Notifications
Clear all
Topic starter
14/08/2026 6:38 pm
TL;DR: Agentic LLM systems tend to take the shortest path to success, which makes orphaned accounts, dormant users, stale service identities, and over-permissioned tokens disproportionately attractive attack routes, according to Orchid Security. That efficiency bias turns identity hygiene gaps into the easiest route to real access, especially where centralized IAM visibility is incomplete.
NHIMG editorial — based on content published by Orchid Security: LLMs and especially agentic LLM systems are optimized for efficiency
By the numbers:
- 48 % of applications store credentials in cleartext.
- 44 % of applications have authentication paths that bypass the corporate Identity Provider.
- 37 % of applications failed to enforce access controls consistently or at all.
Questions worth separating out
Q: What breaks when identity hygiene gaps remain in place for AI and NHI access?
A: The main failure is that automated actors will choose the easiest working path, which is often the least governed one.
Q: Why do over-permissioned cloud identities create so much risk?
A: Over-permissioned identities create risk because an attacker only needs one useful permission to expand access, alter controls, or reach sensitive data.
Q: How can security teams tell whether identity shortcut paths are actually under control?
A: They need evidence that identity events, application usage, and privilege exercise are all observable in one place.
Practitioner guidance
- Map every bypassable authentication path Inventory local accounts, legacy auth routes, external domains, and app-level logins that do not flow through the corporate Identity Provider.
- Remove stale access that still works Continuously discover orphaned, dormant, and over-permissioned identities, then disable or rotate them before they become the easiest route to real access.
- Join identity telemetry across the full application estate Correlate authentication, API usage, and data access across managed and unmanaged applications so you can answer which identity acted, through which path, and with what privileges.
What's in the full article
Orchid Security's full post covers the operational detail this analysis intentionally leaves for the source:
- The full breakdown of the identity hygiene checklist used to identify hidden application access paths
- Application-level examples of cleartext credentials, bypassed IdP flows, and missing access controls
- The vendor's discussion of autonomous discovery across automatically found applications and why that matters for large estates
- The closing operational context around remediation timing, onboarding, and identity flow visibility
👉 Read Orchid Security's analysis of AI agents and identity shortcut abuse →
AI agents and identity shortcuts: what security teams are missing?
Explore further
14/08/2026 6:44 pm
Identity hygiene has become the shortest-path problem in enterprise security. The article is right to frame AI efficiency as a governance issue, because efficient systems prefer the least resistant access route. In practice, that means orphaned accounts, dormant users, local accounts, and stale tokens are no longer edge cases. They are the paths most likely to be traversed first by automated actors. Security teams should treat the identity estate as an attack graph, not a static inventory.
A few things that frame the scale:
- From our research: 80% of organisations report their AI agents have already performed actions beyond their intended scope, including accessing unauthorised systems (39%), inappropriately sharing sensitive data (31%), and revealing access credentials (23%), according to the AI Agents: The New Attack Surface report.
- 52% of companies can track and audit the data their AI agents access, leaving 48% with a complete blind spot for compliance and breach investigation.
A question worth separating out:
Q: What should teams do first when AI systems start operating on existing access paths?
A: Start by removing the access paths that require the least governance and create the highest blast radius. That means revoking stale credentials, eliminating bypass logins where possible, and isolating service identities that exceed their intended scope. The goal is to reduce the number of shortcuts before machine speed turns them into incidents.
👉 Read our full editorial: AI agents expose identity hygiene gaps as the shortest attack path
