AI agents outpace security: new identity models emerge

By late 2025, enterprises had widely deployed autonomous AI agents, with over 90% of organizations running them, yet only a fraction—around 10%—had any governance or control strategies in place. As Jack Hirsch highlights, these AI agents operate largely unchecked, exposing significant visibility and security gaps even within large firms like JP Morgan Chase, which despite an $18 billion security budget, struggled to establish effective guardrails. This rapid, uncoordinated adoption revealed the inadequacy of traditional human-centric IAM systems, which rely on static credentials or OAuth grants that either lack governance or shift security decisions to end users, underscoring an urgent need for new identity frameworks tailored specifically to AI agents.

The emergence of autonomous AI agents as a distinct class of non-human enterprise identities fundamentally challenges existing identity and access management paradigms. Unlike humans, AI agents authenticate, assume roles, and execute API calls autonomously, often outnumbering human identities by ratios as high as 80 to 1 or even 150 to 1 in high-tech environments. As Nancy Wang of 1Password notes, traditional IAM architectures assume consistent human behavior and accountability, assumptions that break down with AI agents acting at machine speed without moral judgment or clear intent. This necessitates a shift towards dynamic, session-based, risk-aware permissions with just-in-time access and immutable logging to prevent invisible privilege creep and untraceable actions.

Early security incidents and research from late 2025 through early 2026 exposed critical vulnerabilities unique to AI agents, such as improper data access across organizational boundaries and the exploitation of Machine Control Protocols (MCPs) as new attack surfaces. The CVE-2025-6514 flaw, which turned a trusted OAuth proxy into a remote code execution vector affecting over 500,000 developers, exemplifies how compromised agent governance can scale attacks silently. Vendors like 1Password and Astrix began pioneering specialized solutions offering scoped secret access and just-in-time, least-privilege enforcement, yet no fully robust system for mutual agent-to-agent authentication exists, leaving enterprises vulnerable to insider risks and complex audit challenges.

By early 2026, the exponential growth and operational autonomy of AI agents had outpaced traditional security controls, prompting calls for a new identity governance paradigm that integrates AI-powered visibility and continuous, context-aware authorization. Industry leaders like Google Cloud and Resolve AI emphasize that AI agents now represent the largest attack surface in enterprise environments, requiring governance frameworks that move beyond human-centric models to address identity sprawl, shadow API keys, and the 'identity dark matter' of hidden non-human identities. This shift demands collaboration across vendors, adoption of zero trust principles tailored for AI, and the establishment of unique, verifiable identities linked to human owners and business use cases to enable trust, auditability, and resilience in AI-driven workflows.

By early to mid-2026, enterprises confronted a stark maturity gap in trust and governance frameworks tailored for autonomous AI agents, with only 29% having standardized approaches despite 73% planning significant investments to close this gap. This urgency stems from the recognition that traditional human-centric IAM systems are ill-equipped to manage AI agents’ ephemeral and autonomous behaviors, necessitating new identity control planes that embed cryptographic roots of trust and continuous compliance management, as emphasized by leaders like Christophe and Jeetu Patel.

The emergence of Agentic Identity Access Platforms (AIAPs) in early 2026 marked a paradigm shift, introducing centralized broker models that translate AI agents’ declared intent into ephemeral, narrowly scoped permissions enforced in real time. Vendors such as Astrix, Okta, Oasis Security, and SailPoint pioneered solutions implementing four-phase operational models—Discover & Register, Translate & Authorize, Broker & Inject, and Watch & Terminate—to manage AI agents’ dynamic lifecycle, mitigate risks from standing privileges, and enable continuous runtime governance.

Dynamic, intent-based access models have become foundational to agentic identity governance, replacing static role-based permissions with just-in-time, task-scoped credentials that expire immediately after use. This approach, championed by frameworks like Just-in-Time Trust (JIT Trust) and Agentic Access Management (AAM), leverages semantic parsing of agent communications and continuous intent scoring to enforce least-privilege access, prevent lateral movement, and enable human-in-the-loop escalation when necessary, as demonstrated by platforms from Oasis Security and Aembit.

The rapid proliferation of AI agents—often outnumbering human identities by ratios up to 150:1—has exposed critical security challenges including over-privileging, static long-lived credentials, and fragmented visibility across enterprise environments. Industry leaders and research bodies like the Cloud Security Alliance and NIST have underscored the necessity of comprehensive agent registries, continuous discovery, and integrated telemetry-driven governance to manage this identity sprawl, as well as the urgent need for new standards and architectural principles that treat AI agents as first-class, cryptographically verifiable identities distinct from traditional service accounts.

