Zero trust for AI agents: what changes when actions are the risk?

TL;DR: AI agents can cause damage while using approved tools, valid credentials, and normal APIs, which makes the breach a matter of sequence rather than malware, according to Canyon Road’s analysis of Anthropic’s Zero Trust for AI Agents. The control point has to move outside the agent’s reasoning loop because prompt instructions, in-agent permissions, and after-the-fact logs do not contain the blast radius.

Editorial analysis by NHI Mgmt Group, based on content published by Canyon Road: “The Attack Will Not Look Like Malware”.

Key questions

Q: What breaks when AI agent access decisions are handled in prompts?

A: Prompt-based access control is fragile because it places security logic inside the same system attackers are trying to influence.

Q: Why do valid credentials still create security risk when an AI agent processes untrusted content?

A: Valid credentials create risk because the agent may faithfully execute malicious instructions embedded in the content it is asked to process.

Q: How should teams decide whether an AI agent control is actually effective?

A: A control is effective only if it makes the unsafe action impossible, not merely annoying or slower.

Practitioner guidance

• Shift authorisation to execution time Evaluate every agent action before it runs, and block or constrain file reads, writes, network calls, and tool invocation outside policy boundaries.
• Separate agent runtime controls from prompt controls Do not rely on instructions inside the model to enforce safety; place the enforcement point in the operating environment, sandbox, or proxy layer.
• Limit the blast radius of legitimate access Scope each agent to the minimum file paths, APIs, credentials, and outbound destinations needed for the task, then deny everything else by default.

Bottom line: AI agent risk comes from legitimate access used in the wrong sequence, not only from malware or stolen credentials.

Explore further

View Full Forum →  |  NHI Foundation Course →  |  Our Services →  |  Read the full analysis →