Topic starter
08/06/2026 4:35 pm
TL;DR: GPT-5 lowers the barrier to creating custom AI agents that connect to corporate systems through service accounts, API keys, and tokens, increasing the risk of unmanaged access, misconfiguration, and privilege exposure, according to Astrix Security. The real issue is not agent creation speed itself but the governance assumption that non-human access can remain visible, bounded, and reviewable once employees can spin it up in minutes.
Editorial analysis by NHI Mgmt Group, based on content published by Astrix Security: “NHI Governance for AI Agent Security in the Age of ChatGPT-5”.
Key questions
Q: What breaks when business users can build and deploy AI agents without strong guardrails?
A: Without guardrails, organisations can lose visibility into who built an agent, what it can access, and what it can do once triggered.
Q: Why do AI agents make excessive access more dangerous than human access?
A: AI agents can use inherited permissions continuously, across multiple systems, and at machine speed.
Q: How do security teams know if agent governance is actually working?
A: It is working only if the team can answer three questions quickly for any agent: what it can reach, what it did recently, and whether that behaviour matches intent.
Practitioner guidance
- Map every agent to an accountable owner Require a human owner for each custom or third-party agent, including who approved it, what it can reach and what business purpose it serves.
- Inventory agent identities and connected systems Create a live inventory of agents, their NHIs, the platforms they touch and the permissions each connector carries so shadow agents do not remain hidden.
- Constrain permissions to the minimum needed Remove broad connector scopes, review service account entitlements and block agents from inheriting human-level access by default.
Bottom line: GPT-5 lowers the friction of agent creation, but the security consequence is faster NHI sprawl rather than safer automation.
Explore further
View Full Forum → | NHI Foundation Course → | Our Services → | Read the full analysis →
This topic was modified 4 days ago by NHI Mgmt Group
08/06/2026 6:18 pm
GPT-5 does not create a new identity category, it compresses the lifecycle of an old one. The important change is that employees can now generate AI agents that immediately need accounts, tokens and permissions, often before security teams know they exist. That is a governance acceleration problem, not merely an AI adoption story. Practitioners should read it as a signal that agent inventory and ownership need to move to the front of the lifecycle.
A few things that frame the scale:
- 53% of security leaders expect AI to run major portions of their infrastructure autonomously within the next three years, according to the 2026 Infrastructure Identity Survey.
- 19% of organisations give AI systems dramatically more access than human employees, nearly one in five granting unrestricted privilege, according to the 2026 Infrastructure Identity Survey.
A question worth separating out:
Q: How should teams govern AI assistants, workflows, and autonomous agents differently?
A: Teams should govern them by runtime behaviour, not by model family. Assistants need strong prompt and response controls, triggered workflows need untrusted-input screening and narrow tool scope, and autonomous agents need separate identities, scoped delegation, and traceability across each decision. A single AI policy rarely fits all three.
👉 Read our full editorial: GPT-5 makes AI agent NHI sprawl faster and harder to govern
This post was modified 4 days ago by NHI Mgmt Group