​AI Agents Don’t Hack Their Way In—They’re Already Inside

Itamar Apelblat is the CEO and Co-Founder of Token Security, a serial entrepreneur and former IDF Unit 8200 cybersecurity leader.

getty

​The security industry has spent the last two years focusing on chatbots, prompt filtering and guardrails, which is a misdiagnosis of AI risk. AI agents have moved beyond chat interfaces and become operational actors inside enterprise environments. They authenticate into SaaS platforms, invoke cloud APIs, retrieve sensitive data, trigger workflows and execute actions across interconnected systems.

This fundamentally changes the AI risk model.

Agents operate through legitimate identities, authorized credentials and approved integrations. Because they function within trusted access paths, they don't need to bypass security controls in the traditional sense.

Controlling what agents are authorized to do, and what they truly need access to, is the real challenge.

AI Agents Have Access

Every meaningful action an AI agent takes inside an enterprise ultimately depends on using a valid identity. An agent can use OAuth tokens to access SaaS platforms, assume cloud roles to interact with infrastructure, invoke APIs using service credentials or inherit delegated permissions from users and orchestration frameworks. These are legitimate, authorized access paths.

This distinction matters because many AI security discussions still focus heavily on the model layer rather than whether an authenticated agent can access sensitive data, modify systems, execute workflows or chain actions across environments. A large language model (LLM) can't directly exfiltrate customer records from Salesforce or make infrastructure changes in a cloud environment, but an authenticated identity with delegated access can.

This is why identity is the primary enforcement layer for AI agent security. This threat isn’t about adversarial prompts but what happens when autonomous actors inherit enterprise-scale trust.

Identity As The Runtime Control Plane

Enterprise security controls were designed around predictable identities and stable behavior patterns. Human users authenticate interactively, while service accounts support known applications performing predefined functions.

AI agents, meanwhile, break every one of those assumptions. They're easy to create, frequently modified and are often deployed outside centralized governance processes. Agents may interact with dozens of systems simultaneously while dynamically changing how they execute tasks based on context. For example, two agents may have similar API permissions while performing entirely different operational functions and introducing vastly different levels of risk.

Traditional access governance models built around static entitlement reviews were never designed to govern autonomous behavior. AI agent risk needs to be evaluated and prioritized based upon its level of autonomy and what access it has.​

This is where identity goes from an authentication mechanism to the operational control plane for securing and governing AI activity. Organizations must continuously evaluate how identities are using access over time, whether behavior aligns with intended purpose and whether permissions remain appropriate as agents evolve.

Traditional IAM Was Never Built For This

Many organizations attempt to extend traditional IAM models directly into AI environments. This approach falls short because human identities are tied to explicit intent, defined responsibilities and relatively stable operational boundaries. AI agents aren't bound by these constraints. They introduce autonomous execution into identities that are already trusted.

That combination creates new security and governance problems. An organization can verify that an AI agent has authorization to access Jira, GitHub, AWS, Slack, Salesforce and internal databases. But should that agent be combining those permissions the way it currently is? Traditional IAM has no answer to that question. It was never designed to have one.

Agents often inherit permissions from developers, operators or integrated platforms. They accumulate access across workflows and retain privileges long after their original purpose changes. Some exist only temporarily inside orchestration frameworks or automation pipelines, making them difficult to discover and inventory. Others become embedded deeply into operational processes without clear ownership or accountability.

Over time, organizations can accumulate large numbers of active, dormant, duplicated or orphaned AI agents operating with valid credentials and little ongoing oversight. A report from the Cloud Security Alliance (CSA) found that only 21% of organizations have a formal decommissioning process for AI agents.

In many ways, this resembles the early stages of service account sprawl but with one important difference: AI agents are capable of autonomous decision making and multi-step operational execution. This significantly expands the potential threat surface of overprivileged identities.

Identity-First Security And Governance For Agents

Securing AI agents must start with visibility. This requires an accurate inventory of AI agents operating across co-pilots, orchestration frameworks, embedded SaaS capabilities, automation platforms and internally developed tooling. In other words, treat them as first-class identities governed throughout their life cycle.

But visibility is the floor, not the ceiling. Every AI agent should have clear ownership that defines its purpose, access boundaries, operational scope and life cycle. Without accountability, agents quickly become shared infrastructure with expanding privileges and no meaningful governance.

Most importantly, access decisions for AI agents must evolve beyond static permissions. Traditional least-privilege approaches were built around relatively predictable behavior. AI agents require more dynamic enforcement models capable of constraining access based on operational intent, runtime context and observed behavior patterns.

An AI agent designed to summarize incident tickets shouldn't gradually evolve into an identity capable of modifying cloud infrastructure, accessing financial systems or interacting broadly across sensitive data environments simply because those permissions became available through inherited trust relationships. This is why runtime identity security and governance matters.

Once AI agents gain the ability to perform legitimate actions, they operate at machine speed and enterprise scale. This is why identity becomes a durable enforcement point for determining and controlling what they're allowed to do.

Forbes Technology Council is an invitation-only community for world-class CIOs, CTOs and technology executives. Do I qualify?