Top agentic AI risks demand identity-centric governance and Zero Trust

At a glance

What this is: This is an analysis of the top enterprise security risks introduced by agentic AI, with a central finding that identity-centric governance and Zero Trust controls are required because autonomous agents can act, access systems, and execute commands.

Why it matters: It matters because IAM, PAM, and NHI teams now have to govern not just credentials and permissions, but agent behaviour, tool trust, and session-level decision making across production environments.

Context

Agentic AI changes the identity problem because the system is no longer just generating text or recommendations. It can execute actions, call tools, reach into SaaS platforms, and make operational decisions that carry real access consequences.

For identity programmes, that shifts the control plane from human workflow approval to runtime governance over non-human identities, permissions, and trust boundaries. The article's core argument is that conventional access models break down once an AI system can initiate its own action path.

The same issue becomes more acute when agents are given broad privileges, untrusted inputs, and connected tools at the same time. In that configuration, risk is no longer hypothetical automation drift; it is a governance gap around autonomous execution.

Key questions

Q: What breaks when AI agents are given broad inherited permissions?

A: Broad inherited permissions break the assumption that access is tied to a narrow business need. The result is larger blast radius, weaker accountability, and faster propagation of mistakes or abuse across connected systems. A single compromised or misconfigured agent can then touch far more data and workflows than the original task required.

Q: Why do autonomous AI systems create more identity risk than normal automation?

A: Normal automation follows a fixed path, but autonomous systems can interpret goals, choose actions, and continue without waiting for a person. That makes intent less predictable and review cycles less useful. The risk increases when the system can broaden scope or trigger actions that affect data, money, or compliance.

Q: What are the signs that agent identities are poorly governed?

A: Common signs include shared service accounts, long-lived OAuth grants, unclear ownership, and logs that cannot distinguish agent actions from human actions. If the audit trail cannot answer who delegated the work and what scope applied, the identity model is already failing. That is a governance problem, not just a logging problem.

Q: How should organisations govern external tools used by AI agents?

A: Organisations should review external tools as security inputs, not convenience features. Each tool needs ownership, approval, metadata inspection, and ongoing monitoring for hidden instructions or unexpected behaviour. If an AI agent can act on a tool, then the tool’s provenance and control status should be governed like any other sensitive integration.

Technical breakdown

Prompt injection turns content into an access path

Prompt injection is the manipulation of an agent through text it processes, such as documents, emails, web pages, or repository content. The danger is not the prompt itself but the fact that the agent may treat untrusted content as instruction, then use legitimate tools and credentials to carry out attacker-directed actions. In agentic environments, this collapses the line between data intake and execution. Once the model can act, any input surface becomes a potential control surface, which is why policy enforcement must sit around the agent runtime, not just the model interface.

Practical implication: inspect and constrain agent inputs before they can influence tool use or privileged actions.

Standing privilege becomes a compound agent risk

Agent identity sprawl happens when every agent, integration, and task creates a persistent identity or credential set without a clear lifecycle. That produces standing privilege, shared secrets, and ownership ambiguity, which is familiar NHI risk but amplified by agent proliferation. The security issue is not only excess access at provisioning time; it is that the access often remains active long after the task, context, or owner has changed. In practice, this creates a large, hard-to-audit population of machine identities that can be reused, inherited, or forgotten.

Practical implication: treat each agent as a governed NHI with unique identity, ownership, and offboarding.

Why the lethal trifecta creates systemic compromise

The article's 'lethal trifecta' combines broad permissions, untrusted input, and autonomous execution. Together, these conditions create a structurally weak trust model because the agent can read attacker-shaped content and then act with enterprise-level authority before a human review step occurs. That is why Zero Trust is relevant here: not as a slogan, but as a way to force continuous verification of identity, context, and authorization around every action. The central technical issue is that the agent is both the interpreter of input and the executor of impact.

Practical implication: separate input trust from action authority and gate high-risk operations with continuous authorization.

Threat narrative

Attacker objective: The attacker aims to turn a trusted AI agent into a privileged execution path for stealing credentials, bypassing controls, and compromising enterprise systems.

1. Entry occurs when malicious instructions are embedded in content that an AI agent processes, such as documents, emails, web pages, or repository files.
2. Credential access follows when the manipulated agent uses its legitimate credentials, tokens, or connected tools to reach sensitive systems and data.
3. Escalation occurs when over-permissioned access lets the agent or attacker chain actions across tools, bypass controls, or trigger persistence on the host.
4. Impact is unauthorized access, credential theft, privilege abuse, and persistent compromise of underlying systems or workflows.

Breaches seen in the wild

• CoPhish OAuth phishing via Copilot Studio: Datadog showed Copilot Studio agents on a Microsoft domain can front OAuth consent phishing and forward stolen tokens; no victims reported.
• postmark-mcp malicious MCP server 2025: A fake Postmark MCP server on npm quietly BCC'd every email AI agents sent through it to an attacker, using victims' own Postmark tokens.

