The Rise of Autonomous Agentic AI
Agentic AI represents a once-in-a-generation shift in how organizations operate. AI agents are not copilots. They are not better chatbots. They are autonomous actors that plan, decide, and act. They write code, move data, and execute transactions. They operate across SaaS, cloud, and on-prem systems.
The critical distinction is behavioral: agents don't log in like humans, don't follow approval workflows, and don't pause for review. They operate at machine speed and machine scale. The security model built for human users—single sign-on, MFA, EDR, access reviews—was not designed for this.
This gap between what agents need to do and what enterprise security can see is the central challenge for CISOs in 2026. The path forward is not to slow down AI. It is to secure it properly.
Assume Prompt Filters Won't Stop Attacks
The most common attack vector against AI agents is prompt injection: adversarial text hidden in content the agent reads—an email, a document, a web page—designed to trick the agent into performing unintended actions.
The non-determinism of large language models is the biggest security challenge with agentic AI. The same prompt, the same filter, and the same agent can produce different results on each run. Prompt filtering reduces the likelihood of a successful attack but can never eliminate it.
This means a security strategy cannot depend on prompt filters stopping attacks. The focus must shift to controlling what agents can do after being compromised. Access containment, limiting blast radius through identity and permissions, is the only reliable defense layer, not prompt-level guardrails.
Agents Are Non-Human Identities, Treat Them That Way
Most organizations today give agents "employee-like" identities. An agent is created by a developer, provisioned with an SSO account, an OAuth token, or an API key, and then never tracked or governed.
This creates a condition called agentic identity washing: the agent has a single-sign-on identity, appears human to endpoint detection and response (EDR) tools, IAM systems, and audit logs. Security tools don't see an agent; they see a user. The consequences are severe, an agent that can create SAML assertions, generate app-specific passwords, or create new users can establish persistent access indistinguishable from legitimate admin activity.
The correct model is to classify agents as non-human identities (NHI) in their own class, with dedicated lifecycle management that includes creation, risk-scoring, scoping, monitoring, and deprovisioning. Access should be just-in-time, time-boxed, and revoked when no longer needed. Risk scoring should factor in what systems an agent can access, what data it handles, its autonomy level, and its potential blast radius. For a step-by-step framework for registering and governing each agent as a formal identity, see The 83% Blind Spot: Why Your AI Agents Are Operating Without Permission.
Unmanageable Agents Create Shadow AI
"Shadow AI" is not a single problem. It manifests in three distinct patterns:
Developer-created agents. This is the most common form. Developers building agents using APIs from OpenAI, Anthropic, or Google, connecting them to internal systems with service accounts or personal OAuth tokens. Often these run on developer machines or cloud accounts not connected to enterprise SSO, completely invisible to security tooling.
Employee-brought-in tools. Employees connecting AI tools through personal accounts that inherit enterprise SSO tokens. The agent can read emails, files, and CRM data with the employee's full permission set, operating entirely outside security controls.
Malicious actor agents. Adversaries using stolen OAuth tokens to spin up their own agents. OAuth abuse bypasses MFA because tokens are trusted artifacts, possession alone is sufficient for access.
Every one of these variants shares the same root cause: agents exist outside the identity governance framework. They cannot be found if the security team doesn't know they exist, and they cannot be controlled without a purpose-built inventory. Our deeper analysis of these blind spots is in Shadow AI Agents: Enterprise Security Blind Spots and AI Cybersecurity Governance Challenges.
The Browser Is the New Battlefield
The browser is where humans, agents, and malicious actors all meet. Browser-based OAuth token theft is a particularly dangerous vector: tokens stolen in real-time by infostealer malware directly from browser session storage. Unlike static secrets, these tokens can be replayed immediately with no detection window.
Browser-based attacks evade EDR because the traffic is already authenticated, encrypted, and originating from a trusted browser. To EDR, the activity looks like legitimate user behavior. The control surface must extend to the browser session itself, not just the endpoint filesystem or network stack.
This is a structural blind spot. Organizations that have invested heavily in endpoint hardening but not in browser-layer telemetry will find that their most sensitive data flows through channels their tools cannot inspect.
Governance Is Non-Negotiable
Securing agentic AI at scale requires three governance pillars:
Identity governance. Every agent must have an owner, every action must have a policy, and every agent must have a clearly defined purpose. Least privilege applies to agents the same way it applies to human users, and the absence of that control is how a single compromised agent becomes a systemic risk.
AI security policy enforcement. Real-time policy enforcement that blocks high-risk actions: bulk data exfiltration, credential access, privilege escalation. Behavioral anomaly detection applied at the identity layer catches patterns that signature-based and prompt-level defenses miss entirely.
Audit and compliance. Agents must be auditable like any other identity. Logs must attribute actions to a specific agent and its owner. Without this, no incident response team can reconstruct what happened, and no compliance framework can be satisfied.
Building a Scalable Identity Control Plane
Agentic AI is inevitable and overwhelmingly positive for business. The value lies in autonomous access that allows agents to act across systems at scale and machine speed. But autonomy without identity control is chaos.
Organizations that bolt AI onto legacy, human-centric identity models will either overprivilege agents or slow innovation to a halt. Organizations that ignore identity will eventually lose control.
Identity is the only scalable control plane for agentic AI. Lifecycle governance is non-negotiable. And security must enable, not obstruct, innovation. The companies that win in the coming decade will be those that leverage AI to transform their business while remaining secure, and the key to doing that is identity. Extending this logic beyond the identity layer, The Action Surface Trap: Why AI Autonomy Demands Infrastructure Security explains why closing the loop on what agents can actually touch is the next step.
This article draws on research published by Token Security CEO Itamar Apelblat in BleepingComputer (March 2026). Related reporting referenced on the same publication includes coverage of a critical remote code execution vulnerability in GitLab's AI Gateway service and browser-based EDR blind spots exploited by threat actors using OAuth token theft.
Sources:
