RSAC 2026 exposes the agentic AI security gap teams must close

At a glance

What this is: Straikerai says RSAC 2026 highlights a shift in AI security from prompt-centric concerns to agentic risks where systems can misuse tools, abuse privilege, and execute multi-step attack chains.

Why it matters: This matters because IAM, PAM, and NHI teams now have to govern what AI systems can reach and do at runtime, not just what they are allowed to prompt or generate.

Context

Agentic AI changes the security problem because the system is no longer limited to producing text. Once an AI system can browse, retrieve, execute, and act across tools and workflows, access control, trust boundaries, and privilege management become part of the model’s security surface. That makes the governance gap as important as the technical one, especially where identities, tokens, and delegated access are involved.

The article frames RSAC 2026 as a signal that traditional model-security thinking is lagging behind operational reality. For IAM and NHI practitioners, the important point is not only that AI tools can be attacked, but that their runtime permissions, integrations, and session behaviour can be turned into an access path. That is a familiar identity problem in a new execution model.

Key questions

Q: What breaks when agentic security systems are governed like chatbots?

A: The control model breaks at runtime. Chatbot governance focuses on whether a response is safe, but agentic systems take actions through tools, loops, and chained decisions. That means the real risk is execution authority, scope creep, and side effects that occur before a human can review the outcome.

Q: Why do agentic AI systems increase initial access and privilege abuse risk?

A: Because they can chain valid access into multiple tool calls without needing a human to approve each step. If a secret is exposed or a role is overbroad, the agent can turn that access into data movement, service interaction or recursive task execution. The risk rises when access outlives the task that created it.

Q: How do security teams know whether agent guardrails are working?

A: They know guardrails are working when denied tool calls are visible in logs, high-risk paths are blocked consistently, and the agent cannot override policy from inside its own session. Observe mode is useful first because it shows what the agent actually tries to do before the team decides where to deny access. The signal is repeatable enforcement, not model compliance.

Q: What should security teams do when agents rely on MCP servers and SaaS connectors?

A: They should treat connectors as privileged trust paths and review them like any other sensitive integration. That means validating authentication, narrowing authorization, and removing unnecessary routes to data or execution. If the connector can reach high-value systems, it must be governed as part of the agent’s effective privilege set.

Technical breakdown

Why agentic AI breaks static vulnerability scoring

Traditional scoring models assume a vulnerability is a discrete defect in a system. Agentic AI is different because the risky behaviour may emerge from how an agent reasons, chooses tools, and chains actions across sessions. In that setting, the blast radius is a workflow, not a host, and the exploit path can be compositional rather than linear. That is why agentic risk needs scoring that reflects autonomy, actionability, and downstream effect, not just prompt-level exposure or model misbehaviour.

Practical implication: Use risk models that account for agent capability, tool reach, and downstream workflow impact, not only model inputs.

How tool access turns agents into a new attack surface

The article’s strongest technical point is that agents with access to browsers, local files, APIs, MCP servers, and SaaS systems create a broader attack surface than a conventional chatbot. When an attacker can influence an agent, the next step is often not data theft alone but OS-level actions, credential harvesting, or persistence through trusted integrations. This is where AI security intersects directly with identity security: delegated access, short-lived tokens, and service permissions become the mechanisms that determine how far manipulation can travel.

Practical implication: Treat every connected tool as a privilege boundary and inventory the identities and tokens that make agent actions possible.

Why runtime visibility matters more than pre-deployment testing

Pre-deployment testing can tell you whether a model or agent behaves safely under known conditions, but it cannot fully predict how that system will act once it is connected to real tools and real data. Runtime monitoring is therefore essential because agentic abuse often appears as legitimate-looking actions spread across multiple steps. The defensive question changes from whether the prompt was malicious to whether the agent’s sequence of actions stayed within the intended trust boundary.

Practical implication: Monitor live agent actions, tool calls, and privilege use so you can detect harmful chains that static testing will miss.

Threat narrative

Attacker objective: The attacker wants to turn an agent’s legitimate access and autonomy into a durable path for data theft, workflow manipulation, or broader compromise.

1. Entry begins when an attacker manipulates an agent through prompt injection, context poisoning, or a compromised tool path.
2. Credential access or privilege abuse follows when the agent reaches local files, APIs, MCP servers, or SaaS systems with delegated permissions.
3. Escalation occurs as the manipulated agent chains legitimate tools into browser actions, file access, command execution, or workflow hijacking.
4. Impact is achieved when the attacker influences decisions, steals data, or persists through trusted AI workflows rather than conventional malware.

Breaches seen in the wild

• SalesBleed Salesforce Agentforce 2026: Three fixed Agentforce flaws let poisoned web leads make AI agents leak CRM data with zero clicks and send phishing under the agent's identity.
• Meta Muse agent hijack 2026: An undocumented Muse setting let local malware hijack Meta's personal AI agent, steal its authentication material and abuse user access.

