Topic starter
02/08/2026 11:33 am
TL;DR: Security leaders should treat exposed APIs, MCP servers, and weakly governed internal services as the real AI attack surface, because AI agents create damage by taking actions, not only by generating text, according to Salt. The governance gap is no longer model safety alone but action-layer control over what agents can reach, call, and chain.
Editorial analysis by NHI Mgmt Group, based on content published by Salt: “An AI Agent Didn’t Hack McKinsey. Its Exposed APIs Did.”.
Key questions
Q: What breaks when AI agents can reach exposed internal APIs?
A: The break point is governance, not just security tooling.
Q: Why do weakly governed action layers increase AI security risk?
A: Weakly governed action layers increase risk because agents do not need new exploits if existing endpoints already grant useful actions.
Q: What are the signs that an AI identity is failing governance even if access looks limited?
A: An AI identity is failing governance when teams cannot name an owner, explain why it exists, or trace what it did.
Practitioner guidance
- Map every agent-reachable API Build an authoritative inventory of APIs, service endpoints, and MCP servers that an AI system can reach, including forgotten and shadow integrations.
- Scope agent permissions to specific workflows Limit each AI agent to the minimum set of actions and data paths needed for its task, and review those entitlements as privileged access.
- Enforce authentication on internal action surfaces Require strong authentication and explicit authorisation for every endpoint that can trigger a business action, even when it was originally internal-only.
Bottom line: AI security risk is moving from model behaviour to the action layer, where exposed APIs and connected services decide what an agent can actually do.
Explore further
View Full Forum → | NHI Foundation Course → | Our Services → | Read the full analysis →
02/08/2026 12:47 pm
Action-layer security is now the real control problem for AI systems. The model may generate output, but the exposed interfaces determine whether that output can become a harmful action. That makes API governance, service inventory, and access scoping the practical center of AI risk management. For identity teams, the key point is that agent permissions are not abstract policy objects, they are executable trust relationships.
A few things that frame the scale:
- Half of companies using generative AI will deploy agentic AI by 2027, according to Deloitte's 2025 Technology Predictions.
A question worth separating out:
Q: How should security teams govern API access for AI agents and service accounts?
A: Security teams should treat API access as a governed identity path, not a transport detail. That means assigning ownership to each machine consumer, limiting scopes to specific tasks, enforcing token binding where possible, and maintaining audit logs that tie every call to an identity and policy decision.
👉 Read our full editorial: AI security risk is shifting from models to exposed action layers