Topic starter
19/08/2026 3:28 pm
TL;DR: AI attacks now cut both ways, with attackers using AI to scale phishing and identity abuse while AI platforms themselves become part of the attack surface, according to Push Security. The practical problem for identity teams is not model performance but browser-level visibility, control, and guardrails across human, NHI, and shadow AI access paths.
Editorial analysis by NHI Mgmt Group, based on content published by Push Security: “AI attacks”.
Key questions
Q: What breaks when AI attacks move into the browser instead of the endpoint?
A: Endpoint tools can miss the real abuse because the malicious step happens inside an authenticated browser session.
Q: Why do AI browsers create new identity and access risk?
A: Because they turn the browser from a passive display layer into a system that can interpret content and execute actions.
Q: What are the signs that shadow AI agents are escaping discovery controls?
A: Common signs include identity traces without formal registration, endpoint-level activity from local agents or MCP servers, and broad permissions with no clear owner.
Practitioner guidance
- Instrument browser-level session telemetry Capture actions inside authenticated browser sessions so phishing, consent abuse, shadow AI usage, and tenant trust flows are visible before they become incidents.
- Govern shadow AI through the browser path Identify which AI tools employees reach through unmanaged browser flows, then compare that reality against approved access paths and policy.
- Monitor poisoned tenant patterns Watch for lookalike tenant creation, invitation sequences, and browser visits that establish false trust in AI collaboration spaces.
Bottom line: AI is reshaping identity risk by pushing more of the attack surface into the browser, where access, trust, and execution meet in a single session.
Explore further
View Full Forum → | NHI Foundation Course → | Our Services → | Read the full analysis →
19/08/2026 4:11 pm
Browser visibility is now an identity control, not a convenience feature. Once AI tools, SaaS access, and unmanaged usage converge in the browser, the organisation's blind spot is no longer the network perimeter but the live session. That means the control question changes from what users are allowed to log into to what they can do after authentication. Practitioners should treat browser telemetry as part of identity governance, not as an optional add-on.
A few things that frame the scale:
- Only 5.7% of organisations have full visibility into their service accounts, according to the Ultimate Guide to NHIs.
- 96% of security operations teams report critical blind spots, most commonly in cloud infrastructure (74%) and identity and access behaviour (67%).
A question worth separating out:
Q: How should teams govern trust infrastructure across machines and AI agents?
A: Treat cryptographic material as an identity estate, not a set of isolated configuration files. Assign ownership for issuance, renewal, revocation, and dependency mapping across platforms so keys, certificates, and trust chains are governed continuously rather than rediscovered during outages or expiry events.
👉 Read our full editorial: AI attacks in the browser are redefining identity risk