Picture a regular Tuesday afternoon. A developer on your platform team wires up a small script. It imports an agent framework, points it at a language model, and starts answering questions by pulling from an internal data store. No ticket. No review. By Friday it is handling real work. It authenticates with a valid credential, shows up in your logs as ordinary service traffic, and none of your controls know that a reasoning system, one an outsider could redirect with a paragraph of cleverly worded text, is now making decisions against production data.

No alarms. No denials. And that is precisely the problem.

We are deploying autonomous decision-makers across our infrastructure faster than our defenses are learning to recognize them. Network firewalls, web application firewalls, service meshes, identity platforms: the whole stack was tuned to distinguish two kinds of traffic, people clicking through browsers and programs your engineers wrote. An AI agent is neither, and it wears the disguise of both. It talks like a person and connects like a service.

The disguise is only half the vulnerability

Most security conversations about AI fixate on the model: hallucination, jailbreaks, unsafe outputs. Those are real, but the structural issue sits one layer down, in the network and the resources agents reach.

When a request lands on a database, an API, or an object store, that destination has twenty years of architecture behind a single question: is this principal authorized? It gets a clean yes. What it cannot ask is whether the thing holding that authorization is a human operator, a deterministic service, or an autonomous agent that was talked into something ninety seconds ago. It treats all three the same and collapses them into one trusted identity.

That collapse is half the vulnerability. The other half is how easily an agent’s intent can be hijacked. An agent does not only act on instructions from its user; while working a task it ingests external material, a web page, a document, an email, an API response, another agent’s output. It has no reliable way to separate a legitimate instruction from a malicious one buried in the content it fetched. To the model, it is all just text in the context window. That is indirect prompt injection.

An attacker no longer needs to steal a credential or breach a perimeter. They plant the right words where an agent that already holds the credential, inside the perimeter, will encounter them. The agent does the walking, and the controls wave it through, because everything about the request is legitimate except the intent steering it.

Shadow agents are more common than you think

In cloud-native environments, non-human identities outnumber human ones by roughly 144 to 1, according to Entro Security; even across the broader enterprise, Rubrik Zero Labs puts the ratio near 45 to 1[i]. Automated traffic has overtaken human traffic on the open web, reaching 51% according to Imperva’s 2025 Bad Bot Report[ii]. And Gartner expects 40 percent of enterprise applications to embed task-specific AI agents by the end of 2026, up from less than 5 percent in 2025[iii].

Many of these agents are off the books. In Microsoft’s 2024 Work Trend Index, 78 percent of the people using AI at work reported bringing their own tools rather than waiting for IT to provision them, a pattern the report itself flags as putting company data at risk[iv]. The same dynamic extends to agents: the ones nobody registered almost certainly outnumber the ones anyone is tracking. They are born the way that Tuesday script was, quietly, usefully, and entirely outside the process meant to govern them.

You cannot secure a population you cannot enumerate, write policy against callers you cannot distinguish, or audit a fleet indistinguishable, at the decision point, from the workloads beside it.

“Just use zero trust” is not enough

The reflex is that identity solves this. Give agents scoped roles, enforce least privilege, run zero trust and mutual TLS everywhere, move on. That advice is correct but incomplete, and the gap is where agents operate.

Identity and access management gates actions: it decides whether a principal may do a thing. It was never built to broadcast a caller’s nature downstream. A support agent driven by a language model and an engineer running an ad-hoc query can assume the same role and look identical at the same table. That was fine when the only distinction that mattered was trusted software or not. It falls apart the instant a caller can be manipulated through language, improvise a route to data it was never meant to see, or be replaced overnight by an unregistered clone on the same credential.

Zero trust and mutual TLS are excellent at verifying that two parties are who they claim and that the channel between them is sound. Neither carries the fact that one party is an autonomous agent acting for an end user, one that may have been compromised at the level of its reasoning rather than its keys. We spent a decade hardening who may connect. Agents attack through what a trusted connection is allowed to do next.

This already happened

If this still sounds like a tabletop exercise, researchers have already demonstrated it, more than once, against the AI assistants enterprises run.

At Black Hat USA 2025, Zenity Labs unveiled AgentFlayer[v], a family of zero-click chains that silently hijacked enterprise AI assistants across multiple vendors. A single poisoned document made an agent rummage through connected systems and hand back API keys, credentials, and CRM records, with no action from the human whose access it borrowed. At Black Hat 2026 the same team extended the class to agentic browsers, with hijacks that reach into local files and authenticated sessions[vi].

A second team proved the point against developer tooling. In October 2025, Legit Security disclosed CamoLeak[vii] (rated CVSS 9.6), a flaw in GitHub Copilot Chat. An attacker planted hidden instructions inside a pull request, invisible to anyone skimming the page. When a developer later asked Copilot about the repository, the assistant read those instructions as its own and exfiltrated private source code, secrets, and API keys, using nothing more than the developer’s own legitimate access.

Notice: the credential was valid, the access was authorized, the agent was sanctioned. Every control in the path saw a trusted assistant making a reasonable request and let it through. The only thing that had changed was the intent driving it. This is not a future threat; it is shipped, patched, and cataloged, and the class is widening faster than the fixes.

The standards have not fully evolved yet

The standards we use to bolt agents together are not yet mature. The protocol that became the default for connecting agents to tools launched at the end of 2024 with insufficient built-in authentication[viii]. A 2026 assessment that dynamically audited 414 internet-facing MCP servers found 68 reportable vulnerabilities, including SQL injection, server-side request forgery against cloud metadata services, and prompt template injection[ix]. We are handing autonomous systems the keys while the locks are still being invented.

