Zenity Labs shows how AI agent security is becoming a field

At a glance

What this is: Zenity Labs frames AI agent security as an emerging field shaped by research, standards participation, open-source tooling, and community activity rather than isolated vendor guidance.

Why it matters: This matters because practitioners now need to evaluate agent identity and authorisation through evolving standards, not just ad hoc controls, as agentic systems move from experiments into operational environments.

Context

AI agent security is the problem space where autonomous software acting on behalf of a user or system is granted tools, permissions, and execution paths that can change at runtime. In this article, Zenity Labs argues that the discipline is becoming a field in its own right because the research, standards, and community layers are now developing together.

For IAM and security teams, that matters because agentic behaviour changes how identity, authorisation, and accountability are governed. The article is not about a single product capability; it is about the ecosystem needed to understand, standardise, and operationalise AI agent security at scale.

Key questions

Q: How should security teams govern agentic AI when agents can delegate to sub-agents?

A: Treat delegation as a first-class identity boundary. Define who can spawn sub-agents, how deep delegation may go, what scopes can be inherited, and when the chain must be revalidated. Without those controls, authority can expand faster than governance can attribute it, which is exactly where autonomous systems become difficult to contain.

Q: Why do AI agents create a different authorisation problem from ordinary automation?

A: Ordinary automation follows predefined rules, so the access path is known before execution starts. AI agents can choose actions, tools, and timing within the session, which means least privilege has to hold during runtime, not just at provisioning. That changes authorisation from a static setup task into a live governance control.

Q: What are the signs that agent security is becoming an operational discipline?

A: The clearest signs are shared standards language, repeatable testing methods, public threat research, and documented ownership for agent authority. When teams start using the same terms for agent identity, access, and misuse, the programme is moving from experimentation to governance.

Q: How can organisations keep pace with new AI agent attack patterns?

A: Organisations keep pace by building a fast intake path from external research into internal controls, exercises, and policy updates. If a team cannot turn new findings into test cases or access decisions quickly, it will fall behind the rate at which agent behaviour and attack methods evolve.

Technical breakdown

Why AI agent security needs its own research discipline

AI agent security is different from classic application security because the risk surface is shaped by runtime tool use, delegated permissions, and actions taken on behalf of a principal. Zenity Labs describes research as the mechanism that uncovers those gaps early, before patterns become accepted practice. Public disclosure matters because the attack surface is not static: agent behaviour, integrations, and autonomy levels can shift as platforms change. That makes security research part of the control plane, not just a support function. The practical question for defenders is whether they have enough visibility into how agents obtain, combine, and exercise authority.

Practical implication: Treat agent behaviour as a governance surface that must be studied continuously, not only monitored after deployment.

How standards turn agent security into something governable

Standards matter because they translate novel agent behaviours into shared language for policy, control design, and procurement. Zenity Labs points to work across OWASP projects and NIST engagements as scaffolding for that translation. In practice, that means agent identity, authorisation, and safe tool use stop being purely vendor-specific claims and become auditable requirements. The point is not that standards solve the problem by themselves, but that they make the problem discussable across teams, sectors, and regulators. Without that shared vocabulary, every organisation reinvents the same control failures in isolation.

Practical implication: Anchor agent governance in standards language so security, risk, and procurement teams evaluate the same control expectations.

Why open source changes the pace of agent security maturity

Open source accelerates AI agent security because it turns research into reusable artefacts rather than one-off findings. Zenity Labs frames this as a deliberate way to help the wider community test attack paths, compare control ideas, and share defensive logic. That matters in agentic systems because the threat model is moving faster than closed, siloed programmes can absorb. The ecosystem benefits when tools, techniques, and community review are visible early. For practitioners, the lesson is that maturity is increasingly measured by how quickly new findings can be operationalised across teams, not by how quietly they are kept internal.

Practical implication: Use open-source research outputs to shorten the gap between discovery, validation, and defensive adoption.

NHI Mgmt Group analysis

AI agent security has crossed the line from niche research topic to field-level discipline. Zenity Labs is describing an ecosystem where research, standards, tooling, and community are now developing in parallel, which is what mature security domains look like before they become operationalised at scale. That matters because agentic AI changes faster than ordinary control programmes can absorb, so the field needs shared language before it can achieve consistent governance. Practitioners should expect the discipline to consolidate around repeatable methods rather than isolated discoveries.

