SharedRoot shows why AI agent identity is the real blast radius

At a glance

What this is: SharedRoot is a sandbox escape analysis showing that AI agent risk extends beyond isolation failures into identity scope and blast-radius control.

Why it matters: It matters because IAM, PAM, and NHI teams must govern what an agent can reach if a runtime boundary fails, not just whether the boundary exists.

By the numbers:

• 90% of IT leaders say properly managing NHIs is essential for a successful zero-trust implementation.
• NHIs outnumber human identities by 25x to 50x in modern enterprises.
• Only 5.7% of organisations have full visibility into their service accounts.
• 80% of identity breaches involved compromised non-human identities such as service accounts and API keys.

👉 Read Unosecur's analysis of the SharedRoot sandbox escape and agent trust model

Context

AI agent identity risk is not limited to model behaviour or prompt safety. When an agent operates with access to folders, tools, or local credentials, the real control question becomes what the actor can reach if the sandbox, mount, or runtime boundary fails.

SharedRoot illustrates that boundary design and identity governance are now inseparable. In this case, a local VM escape turned a scoped session into host-level access, which is the same blast-radius problem identity teams already see in overprivileged service accounts and unmanaged machine credentials.

For teams running agentic systems, the relevant programme lens is not only containment but entitlement scope, credential exposure, and operational visibility. The starting assumption that an agent can be trusted with broad access because the runtime is isolated is a fragile one.

Key questions

Q: What breaks when an AI agent has sandboxed execution but still inherits host credentials?

A: The control model breaks because isolation and identity scope are not the same thing. A sandbox can confine execution, but if the agent inherits the host user's SSH keys, cloud credentials, or mounted filesystem access, a breakout becomes a full trust compromise. Security teams should design for the resources the agent can reach, not only the environment it runs in.

Q: Why do AI agents complicate least-privilege design?

A: AI agents complicate least-privilege design because their tool use can change dynamically while the underlying permissions remain persistent. The system may need broad enough access to complete a task, but that same access can overshoot if scope is not tightly controlled. The fix is task-scoped authorisation with clear boundaries, not wider standing access.

Q: How do security teams know if an AI agent has too much access?

A: Look for agents that can reach multiple systems without task-specific limits, use persistent tokens, or touch high-value services such as email, chat, cloud consoles, and file stores. A healthy deployment leaves a clear audit trail of what the agent can do, what it actually did, and which credentials it used.

Q: Who is accountable when an AI agent exposes credentials or changes identity state?

A: Accountability should sit with the business owner of the agent, the identity team that granted scope, and the control owner responsible for the affected workflow. If the agent touched privileged systems, incident handling should follow the same seriousness as any privileged access failure, because the issue is not just misuse but governance collapse across the identity layer.

Technical breakdown

Why sandbox isolation alone does not solve agent identity risk

A sandbox constrains where code runs, but it does not answer what the actor is allowed to touch if that boundary fails. In SharedRoot, the agent lived inside a Linux VM on macOS, yet the host filesystem and local credentials were still within practical reach because identity scope and runtime scope were not aligned. That is the core failure mode in agentic systems: isolation controls the container, while identity controls the blast radius. If the agent inherits the human user's reach, any breakout becomes a host-wide access event instead of a contained exception.

Practical implication: treat sandboxing as a boundary control, not an entitlement model.

How mounted folders and inherited credentials expand the blast radius

Mounted folders are not just data paths. When a local agent session can see shared mounts, autoloaded modules, and the human user's credential stores, the runtime inherits the surrounding operating context. That makes the effective privilege set much larger than the agent task requires. In identity terms, the actor is operating with standing access to adjacent assets that were never explicitly approved for that workflow. The danger is not only compromise of the sandbox, but lateral exposure into SSH keys, cloud tokens, and configuration secrets already present on the endpoint.

Practical implication: scope agent sessions to task-specific resources and separate them from endpoint credential stores.

Identity-first governance for AI agents needs observable tool use

The stronger lesson is that AI agent governance cannot depend on assumptions about the integrity of the runtime alone. Tool access, secret exposure, and action logs must be tied back to the identity that initiated them, otherwise post-incident review collapses into guesswork. Agentic systems need explicit evidence of what was touched, when, and under whose authority. That is where identity governance and runtime telemetry overlap: the first defines allowable reach, the second proves whether that reach was used as intended.

Practical implication: log agent tool use, access scope, and secret exposure as one reviewable control plane.

Threat narrative

Attacker objective: The objective is to turn a scoped agent session into access to host credentials and broader local resources that were never intended for the task.

1. Entry occurred through a local AI agent session running inside a sandboxed Linux VM that could still interact with host-linked resources and mounted folders.
2. Escalation followed a VM escape chain that let the agent cross the guest-host boundary and inherit the macOS user's broader filesystem reach.
3. Impact was host-level exposure of SSH keys and cloud credentials, turning a scoped session into a full trust and blast-radius problem.

Breaches seen in the wild

• Meta AI Instagram Account Takeover — 20,225 Instagram accounts hijacked via compromised Meta AI support chatbot with overprivileged access.
• Replit AI Tool Database Deletion — Replit vibe coding AI assistant deletes live production database and creates 4,000 fake user records.

