The internet of agents is forcing a new security model

At a glance

What this is: This is a Lakera analysis of how the Internet of Agents changes AI security from protecting user prompts to governing interconnected AI-to-AI systems that can execute tasks independently and amplify failure across a network.

Why it matters: It matters because IAM, PAM, and AI governance teams will need to control agent capability, not just access, if they want to keep autonomous interactions observable, containable, and accountable.

Context

The internet of agents problem is not just about more AI usage, it is about a different operating model for access and action. When agents can initiate tasks, call tools, and exchange outputs without a human in the loop, existing approval and review assumptions start to break down.

For identity and access practitioners, the core governance question shifts from whether an agent can access a system to whether its actions remain bounded, attributable, and reversible once it starts acting on its own. That makes agent identity, authorisation, and oversight a programme issue rather than a feature-level control.

Lakera frames this as an emerging cybersecurity model shaped by AI-to-AI interaction, where risks compound through interconnected agents rather than isolated user sessions.

Key questions

Q: What breaks when an AI agent can act across multiple business systems?

A: Traditional helpdesk controls break because they assume a human can be held at the centre of the workflow. Once an agent can check eligibility, place an order, and notify other systems, entitlement scope and auditability become the real control points. If those are unclear, the workflow becomes difficult to contain or review.

Q: Why do agentic AI systems create more security risk than standard chatbots?

A: Agentic systems can turn model output into action, which means a bad instruction can affect code flow, tool use, and downstream state. Standard chatbots usually stop at text generation. Agentic AI adds execution authority, so compromise can lead to disclosure, unauthorized changes, or misuse of credentials.

Q: How should teams govern AI agents that can reach APIs, events, and memory?

A: Teams should govern those agents as runtime identities, not as isolated integrations. That means enforcing policy at execution time, logging every tool and data access, and binding actions back to a clear initiating workflow or identity. If the control plane cannot show who acted, what they reached, and why, the programme does not have usable governance.

Q: What is the difference between agent observability and agent containment?

A: Observability tells you what an agent did, while containment limits what it is able to do. Both matter, but observability without containment only helps after a failure, whereas containment reduces the chance that a compromised or misdirected agent can spread its impact.

Technical breakdown

Why agent-to-agent interaction changes the security boundary

The security boundary moves when AI systems stop acting only as assistants and start exchanging work directly with other AI systems. In a human-to-machine model, a person reviews the output and can stop the workflow. In an internet-of-agents model, the agent can continue negotiating, querying, transforming, and acting across multiple services without fresh human validation. That changes how trust is established, because the risk is no longer only what a user asks the model to do, but what the model can do once another system accepts its output as legitimate input.

Practical implication: Practitioners need to define policy at the point of agent action, not just at the point of user request.

Universal interface and universal capability expand attack surface

Lakera’s article points to two structural shifts: language models can interpret almost any input, and they can perform a wide range of tasks, including tool use and code execution. That combination broadens attacker access and increases blast radius because a single malicious prompt or malformed input can trigger actions the developer did not explicitly anticipate. In identity terms, this creates a more dynamic trust problem than traditional automation, because the same agent may move between reading, generating, calling APIs, and influencing other agents within one workflow.

Practical implication: Governance must account for capability creep and unexpected tool use, not just documented permissions.

Containment, traceability, visibility, accountability, and actionability

Lakera’s recommended foundation for the Internet of Agents is a control set built around containment, traceability, visibility, accountability, and actionability. These are not abstract principles. They describe whether an organisation can constrain agent behaviour, reconstruct what happened, assign ownership, and intervene when agent decisions become unsafe. For identity teams, this aligns closely with authorisation boundaries, auditability, and incident response, but the emphasis shifts to runtime behaviour across a network of agents rather than static access at login.

Practical implication: Build agent governance so every significant action can be traced back to a bounded identity and a clear owner.

Threat narrative

Attacker objective: The attacker wants to hijack agent behaviour so a single manipulated interaction can drive data exposure, unsafe execution, or network-wide propagation of failure.

1. Entry occurs when an attacker sends crafted input to an AI assistant or exploits a model that can ingest arbitrary content, such as an email sent to an inbox summariser.
2. Escalation happens when the agent turns that input into tool use, API calls, or code execution that the developer did not intend to be attacker-controlled.
3. Propagation follows when one compromised or manipulated agent influences downstream agents, allowing the same flawed instruction or poisoned data to spread across the network.
4. Impact is realised when interconnected agents leak data, execute unsafe actions, or amplify failures at scale faster than human reviewers can intervene.