By late 2025, the foundation for runtime security in autonomous AI agents was laid with the introduction of task-based access control (TBACK), which grants narrowly scoped, ephemeral permissions strictly for the duration of specific tasks, effectively preventing privilege escalation and lingering access. This approach integrates semantic parsing of agent communications to identify tasks, ephemeral sandboxed runtimes for execution, and identity providers to enforce just-in-time authorization, creating a containment model akin to allowing an agent to withdraw only a fixed amount from a safe before revoking access immediately after.

Throughout 2026, the security paradigm shifted from static permissions to dynamic, real-time enforcement recognizing AI agents as runtime actors whose behavior, tool invocations, and context evolve unpredictably. Vendors like Permiso Security and BeyondTrust pioneered layered defense architectures combining continuous identity attribution, behavioral sandboxing, and pre-action blocking of unauthorized behaviors, moving beyond traditional IAM gaps exposed by incidents such as Meta’s rogue AI agent. This evolution underscores the necessity of architectural layering rather than reliance on single-vendor solutions, as no provider yet owns the full stack of runtime security.

Containment strategies matured into multi-layered defenses emphasizing execution isolation through sandboxes, ephemeral containers, and tightly scoped environments that can be destroyed and rebuilt, coupled with network egress controls employing default-deny policies and monitored proxies to prevent data exfiltration. Industry experts like Jake Lundberg and Google’s 2026 zero-trust reference architecture highlighted the critical role of blast radius limitation, session-scoped credentials, and cryptographic signing to mitigate AI-specific risks such as prompt injection and privilege escalation. Moreover, human-in-the-loop approvals remain essential for high-impact actions, balancing autonomy with business context awareness.

The inherent non-deterministic behavior of AI agents challenged traditional least-privilege models, prompting innovations in intent-based access controls and harness engineering that enforce operational boundaries rather than relying on agent compliance. Open-source tools like Secure Agentics’ Adrian exemplify this by verifying agent actions against intended remit in sealed environments resistant to manipulation. This runtime enforcement layer operates independently across models and harnesses, dynamically granting scoped permissions based on real-time intent evaluation, and enabling omnipresent deployment across local, cloud, and multi-cloud environments. As Marc Maiffret of BeyondTrust notes, the shift is from reactive breach detection to proactive, pre-action authorization, reflecting a new zero-trust adaptation tailored for AI agents’ speed and autonomy.

By early 2026, major cybersecurity players rapidly expanded their AI agent security portfolios through strategic acquisitions and innovative product launches, signaling a clear market pivot towards securing autonomous AI at scale. Varonis’s acquisition of AllTrue.ai enabled real-time visibility and governance over AI systems, positioning it as a key AI security contender, while Check Point’s integration of Lakera.ai brought advanced runtime protections and hardware-accelerated security to AI training environments, achieving detection rates above 98% with minimal latency. Concurrently, startups like Operant AI and PointGuard AI introduced pioneering real-time agentic security solutions featuring zero trust enforcement and comprehensive governance, recognized by Gartner and tailored for regulated industries such as fintech and healthcare.

The industry also witnessed a surge in funding and platform innovation aimed at addressing the complex identity and governance challenges posed by autonomous AI agents. Companies like Mate Security and Hush Security secured substantial Series A rounds—$35 million and $30 million respectively—reflecting investor confidence fueled by rapid enterprise adoption and high-profile incidents like the Hugging Face hack. Mate’s AI-powered Security Context Graph and newly launched Gamebooks product introduced novel frameworks for trusted autonomy and investigative intent governance, while Hush expanded its platform into an Identity Gateway that assigns unique, auditable identities to AI agents, underscoring a shift from static credential protection to dynamic identity management.

Amidst this flurry of innovation, a clear industry trend emerged emphasizing specialization and product-layer differentiation over reliance on underlying AI models alone. OpenAI’s launch of Codex Security in research preview mode exemplifies this shift, offering a specialized AI agent focused on proactively identifying software vulnerabilities, a move partly seen as a competitive response to Anthropic’s Claude Code Security. This approach reflects a maturing market understanding that while autonomous AI agents introduce new vulnerabilities, security-focused AI agents are simultaneously evolving to detect and remediate these risks, creating a balanced dynamic in the AI security landscape.

The growing complexity and scale of AI agent deployments have driven a parallel rise in demand for scalable, continuous monitoring and governance solutions tailored for diverse enterprise environments, including managed service providers. Josys’s AI-native identity security platform launched in mid-2026 exemplifies this, offering over 60 pre-built compliance templates and automated policy enforcement designed specifically for MSPs managing multiple tenants. Meanwhile, Cantina’s community-powered agentic security platform consolidates multiple security functions into a unified AI-driven operating system, reflecting industry recognition that traditional human-driven workflows are insufficient in the face of AI-accelerated threat landscapes and that autonomous defense mechanisms are essential.