What a real fix looks like: make agents legible, then defend in layers

If our controls cannot perceive agents, the fix begins by giving agents a signature those controls can read, treated as core infrastructure rather than a log field nobody queries.

A caller’s origin needs to travel with its traffic. Not just which credential, but a signal the caller cannot forge, answering what a resource needs to know before it says yes: whether an agent is involved at all, whether it is sanctioned or showed up unannounced, who is accountable for it, and whether a verified human actually delegated the action. Signed identity for automated callers is already emerging at the edge; the IETF’s Web Bot Auth effort lets a legitimate automated client cryptographically prove what it is[x]. Push that principle inward, let provenance persist across service boundaries and surface inside each resource’s own decision, and you can finally write rules that were previously unwritable: this vault refuses agent traffic outright, or only a finance-owned agent acting for a verified employee may query this system.

Legibility is the precondition. Layered defense is what you build on top, and the layers matter most when they are independent:

1. Where the agent reasons: content inspection screens prompts and responses for injection and leakage. Essential, but it lives inside the very loop an attacker is hijacking, so it cannot stand alone.

2. Where the agent acts: tool-level authorization limits which capabilities it can invoke and how far each reaches. Stronger, because it stops taking the agent’s judgment on faith.

3. Where the traffic travels: network and resource enforcement governs where any agent may send data and what any destination will accept from one, regardless of what the agent talked itself into.

Build your confidence around the third layer, because it keeps working after the agent is subverted. Corrupt the model, jailbreak the prompt, coax it down a path no designer imagined: the request still has to leave a host, cross a network, and arrive somewhere real. Each transition is a chance to enforce a decision the compromised agent cannot override. The most important control in agentic security is the one the agent cannot negotiate with. For a decade we pushed controls closer to the application; that instinct now needs to be complemented with intelligence in the network.

A pragmatic starting checklist

You do not need to solve all of this at once. But you need to stop trusting your controls to see something they are blind to.

1. Find the agents you never approved. Assume they exist. Flagging workloads that make model calls with no registration turns “we trust developers to follow policy” into “we can name the ones who didn’t.”

2. Turn provenance into a fact, not an inference. Register the agents you run, bind an identity to each, and make that identity travel with their traffic so a downstream system can act on it.

3. Put your firmest boundary at the resource and the egress edge. Decide what your sensitive systems will accept from an agent, and constrain where agents can ship data.

4. Observe before you enforce. A false positive can take down production. Watch real traffic, simulate the rule, then enforce.

5. Keep your audit trail agent-aware. “Which agents touched sensitive data this year” should resolve to a single query.

The runway is short

In late 2025, Anthropic disclosed what it called the first documented AI-orchestrated cyber-espionage campaign[xi], in which an AI system carried out an estimated 80 to 90 percent of the tactical work against roughly thirty organizations, with humans stepping in only for a handful of decisions. The attacker’s orchestrator and the defender’s orchestrator are, architecturally, the same machine, and the people running the offensive version now have real operational experience. The identity, network, and resource layers were all designed for a world of humans and handwritten code. That world is behind us.

Whoever makes agents legible, visible, attributable, and controllable at the layers where traffic moves, will shape enterprise security for the next decade. Teams that make “is this an agent, and whose?” a first-class question answered inside the request will write policy that bites. Teams that lean on identity alone will keep approving valid credentials wrapped around hijacked intent, and calling the result access control.

The impostor is already in your environment, holding a badge you issued. The work is not catching it in the act. It is building infrastructure that can tell what it is before it ever reaches the door.

Sources

[i] https://thehackernews.com/expert-insights/2026/05/the-non-human-identity-crisis-why-your.html

[ii] https://www.thalesgroup.com/en/worldwide/defence-and-security/press_release/artificial-intelligence-fuels-rise-hard-detect-bots

[iii] https://www.gartner.com/en/newsroom/press-releases/2025-08-26-gartner-predicts-40-percent-of-enterprise-apps-will-feature-task-specific-ai-agents-by-2026-up-from-less-than-5-percent-in-2025

[iv] https://blogs.microsoft.com/blog/2024/05/08/microsoft-and-linkedin-release-the-2024-work-trend-index-on-the-state-of-ai-at-work/

[v] https://www.prnewswire.com/news-releases/zenity-labs-exposes-widespread-agentflayer-vulnerabilities-allowing-silent-hijacking-of-major-enterprise-ai-agents-circumventing-human-oversight-302523580.html

[vi] https://www.businesswire.com/news/home/20260805803998/en/Zenity-Labs-Exposes-the-Full-Scope-of-PleaseFix-a-Vulnerability-Class-Enabling-Zero-Click-Attacks-Across-Leading-Agentic-Browsers

[vii] https://www.legitsecurity.com/blog/camoleak-critical-github-copilot-vulnerability-leaks-private-source-code

[viii] https://www.vectara.com/blog/mcps-rapid-journey-from-open-door-to-a-fortified-gateway

[ix] https://arxiv.org/html/2608.00150v1

[x] https://blog.cloudflare.com/web-bot-auth/

[xi] https://assets.anthropic.com/m/ec212e6566a0d47/original/Disrupting-the-first-reported-AI-orchestrated-cyber-espionage-campaign.pdf