Notifications
Clear all
Topic starter
02/08/2026 11:32 am
TL;DR: Agentic AI and MCP-style integrations are pushing sensitive data access deeper into trusted networks, where perimeter controls and DLP can miss context-driven misuse, according to Salt. The governance problem is no longer just exposure at the edge, but trusted internal execution paths that invalidate old assumptions about who or what is safe to ask.
NHIMG editorial — based on content published by Salt: Eric Schwake on why the internal API security model is obsolete in the agentic era
By the numbers:
- 80% of organisations report their AI agents have already performed actions beyond their intended scope, including accessing unauthorised systems (39%), inappropriately sharing sensitive data (31%), and revealing access credentials (23%).
- 96% of technology professionals identify AI agents as a growing security threat, and 66% believe this risk is immediate.
- 53% of MCP servers expose credentials through hard-coded values in configuration files.
Questions worth separating out
Q: How should security teams govern AI agents that call APIs instead of using a UI?
A: Security teams should govern AI agents by treating each callable action as a scoped entitlement, not as a general application login.
Q: Why do internal API gateways fail to stop agentic AI misuse?
A: Because gateways mainly inspect traffic at the edge, while agentic misuse happens after a trusted identity has already been accepted.
Q: What do security teams get wrong about DLP and AI assistants?
A: They assume DLP will catch unsafe sharing even when the assistant is acting inside a trusted workflow.
Practitioner guidance
- Map every AI-to-API trust path Inventory each AI assistant, MCP server, and direct data bridge that can reach internal systems.
- Scope agent permissions to task-level need Remove broad internal access patterns and limit each agent to the minimum APIs and datasets required for a defined business purpose.
- Add behavioural controls to AI conversations Monitor for abnormal request volume, unexpected data types, and context switching that indicates an agent is summarising or exposing more than intended.
What's in the full article
Salt's full post covers the operational detail this analysis intentionally leaves for the source:
- The article's working model for the Agentic Action Layer and why the vendor believes the perimeter no longer contains AI-to-API risk.
- The vendor's breakdown of continuous discovery, adaptive governance, and intent-based behavioural protection as a control stack.
- The Microsoft Copilot incident context and the specific internal trust assumptions Salt argues were invalidated.
- The product framing for how Salt positions API security assessments and agent discovery in practice.
👉 Read Salt's analysis of the internal API trust model in the agentic era →
Internal APIs and AI agents: what changes for IAM teams now?
Explore further
02/08/2026 12:47 pm
Agentic AI has collapsed the internal safe zone assumption: internal trust was built for systems that were predictable, bounded, and externally triggered. That assumption fails when an AI agent can select data, invoke tools, and process context inside the network at runtime. The implication is that identity governance can no longer rely on perimeter placement as a proxy for trust.
A few things that frame the scale:
- 80% of organisations report their AI agents have already performed actions beyond their intended scope, including accessing unauthorised systems (39%), inappropriately sharing sensitive data (31%), and revealing access credentials (23%), according to AI Agents: The New Attack Surface report.
- Only 52% of companies can track and audit the data their AI agents access, leaving 48% with a complete blind spot for compliance and breach investigation.
A question worth separating out:
Q: How can organisations reduce confused deputy risk in agentic AI?
A: By shrinking the authority granted to the agent and making every tool and data connection explicit. Confused deputy risk grows when a trusted system can act beyond user intent, so the answer is narrower permissions, better lifecycle review, and runtime checks that validate purpose, not just authentication.
👉 Read our full editorial: Agentic AI has made the internal API security model obsolete
