisation: Runtime authorisation is the practice of deciding access while a task is in progress, rather than only at provisioning time. It matters for NHIs because credentials and entitlements can change risk mid-session, especially when automation or AI agents interact with sensitive systems.

Deepen your knowledge

NHI governance, agentic AI identity, and machine identity lifecycle are core topics in our NHI Foundation Level course, the industry's only accredited NHI security programme. If you are building or maturing an IAM programme, it is worth exploring.