Read our 52 NHI Breaches Analysis report for a comprehensive view of breaches impacting Non-Human Identities including AI Agents.

NHI Mgmt Group analysis

AI agent sandboxing is not an identity control. Isolation limits execution environment, but it does not define what the actor may reach if the boundary fails. SharedRoot shows why endpoint trust, mounted data, and credential presence must be treated as part of the same control surface. Practitioners should stop treating runtime containment as a substitute for entitlement design.

Identity blast radius is the right governing concept for agentic access. When an agent inherits the human user's reach, a single breakout becomes a host-wide trust event. That is structurally different from a normal application vulnerability because the exposure is defined by the surrounding identity context, not by the agent alone. The practical conclusion is that agent access must be measured by reach, not by session existence.

Least privilege for AI agents must be evaluated at the task level, not the device level. A folder-scoped or app-scoped session can still expose secrets that are irrelevant to the job. The issue is not whether the VM is hardened, but whether the agent's effective permissions are smaller than the endpoint's ambient credentials. Teams should govern what the agent can do, not just where it runs.

SharedRoot exposes a named concept: identity blast radius. This is the distance between an agent's intended task scope and the credential, file, and system access it can actually touch. The more that gap depends on local trust, the more a breakout turns into enterprise compromise. Practitioners should treat that gap as a measurable governance defect, not an abstract architecture concern.

Agentic risk management has to connect access, logging, and revocation. The security question is no longer whether the sandbox failed in isolation, but whether the surrounding identity model contained the failure. If logs do not show which agent touched which tool and which secrets were exposed, the programme cannot distinguish normal use from unsafe reach. That is a governance gap, not just a technical one.

From our research:

• 80% of identity breaches involved compromised non-human identities such as service accounts and API keys, according to Ultimate Guide to NHIs.
• 71% of NHIs are not rotated within recommended time frames, increasing the risk of compromise over time.
• 52 NHI Breaches Analysis shows how standing access and weak lifecycle governance turn small exposures into enterprise incidents.

What this signals

Identity blast radius will become a practical control metric for AI agent programmes, because sandbox integrity alone does not reveal how much host trust a session inherits. Teams that still measure only container boundaries will miss the wider question of whether an agent can see credentials that were never required for the task.

With 97% of NHIs carrying excessive privileges, per the Ultimate Guide to NHIs, the same pattern is now visible in agentic environments: ambient trust is doing more work than explicit governance. That means access review, secrets handling, and endpoint policy need to converge around the agent session, not stay in separate operational silos.

For practitioners

• Measure agent identity blast radius Inventory every AI agent session that can see local folders, cloud tokens, SSH keys, or shared mounts, then compare intended task scope to actual reachable resources. If the reachable set is larger than the task requires, the access model is already too broad.
• Separate agent sessions from endpoint credentials Move human and machine credentials out of the same operating context as the agent wherever possible, especially on developer laptops and local sandbox hosts. The goal is to keep a breakout from automatically exposing the user's full credential store.
• Tie tool use to a reviewable identity record Ensure every agent action is logged with the initiating identity, the connected tool, the scope in force, and the data touched. Without that record, incident response cannot tell whether the problem was the sandbox, the access model, or both.
• Re-test local agent defaults after platform changes Check whether a product default, such as cloud execution, has hidden a local risk without removing it from older deployments. Programmes that still allow local agent execution should assume the older path remains relevant until confirmed otherwise.

Key takeaways

• SharedRoot shows that a sandbox escape becomes an identity incident when the agent inherits host-level trust and credentials.
• The scale problem is blast radius, not just code vulnerability, because exposed SSH keys and cloud credentials can sit inside the same session boundary.
• Teams need task-scoped access, credential separation, and reviewable agent logs before local agent execution becomes a default operating model.

Key terms

• Identity Blast Radius: The amount of damage a compromised identity can cause across systems, data, and infrastructure. In NHI environments, it is shaped by permissions, network reach, and administrative capability rather than by the credential alone. Reducing blast radius is a containment strategy that limits lateral movement and data exposure.
• Agentic Access: Agentic access is delegated system access granted to an AI agent or autonomous workflow so it can perform defined tasks across tools and data sources. It differs from human access because the actor can execute continuously, combine actions quickly, and amplify mistakes at scale.
• Standing Trust: Persistent confidence in an identity, broker, or automation path to request privilege without sufficient ongoing verification. For NHIs, standing trust can remain even when credentials are short lived, which means the organisation has reduced exposure time but not necessarily reduced the chance of abuse.

What's in the full article

Unosecur's full blog post covers the operational detail this analysis intentionally leaves for the source:

• A breakdown of the SharedRoot chain and the specific local VM conditions that allowed the escape.
• Unosecur's description of the MCP Gateway controls for JIT access, least privilege, and tool-call logging.
• The access analyzer and DLP handling details that show how the gateway inspects MCP traffic for secrets and overprovisioning.
• The practical workflow for tying AI client actions back to the real human identity behind the session.

👉 The full Unosecur post covers the SharedRoot chain, host credential exposure, and the identity-layer controls it proposes.

Deepen your knowledge

NHI governance, agentic AI identity, and machine identity lifecycle are core topics in our NHI Foundation Level course, the industry's only accredited NHI security programme. If you are building or maturing an IAM programme, it is worth exploring.