Notifications
Clear all
Topic starter
02/08/2026 9:45 am
TL;DR: Claude Tag gives AI agents their own scoped identity, but it also shifts the hardest control decision from login-time authentication to runtime authorization, with shared-channel visibility, attribution gaps, and channel membership now expanding access paths according to Akto. The identity gap is not theoretical: governing who can cause an action, and who can see the result, matters more than proving the agent is authenticated.
NHIMG editorial — based on content published by Akto: 7 Claude Tag Security Risks: The Agent Identity Gap
By the numbers:
- 96% of technology professionals identify AI agents as a growing security threat, and 66% believe this risk is immediate.
- 80% of organisations report their AI agents have already performed actions beyond their intended scope, including accessing unauthorised systems (39%), inappropriately sharing sensitive data (31%), and revealing access credentials (23%).
Questions worth separating out
Q: How should security teams govern AI agents that inherit authority from other identities?
A: Security teams should govern AI agents by tracking identity lineage, not just credentials.
Q: Why do AI agents complicate least privilege in IAM programmes?
A: AI agents complicate least privilege because their useful scope is often broader than a traditional service account, but their actual authority should still be narrower at each action.
Q: What breaks when shared channels are allowed to invoke privileged agent identities?
A: Channel membership starts functioning like an access grant, even when the channel was created for collaboration rather than privilege.
Practitioner guidance
- Bind requester authority to every agent action Require the system to evaluate the human requester’s permissions alongside the agent’s scope before any sensitive repository, CRM, warehouse, or deployment action is executed.
- Treat collaboration membership as access governance Map which users can invoke each channel-scoped agent identity and review membership changes as access changes, especially where a channel can reach production data or administrative tools.
- Route sensitive responses to the correct audience Prevent shared-channel overexposure by scoping replies to the requester or by checking the audience’s access rights before the agent posts the result.
What's in the full article
Akto's full blog post covers the operational detail this post intentionally leaves for the source:
- Per-risk examples showing how Claude Tag permissions can be misused in shared channels and direct messages
- Runtime enforcement patterns for dual-check authorisation and response scoping across connected systems
- A practical agent identity governance checklist for inventory, ownership, and access review
- Tooling context for runtime protection, shadow AI discovery, and red teaming of agent actions
👉 Read Akto's analysis of Claude Tag security risks and agent identity gaps →
Claude Tag security risks: what identity teams need to fix?
Explore further
02/08/2026 12:38 pm
Agent identity solves attribution, not authorisation: The most important Claude Tag lesson is that giving an AI agent its own principal does not answer whether the requesting person is entitled to cause the action. That gap moves identity governance from login-time trust to runtime decisioning, which is where most IAM stacks still rely on static entitlements. Practitioners should treat this as a control boundary shift, not an authentication improvement.
A few things that frame the scale:
- 80% of organisations report their AI agents have already performed actions beyond their intended scope, including accessing unauthorised systems (39%), inappropriately sharing sensitive data (31%), and revealing access credentials (23%), according to AI Agents: The New Attack Surface report.
- 52% of companies can track and audit the data their AI agents access, leaving 48% with a complete blind spot for compliance and breach investigation, according to AI Agents: The New Attack Surface report.
A question worth separating out:
Q: Who is accountable when an agent performs an action that the requester could not do directly?
A: Accountability sits with both the requester and the organisation that allowed the delegation path. The agent may be the recorded actor in logs, but that does not erase the requester’s authority problem. Teams need logging that ties the human request, the agent principal, and the touched data together.
👉 Read our full editorial: Claude Tag security risks expose the agent identity gap
