Topic starter
11/07/2026 1:57 pm
TL;DR: Enterprises are using virtual machines to isolate AI agents, but Appgate argues that VM boundaries do not solve identity exposure when agents still rely on static credentials, broad network trust, and weak visibility into access. Isolation without identity controls leaves lateral movement and data leakage paths open.
Editorial analysis by NHI Mgmt Group, based on content published by Appgate: “Secure Sandboxes for AI Innovation: How AppGate ZTNA Protects Virtual Machines”.
Key questions
Q: What breaks when AI agents in VMs still rely on static trust and shared credentials?
A: VM isolation stops at the host boundary, but AI agents still need identity to reach APIs, data sources and external services.
Q: Why do virtual machines not solve AI agent access risk on their own?
A: Because isolation does not remove the need for credentials, tokens, or service permissions.
Q: How should teams secure AI agents running inside virtual machines?
A: Treat the VM as a place to run the workload, not a trust boundary.
Practitioner guidance
- Define workload-level identity boundaries Inventory every AI agent running in a VM and map the exact identities, secrets and entitlements it uses to reach APIs, data stores and model services.
- Replace broad network trust with context-aware policy Enforce identity, posture and purpose-based rules for each connection rather than trusting traffic because it originates from an internal VM.
- Remove static credentials from agent runtimes Eliminate shared credentials and long-lived secrets from agent environments where possible, and scope any remaining access to the narrowest task boundary.
Bottom line: AI agents in VMs are still governed by the identities and entitlements they carry, not by the isolation of the host alone.
Explore further
View Full Forum → | NHI Foundation Course → | Our Services → | Read the full analysis →
11/07/2026 2:08 pm
VM isolation is a boundary control, not a trust model. Virtual machines reduce blast radius, but they do not answer the identity question that matters for AI agents: who or what is authorised to act, and under what context. When access is still granted through static secrets and broad network trust, the VM only relocates the problem. Practitioners should treat identity governance as the control plane, not the host boundary.
A few things that frame the scale:
- 70% of organisations grant AI systems more access than they would give a human employee performing the exact same job, according to the 2026 Infrastructure Identity Survey.
- The agentic AI market is already worth $5 billion and is projected to reach $50 billion by 2030.
A question worth separating out:
Q: What is the difference between VM isolation and zero trust for AI agents?
A: VM isolation separates workloads from the host and other systems, while zero trust evaluates every access request on identity, context and entitlement. For AI agents, that difference matters because the workload can still reach data and services from inside the VM. Zero trust controls the request path, not just the environment boundary.
👉 Read our full editorial: Zero trust for AI agents in VMs: why identity must follow