Breaches seen in the wild

• iOS apps leaking hard-coded secrets: Cybernews found 71% of 156,080 iOS apps leak hard-coded secrets, with open cloud storage and Firebase databases exposing user data.
• CISA Private-CISA GitHub leak 2026: A CISA contractor's public GitHub repo exposed AWS GovCloud admin keys, Artifactory credentials and plaintext passwords for six months.

Read and download The State of NHI & AI Agent Breach Report 2026, covering 200+ breaches impacting Non-Human Identities including AI Agents.

NHI Mgmt Group analysis

Agent-to-agent trust is a new governance boundary: The internet of agents breaks the assumption that AI only acts in response to a human request and then stops. Once agents negotiate and execute with other agents directly, the trust boundary moves from the user interface to the runtime relationship between identities, tools, and downstream services. Practitioners should treat agent-to-agent interaction as a distinct governance surface, not just a more complex chatbot workflow.

Universal capability creates identity ambiguity: Lakera’s core insight is that modern agents can write, call APIs, generate media, and execute code within the same operational context. That collapses the old separation between read, decide, and act, which is exactly where conventional least-privilege assumptions become fragile. The implication is that authorisation can no longer be reasoned about as a static role assignment; it must be evaluated against what the agent can do at runtime.

Containment is becoming the primary control objective: In interconnected agent ecosystems, failure does not stay local. A compromised model, poisoned input, or unsafe tool path can propagate through downstream applications and agents at speed. This is why containment, not just detection, has to sit at the centre of the security model. Identity teams should expect runtime containment requirements to become part of both AI governance and broader access governance.

Accountability must follow delegated action, not just approved access: The article rightly elevates traceability and accountability because autonomous chains make post hoc ownership harder, not easier. When an agent acts through multiple services, the business question becomes who owns the decision path, who can stop it, and who is accountable when it exceeds intent. That pushes identity governance beyond provisioning into runtime responsibility management.

Internet of agents is a capability governance problem, not a model governance problem: The named concept here is the agent capability governance gap, the difference between controlling what a model may access and controlling what an interconnected agent is able to do at runtime. That distinction matters because the attack surface is created by actionability across a network, not by model quality alone. Practitioners should read the change as a governance redesign requirement, not a tuning exercise.

What this signals

Agent capability governance gap: Identity programmes now need to govern what an agent can do after it is trusted, not just whether it authenticated successfully. That means policy design has to shift from access approval to runtime action boundaries, especially where agents can call tools or chain into other systems.

The most important near-term change is that access reviews alone will not answer the operational question. If an agent can complete a harmful sequence faster than a review cycle can observe it, the governance model has to move to issuance-time and execution-time controls.

External standards work is still catching up, but the direction is clear: AI governance, identity governance, and incident response are converging around the same runtime control problem.

For practitioners

• Define runtime agent boundaries Set explicit limits on which tools, data sets, and downstream agents each autonomous system may reach during execution, and require those limits to be reviewable by identity and security teams.
• Map delegated actions to ownership Assign a human owner for every agent workflow that can initiate external actions, and ensure accountability remains visible when the workflow crosses systems or vendors.
• Instrument agent audit trails Capture prompts, tool calls, outputs, and downstream handoffs so investigators can reconstruct how an agent reached a decision and where propagation began.
• Separate assistive and autonomous use cases Classify which systems merely assist humans and which can act independently, then apply stricter containment and approval boundaries to the autonomous set.

Key takeaways

• The article argues that the Internet of Agents changes cybersecurity from user-centric protection to runtime governance of interconnected AI identities.
• Its central risk is not one model misbehaving in isolation, but a network effect in which tool use, API calls, and downstream agent handoffs amplify failure.
• Practitioners should respond by tightening containment, traceability, and accountability around agent actions rather than relying on human review alone.

Key terms

• Internet of Agents: A networked environment where AI systems communicate with one another, share context, and execute tasks across multiple tools or services. In security terms, the unit of governance is no longer a single assistant but the whole delegation chain and its downstream effects.
• Agent capability boundary: The defined limit around what an AI agent may touch, read, write, or contact during execution. It is stronger than a general environment restriction because it ties permission to task scope, making the boundary a governance control rather than just an infrastructure setting.
• Containment: The phase of incident response that stops an incident from spreading while preserving the evidence needed to investigate it. In cloud environments, containment often starts with identity revocation, isolation of workloads, and protection of logs before any system is terminated or cleaned up.
• Identity Traceability: Identity traceability is the ability to link each action back to a specific identity, authorisation path, and time window. It is essential when humans, service accounts, and AI agents all operate in the same environment and auditors need a defensible record.

Deepen your knowledge

NHI governance, agentic AI identity, and machine identity lifecycle are core topics in our NHI Foundation Level course, the industry's only accredited NHI security programme. If you are building or maturing an IAM programme, it is worth exploring.