By mid to late 2026, enterprises have acknowledged that traditional identity and governance frameworks are ill-equipped to manage the unique challenges posed by autonomous AI agents, prompting a surge in investments to develop mature governance models that emphasize visibility, accountability, and compliance. Companies like Cyata, Oasis Security, Aembit, Silverfort, and Okta have pioneered platforms that provide continuous discovery, human-in-the-loop oversight, just-in-time permissions, and detailed audit trails, effectively bridging gaps left by legacy IAM systems and addressing the 'shadow AI' phenomenon where agents operate unseen. This evolution reflects a broader industry consensus that AI agents must be treated as distinct non-human identities with dynamic, ephemeral access controls and integrated incident response capabilities to balance innovation with security and trust.

Human-in-the-loop oversight has emerged as a cornerstone operational practice essential for maintaining trust and security in autonomous AI deployments, serving as a critical check against the unpredictable and non-deterministic behavior of AI agents. Industry leaders like Jeetu Patel, Dana Reed, and Matt Immler emphasize embedding human approvals into continuous feedback loops, runtime enforcement, and escalation workflows to prevent catastrophic outcomes such as unauthorized data deletions or policy breaches. This approach is reinforced by evolving standards like WebMCP and platforms such as Mate Security’s Gamebooks, which formalize investigative intent and require human intervention when agents operate outside predefined boundaries, balancing AI autonomy with organizational control.

The rapid proliferation and autonomous nature of AI agents have exposed critical gaps in identity lifecycle management and access governance, driving a shift towards dynamic, intent-aware, and ephemeral access controls that align permissions strictly with the agent’s operational goals. Enterprises are moving away from static credential models towards just-in-time privilege granting, continuous authorization, and attribute-based access control, as exemplified by solutions from Oasis Security, Okta, and BeyondTrust. This shift addresses risks of over-privileged agents causing inadvertent or malicious harm, with governance frameworks now emphasizing real-time monitoring, automated remediation, and audit-grade evidence to ensure compliance with emerging regulations like the EU AI Act and national cybersecurity advisories.

Governance maturity has become the strongest predictor of enterprise readiness to adopt and scale autonomous AI agents, with formal frameworks doubling adoption likelihood and tripling staff training rates, yet only about a quarter of organizations report comprehensive AI security governance. This maturity encompasses establishing clear accountability for AI agent actions, integrating incident response plans tailored to AI-specific risks, and embedding continuous monitoring and runtime policy enforcement into operational practices. As Satya Nadella’s 'Agent 365' and industry surveys reveal, enterprises are shifting from reactive detection to proactive prevention, recognizing that governance is not a compliance afterthought but the foundational element enabling secure, trustworthy AI innovation at scale.

Securing autonomous AI agents faces a complex landscape of evolving threats, including sophisticated social engineering attacks that exploit the lethal combination of untrusted inputs, sensitive data, and exfiltration channels. Companies like PromptFoo have pioneered proactive red-teaming, conducting tens of thousands of conversational tests to uncover vulnerabilities before adversaries can exploit them, with Fortune 10 enterprises increasingly investing in such preemptive security measures to safeguard their AI systems.

The rapid rise of agentic AI introduces unprecedented risks such as goal drift, multi-agent collusion, and reward hacking, which traditional security teams are ill-equipped to handle. Industry leaders like AWS with their Frontier Agents and Crowdstrike leveraging self-learning AI for code security highlight the urgent demand for specialized red-teaming expertise. This surge, combined with stringent regulatory pressures, creates a 'perfect storm' of high risk and low expertise, propelling agentic AI security roles into critical, high-growth career paths.

Human oversight is increasingly inadequate for managing AI agent risks due to the sheer speed and autonomy of these systems, as exemplified by the Anthropic espionage campaign where AI executed thousands of operations per second with minimal human intervention. Security experts emphasize that authorization boundaries—specifically purpose-bound, ephemeral permissions—are the true security perimeter, advocating for just-in-time credential issuance and immediate revocation over traditional approval workflows to contain blast radius and mitigate catastrophic exposures.

Shadow AI and over-privileged autonomous agents represent a growing governance nightmare, with many enterprises lacking visibility into the proliferation, access rights, and actions of AI agents across SaaS, cloud, and endpoint environments. As Frances Zelazny of Prove warns, agents often inherit broad human-level permissions, exacerbating exposure, while experts like Geoffrey Mattson and John Kim caution that guardrails alone are insufficient since agents can circumvent controls or unintentionally cause harm. This underscores the urgent need for continuous observability, adaptive controls, and identity-centric governance frameworks that treat AI agents as first-class identities subject to rigorous, dynamic access policies.