Read and download The State of NHI & AI Agent Breach Report 2026, covering 200+ breaches impacting Non-Human Identities including AI Agents.

NHI Mgmt Group analysis

Identity governance for agentic AI is now a runtime control problem, not a provisioning problem. The article shows that agents do not just hold credentials, they execute actions, choose tools, and absorb untrusted inputs. That means access reviews and static approval flows are no longer enough on their own. Practitioners need to think in terms of continuous authorization, action scoping, and lifecycle governance for non-human identities.

Standing privilege is the wrong default for agents because their value comes from change, not persistence. The more agents proliferate, the more organisations inherit identity sprawl, shared credentials, and unclear ownership. That pattern is familiar in NHI governance, but agentic AI makes it more volatile because access is often tied to dynamic tasks and external tools. The implication is that agent identity design must assume frequent creation, use, and decommissioning rather than permanence.

Lethal trifecta is the right named concept for this category of risk. Broad permissions, untrusted input, and autonomous execution combine into a compound failure mode that changes the security meaning of ordinary enterprise connectivity. This is not simply an over-permissioned app problem. It is a governance problem where runtime decisions and enterprise privileges converge, so practitioners should treat tool access, input trust, and execution rights as one control boundary.

Agentic AI collapses the separation between an identity and its decisions. For human IAM, authorisation often assumes a person initiates an action and a control evaluates it. For autonomous systems, the identity can originate the action path itself. That assumption failure changes how NHI programmes define accountability, because ownership without decision traceability is not governance. Practitioners should redesign controls around who or what can initiate execution, not just who can authenticate.

OpenClaw-style exposure shows why third-party tool trust now belongs in identity governance. The article's emphasis on plugins, APIs, MCP servers, and external integrations makes clear that agent risk extends beyond the agent itself. Tool trust, identity trust, and runtime trust are now coupled. The practitioner conclusion is straightforward: governance scope must expand from the agent object to the entire delegation chain and tool ecosystem.

From our research library:

• 69% of security leaders agree identity management must fundamentally shift to address agentic AI systems, according to the 2026 Infrastructure Identity Survey.
• 53% of security leaders expect AI to run major portions of their infrastructure autonomously within the next three years, according to the 2026 Infrastructure Identity Survey.
• Read next: Agentic AI Security Guide

What this signals

Lethal trifecta: When broad permissions, untrusted input, and autonomous execution coincide, the control problem shifts from managing requests to managing initiation. Access reviews that assume a person is in the loop will miss the moment an agent acts on its own, so governance has to move to the point of decision.

Agentic AI also pushes NHI programmes toward lifecycle discipline. The question is no longer whether an identity exists, but whether it can be owned, scoped, observed, and retired before it becomes a persistent trust path. That makes offboarding and entitlement review core design issues, not housekeeping.

For practitioners

• Define unique identities for every agent Assign each AI agent its own identity, ownership record, and authorization scope so you can trace use, revoke access, and prevent shared credential reuse.
• Constrain agent permissions to task scope Limit each agent to the minimum systems, data, and tools required for a specific workflow, then reassess scope as the workflow changes.
• Inspect untrusted inputs before execution Treat external content as a control boundary and block prompt-influenced actions until policy checks confirm the request is expected and allowed.
• Govern third-party tools as part of the agent trust chain Review plugins, APIs, MCP servers, and integrations as dependencies that can widen the attack surface even when the model itself is unchanged.
• Replace standing access with continuous authorization Re-evaluate whether the agent should retain access after each action or task, especially where credentials, tokens, or secrets are involved.

Key takeaways

• Agentic AI introduces a governance problem where identities can act, choose tools, and execute tasks rather than merely authenticate.
• The article ties that shift to concrete risk patterns including prompt injection, excessive permissions, secrets exposure, and audit gaps.
• Identity-centric governance, Zero Trust, and continuous authorization are the control themes that matter most for enterprise deployment.

Key terms

• Agentic AI: Autonomous AI systems capable of planning, deciding, and taking actions, including calling APIs, writing code, and orchestrating other agents, with minimal human oversight. Agentic AI introduces new NHI risks as agents must authenticate to external services.
• Shadow AI: AI agents, copilots, or connected tools operating without full visibility or governance from security teams. Shadow AI becomes an identity problem when those systems authenticate with unmanaged tokens, service accounts, or OAuth apps that can reach production resources.
• Standing Privilege: Standing privilege is access that remains active even when no immediate task requires it. For NHI programmes, it is a common failure mode because long-lived credentials and persistent roles create unnecessary exposure. Reducing standing privilege usually means tighter expiry, on-demand access, and clearer review of who or what still needs access.
• Prompt Injection (Agentic): An attack where malicious instructions are embedded in content that an AI agent reads, causing the agent to execute unintended actions using its own legitimate credentials. A primary vector for agent goal hijacking and identity abuse.

Deepen your knowledge

NHI governance, agentic AI identity, and machine identity lifecycle are core topics in our NHI Foundation Level course, the industry's only accredited NHI security programme. If you are building or maturing an identity security programme, it is worth exploring.