Identity and authorisation for agents is the governance centre of gravity. Once an agent can select tools and act with delegated authority, the question is no longer only whether it is authenticated. The real issue is how runtime authority is bounded, monitored, and made legible to security and risk owners. That places agent identity in the same strategic tier as secrets management and privilege governance. Practitioners should treat agent authorisation as a first-class control domain, not a feature of application access.

Standards work is now a control mechanism, not just a policy exercise. Zenity Labs' participation in OWASP, MITRE ATLAS, and NIST discussions signals that the market is trying to stabilise terminology and testing assumptions while the technology is still moving. That is a strong indicator that vendor claims alone will not be sufficient for procurement or assurance. Practitioners should align internal requirements to emerging standards early so they are not forced to retrofit governance after adoption.

Open collaboration is becoming part of the defensive posture. In agentic AI, closed-door security programmes tend to lag the rate of change because new attack paths, new tools, and new integration patterns emerge too quickly. Public research, open-source tooling, and practitioner communities create faster feedback loops between discovery and defense. That does not eliminate risk, but it shortens the period during which a blind spot can remain unexamined. Practitioners should expect shared learning to outperform isolated experimentation in this domain.

Runtime behaviour is the new test for agent governance. The field will not be judged by whether organisations can describe agentic AI in policy language. It will be judged by whether they can constrain what agents do after authentication, after tool selection, and after delegation begins. That is a higher bar than traditional application security or static IAM models. Practitioners should assume that control maturity will increasingly be measured by runtime observability and bounded authority rather than access issuance alone.

What this signals

Agent security will mature fastest where research, standards, and operations are deliberately connected. Zenity Labs is pointing to a broader market shift in which AI agent governance is no longer just a technical experiment. Practitioners should expect assurance to come from control definitions, shared terminology, and repeatable review processes rather than from isolated point solutions.

Runtime authorisation is the pressure point that most programmes will have to rework. Static IAM assumptions break down when an agent can choose tools and actions as it executes a task. Security teams should prepare to evaluate whether their current identity model can express bounded authority after delegation begins, not just at the point of login.

For practitioners

• Define an agent governance model Map which systems qualify as AI agents, what authority they receive, and which business owners approve that delegation before rollout.
• Separate research, standards, and operations Create a clear path from external findings to internal policy updates, control testing, and security reviews so new agent risks do not stall in analysis.
• Review runtime authorisation boundaries Check whether current authorisation logic can describe what an agent may do during execution, not only what it may access at login or task start.
• Adopt a shared agent risk vocabulary Use emerging standards, threat taxonomies, and internal review language so security, legal, procurement, and engineering teams assess the same control questions.

Key takeaways

• AI agent security is evolving into a field with its own research, standards, and community structures, which means programme owners can no longer treat it as a side topic.
• The central governance issue is whether identity and authorisation models can constrain agent behaviour after delegation begins, not only before execution starts.
• Practitioners should align policy, testing, and standards mapping now so agent risk does not outpace their ability to govern it.

Key terms

• AI Agent Security Risk Review: An AI agent security risk review is an internal assessment that tests what a deployed agent can actually be made to do, who owns it, and whether its behavior fits bank risk policy. It goes beyond documentation to examine live tool use, data access, and governance accountability before or after deployment.
• Runtime Authorisation: Runtime authorisation is the practice of deciding access while a task is in progress, rather than only at provisioning time. It matters for NHIs because credentials and entitlements can change risk mid-session, especially when automation or AI agents interact with sensitive systems.
• Agent Governance: Agent governance is the set of policies, controls, and evidence required to manage autonomous software as a non-human identity. It covers consent, tool access, lifecycle review, audit logging, and revocation so that an agent remains bounded as its workflows change.
• Agentic AI: Autonomous AI systems capable of planning, deciding, and taking actions, including calling APIs, writing code, and orchestrating other agents, with minimal human oversight. Agentic AI introduces new NHI risks as agents must authenticate to external services.

Deepen your knowledge

NHI governance, agentic AI identity, and machine identity security are core topics in our NHI Foundation Level course, the industry's only accredited NHI security programme. If you are building or maturing an IAM programme, it is worth exploring.