Topic starter
06/11/2026 6:55 pm
TL;DR: AI agents can authenticate once and then act hours later outside the original security check, according to AppViewX's analysis of machine identity risk. That timing gap turns certificate management into an operational control, not just an access control.
Editorial analysis by NHI Mgmt Group, based on content published by AppViewX: “AI Agents are blindspots for Zero Trust”.
By the numbers:
- 40% of enterprise applications will integrate AI agents by 2026, up from less than 5% in 2025.
- 84% of organizations experienced at least one API security incident in 2024.
Key questions
Q: Why do machine certificates create operational risk for AI agents?
A: Machine certificates create operational risk for AI agents because they bind runtime trust to a specific private key, issuer and expiry.
Q: How should security teams implement AI agent credential management?
A: Security teams should issue short-lived, task-scoped credentials tied to the specific agent, tool, and resource involved, rather than sharing human sessions or static API keys.
Q: Why do AI agents need Zero Trust instead of perimeter security?
A: AI agents operate inside the environment while still behaving like active decision-makers, so perimeter controls no longer define trust.
Practitioner guidance
- Inventory every AI agent credential path Map certificates, API keys, and delegated tokens to each agent, including where they are issued, stored, renewed, and revoked.
- Automate lifecycle monitoring for machine credentials Use continuous renewal and expiry tracking so AI agents do not fail silently when certificates lapse.
- Shift from login checks to action checks Require policy decisions at the point an agent performs a sensitive action, not only when it first authenticates.
Bottom line: AI agent access creates a mismatch between when trust is granted and when work is performed, which makes login-centric controls incomplete.
Explore further
View Full Forum → | NHI Foundation Course → | Our Services → | Read the full analysis →
06/11/2026 6:56 pm
Zero trust becomes brittle when the subject is a machine that acts later than it authenticates. Human-centric trust models assume the security decision and the action stay close together in time. AI agents decouple those moments, so the original verification no longer describes the current risk state. The field needs to recognise that this is a timing problem as much as an identity problem, and that assumption collapse changes how access is governed.
A few things that frame the scale:
- Systems with least-privileged AI access had a 17% incident rate vs 76% for over-privileged systems. Organisations failing to scope AI access properly are 4.5x more likely to experience a security incident, according to the 2026 Infrastructure Identity Survey.
- Only 44% of organisations have implemented any policies to manage their AI agents, despite 92% agreeing that governing AI agents is critical to enterprise security, according to the 2026 Infrastructure Identity Survey.
A question worth separating out:
Q: What signs suggest an AI agent has lost credential validity?
A: Signs include failed API calls, TLS handshake errors, sudden 401 or 403 responses, repeated token refresh failures and services rejecting mutual TLS. An AI agent may also stop calling tools it previously used, fall back to unauthenticated paths, or generate retry loops. These patterns usually indicate expired certificates, revoked tokens, rotated secrets or broken credential injection.
👉 Read our full editorial: AI agent certificates create a zero trust blindspot for operations