SANS 2025 Security Awareness Report<\/a>, which named AI a top security risk for the second year running. However, the core issue isn\u2019t AI\u2019s intrinsic flaws, but rather the failure of organisations to define and implement appropriate security policies and controls for\u00a0AI.\u00a0<\/p>\nWe\u2019ve\u00a0been treating AI agents as\u00a0mere tools, despite\u00a0exhibiting\u00a0the characteristics of independent actors.\u00a0<\/p>\n
The Borrowed-Credentials Problem\u00a0<\/p>\n
These failures point to a fundamental flaw in how AI agents are commonly deployed today. Most users grant agents access by letting them\u00a0operate\u00a0under their own credentials. It feels natural and convenient, after all, traditional applications often act as extensions of the user, performing tasks on their behalf.\u00a0<\/p>\n
However, AI agents are not traditional applications. They reason, interpret context, and take dynamic actions based on natural-language instructions and make decisions, not just execute predefined logic. This agency and autonomy, combined with unrestricted access, creates a new class of risk.\u00a0<\/p>\n
A single targeting error, like Antigravity running a delete command from the root directory instead of a temporary folder, can escalate into catastrophic data loss. If an autonomous agent with broad permissions interacts with financial systems, even a minor misinterpretation could result in irreversible transactions or large-scale miscalculations.\u00a0The concern\u00a0isn\u2019t\u00a0that agents might make errors, but rather that those mistakes can have greater consequences when agents\u00a0possess\u00a0human-level privileges.\u00a0\u00a0<\/p>\n
Why Traditional IAM\u00a0Doesn\u2019t\u00a0Work for Agents\u00a0<\/p>\n
IAM frameworks were designed around two familiar actors: human users and service accounts. Humans bring judgment and accountability. Service accounts\u00a0represent\u00a0predictable, deterministic applications. AI agents fit neither category.\u00a0<\/p>\n
When an agent uses a user\u2019s identity, attribution disappears. System logs show the human performing every action, making it\u00a0nearly impossible\u00a0to distinguish between user-initiated and agent-initiated activity. This undermines forensic analysis, compliance audits, and incident response.\u00a0<\/p>\n
At the same time, excessive privilege becomes unavoidable. Employees accumulate broad permissions over time, and any agent inheriting those permissions gains far more access than it needs. This violates the principle of least privilege and dramatically increases the blast radius of any error.\u00a0\u00a0<\/p>\n
Without distinct identities, scope boundaries cannot be enforced. A data-analysis agent should only read information. A deployment agent may need limited write access. But when both\u00a0operate\u00a0under the same user identity, they receive identical permissions regardless of purpose.\u00a0<\/p>\n
This leads directly to accountability gaps. If an agent\u00a0deletes\u00a0data or triggers a financial transaction, who is responsible: the user, the agent, or the system that allowed it? Without clear identity boundaries, organisations cannot answer that question.\u00a0<\/p>\n
The Case for Agent-First Identity\u00a0<\/p>\n
To tackle these issues,\u00a0it\u2019s\u00a0important to recognise AI agents as primary identity principals, giving them their own credentials, access rights, and audit trails.\u00a0This model recognises agents as distinct actors subject to the same governance rigour applied to human users.\u00a0\u00a0<\/p>\n
Administration\u00a0starts by giving each agent its own identity with defined metadata, enabling clear visibility and consistent policy enforcement across the system.\u00a0<\/p>\n
Authentication\u00a0should use machine-appropriate credentials like mutual TLS or private key JWTs, enabling automatic rotation and programmatic verification to ensure agents are genuine, not impostors.\u00a0\u00a0<\/p>\n
Authorisation\u00a0is precise. With unique identities, organisations can assign tightly scoped, context-aware permissions and delegation, ensuring each agent receives only the precise access it needs and acts on the correct party\u2019s behalf.\u00a0<\/p>\n
Auditability\u00a0improves dramatically. Every agent action is logged with full context \u2013 who acted, what they did, and under what authorisation. This independent audit trail is essential for investigations, compliance, and responsible AI governance.\u00a0<\/p>\n
Building Trust Through Governance\u00a0\u00a0<\/p>\n
The Antigravity and\u00a0Replit\u00a0incidents are not arguments against AI agents: they are arguments for treating agent security with the seriousness it demands. As organisations rely on agents for critical\u00a0tasks,\u00a0 IAM\u00a0becomes a business necessity. In 2026, every AI agent should have proper identity and access controls before it ever touches production.\u00a0<\/p>\n
With restricted identities and read-only access, the Antigravity and\u00a0Replit\u00a0agent mistakes would still have occurred, but their actions would have been\u00a0contained\u00a0and the resulting damage far smaller.\u00a0<\/p>\n
The agentic AI boom in 2025 revealed that without strong IAM foundations, autonomous systems gain broad, untracked access that becomes increasingly risky as deployments scale in 2026. The answer\u00a0isn\u2019t\u00a0slowing adoption but giving agents first-class identities with proper authentication, authorisation, and audit trails so their inevitable mistakes\u00a0remain\u00a0manageable and\u00a0don\u2019t\u00a0become a real disaster for your organisation.\u00a0<\/p>\n","protected":false},"excerpt":{"rendered":"The start of 2026 is a pivotal moment to reflect on what real-world deployments of AI agents have…\n","protected":false},"author":2,"featured_media":31861,"comment_status":"","ping_status":"","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[6],"tags":[405,7537],"class_list":{"0":"post-31860","1":"post","2":"type-post","3":"status-publish","4":"format-standard","5":"has-post-thumbnail","7":"category-agentic-ai","8":"tag-ai-agents","9":"tag-artificial-intelligence-agents"},"_links":{"self":[{"href":"https:\/\/www.europesays.com\/ai\/wp-json\/wp\/v2\/posts\/31860","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/www.europesays.com\/ai\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/www.europesays.com\/ai\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/www.europesays.com\/ai\/wp-json\/wp\/v2\/users\/2"}],"replies":[{"embeddable":true,"href":"https:\/\/www.europesays.com\/ai\/wp-json\/wp\/v2\/comments?post=31860"}],"version-history":[{"count":0,"href":"https:\/\/www.europesays.com\/ai\/wp-json\/wp\/v2\/posts\/31860\/revisions"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/www.europesays.com\/ai\/wp-json\/wp\/v2\/media\/31861"}],"wp:attachment":[{"href":"https:\/\/www.europesays.com\/ai\/wp-json\/wp\/v2\/media?parent=31860"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/www.europesays.com\/ai\/wp-json\/wp\/v2\/categories?post=31860"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/www.europesays.com\/ai\/wp-json\/wp\/v2\/tags?post=31860"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}