Read and download The State of NHI & AI Agent Breach Report 2026, covering 200+ breaches impacting Non-Human Identities including AI Agents.

NHI Mgmt Group analysis

Agentic AI security is now an identity governance problem, not just a model-safety problem. Once agents can browse, retrieve, execute, and act, the controlling question becomes who or what is allowed to delegate authority to them and with what limits. That shifts attention from prompt filtering to access scope, session control, and runtime oversight. Practitioners should treat agent permissions as governable identity relationships, not as incidental implementation detail.

Workflow compromise is the right named concept for this phase of AI risk. The article shows that the real danger is not a single bad output but the misuse of a whole chain of actions across tools, data, and services. That means defenders need to understand how trust compounds across a workflow, especially when a human approves a starting action but the agent executes multiple downstream steps. The practical conclusion is that one approval cannot be assumed to bound the full outcome.

AI systems expose a privilege-abuse gap that conventional IAM never had to model. Traditional IAM assumes access can be reviewed, certified, and revoked on a lifecycle rhythm. Agentic systems can acquire value, act, and release access inside a short execution window, which makes static review controls too slow to be sufficient on their own. The security lesson is to govern privilege at issuance and execution time, not only after the fact.

Tool integrations are becoming the new perimeter for both AI and identity security. MCP servers, APIs, SaaS connectors, and local desktop integrations are no longer just plumbing. They are the path by which agent behaviour becomes operational reality, and therefore the point where trust can be abused. Teams should stop treating the agent as the only object of concern and start governing the connective tissue around it.

Runtime observability is now a prerequisite for AI risk management. Without inventory, execution visibility, and action-level telemetry, multi-step attacks will look like normal automation until damage is already underway. That is a governance failure as much as a detection failure. The field needs controls that can explain not just what the agent was asked to do, but what it actually did.

From our research library:

• Gartner predicts that AI systems will initiate 50% of all service requests by 2030, driven largely by agentic AI.
• Read next: Agentic AI Identity Guide

What this signals

Workflow compromise: agentic AI shifts the primary concern from unsafe outputs to unsafe sequences of action, which means teams need governance that follows the workflow rather than the prompt.

The 69% of security leaders agree identity management must fundamentally shift to address agentic AI systems, according to the 2026 Infrastructure Identity Survey. That is the right directional signal, but the practical test is whether organisations can inventory agents, bound their tool reach, and observe runtime behaviour before damage occurs.

For practitioners

• Map agent authority before expanding deployment Inventory every agent, its connected tools, and the identities or tokens it can use so you know which actions are actually reachable.
• Separate agent permissions from human privileges Do not let agents inherit broad user rights by default. Define narrow execution scopes for browsing, retrieval, file access, and SaaS actions.
• Instrument runtime action monitoring Collect telemetry on agent tool calls, approval steps, and cross-system actions so unusual multi-step behaviour can be detected during execution.
• Harden MCP and API connections Review connector trust, authentication, and authorization for MCP servers and APIs that agents can reach, then remove any unnecessary access paths.
• Redesign controls around outcomes, not prompts Measure whether an agent stayed within its intended workflow boundary, not only whether the initial prompt looked safe or compliant.

Key takeaways

• Agentic AI changes the security question from what the model generates to what the system is allowed to do across connected tools and workflows.
• The main failure mode is workflow compromise through delegated access, where an attacker can turn legitimate agent action into multi-step abuse.
• Runtime visibility and privilege scoping are the controls that matter most because static testing cannot reliably predict live agent behaviour.

Key terms

• Agentic AI: Autonomous AI systems capable of planning, deciding, and taking actions, including calling APIs, writing code, and orchestrating other agents, with minimal human oversight. Agentic AI introduces new NHI risks as agents must authenticate to external services.
• Workflow compromise: A failure mode where the attacker does not need to break the underlying system directly, but instead uses a trusted process to trigger unauthorised action. In email, the workflow itself becomes the attack surface when message content can influence automated decisions.
• Runtime Guardrail: A control applied while an AI agent is operating, not just during configuration or review. Guardrails can block dangerous tool calls, require approval for sensitive actions, or stop data leakage before it reaches systems or users.
• Delegated Access: Delegated access is permission granted to one identity to act on behalf of another user, service, or system. In NHI environments, this usually appears in OAuth-connected apps and automation tooling. It is powerful, but it must be tightly scoped and reviewed because it can persist long after the original business need ends.

Deepen your knowledge

NHI Foundation Level course, the industry's only accredited NHI security programme, covers NHI governance, agentic AI identity, and workload identity for practitioners who need to govern delegated access and runtime behaviour. It gives security and IAM teams a common baseline for managing identity risk across humans, services, and agents.