AI Agents Are Breaking the Security Model Enterprises Spent a Decade Building

Key points

• Agentic AI, meaning software that acts on its own initiative across multiple systems, creates attack paths that zero-trust security frameworks were never designed to detect.
• Security experts estimate that roughly 80% of AI agents running inside enterprise networks are not registered with IT or security teams.
• Agents can pass malicious instructions to other agents through channels that no vendor has yet made visible to security staff.
• Criminals who hijack one AI agent can use it to quietly infect others, then let the first agent get caught while the real attack runs days later.
• Experts recommend short-lived, narrowly scoped agent credentials and a clear "undo" capability for any action an agent takes.

Zero trust is a security approach built on one simple idea: never trust anyone automatically, always check. Every person and every device that tries to access a company's systems gets verified, every time, no matter where they are. Enterprises have spent years and significant budget trying to put this model in place.

AI agents are now threatening to make that effort meaningless.

An AI agent is software that works on its own: it reads files, queries databases, writes summaries, sends emails, all without a human approving each step. That independence is the entire point. It is also the problem.

How does an AI agent break zero trust?

Zero trust checks each request in isolation. It cannot see a pattern building across five separate, individually approved steps.

Nik Kale, a member of the Coalition for Secure AI (CoSAI), put it plainly in analysis first summarised by CSO Online: "An agent can be allowed to read a document, allowed to query another data source, allowed to summarise what it found, allowed to write it to a file, allowed to send an external email, and every one of those decisions is correct on its own. Put them in that order and you just authorised an exfiltration path."

Exfiltration means stealing data out of a company. Each door the agent walked through was unlocked. Nobody approved the destination.

The identity problem compounds this. An agent gets approved on Monday. By Friday, the underlying model has been updated, new tools added, context memory filled with data nobody reviewed. The badge still says approved. The machine wearing it is materially different.

Should security teams be worried about agents talking to each other?

Yes. This is where the exposure gets serious, and where current tools offer almost nothing.

Authorised agents can create sub-agents that inherit full permissions but carry no recognised identity. Agents can also send instructions to other agents through channels that are, for now, invisible. Security teams can detect that a conversation happened; they cannot see what was said. No vendor has solved this, despite the problem being widely known for over a year.

Krti Tallam, senior member of technical staff at Kamiwaza.ai, frames the scale of what this means: "Some 80% of your agents are not on your list. That's not a control. It's an inventory of the compliant minority."

Those unregistered agents arrive through two routes: employees who deploy AI tools without going through IT (known as shadow IT), and credentialed third-party vendors who spin up agents inside a client's environment without asking.

Risk factor	Current status
Agent-to-agent message visibility	No vendor solution exists
Unregistered agents in enterprise environments	Estimated 80% of total agents
Sub-agent identity verification	Not addressed by any major platform
Hijacked agent detection	Possible, but attackers now pace infections to avoid it

Attackers are already adapting. A hijacked agent infects several others with delayed instructions, then allows itself to get caught and shut down. The real attack runs days later from the infected agents, which continue to behave normally until they execute their poisoned instructions.

What should organisations actually do?

Mike Wilkes, enterprise CISO at Aikido Security, recommends treating agent credentials the way email encryption software treats signing keys: a strongly protected primary identity delegates limited, short-lived permissions downward to each agent. Every agent gets rate limits, spending caps, and an approval gate before it can take any high-consequence action.

Critically, Wilkes argues that reversible actions are far safer to delegate than permanent ones. Deleting production data, transferring funds, or changing access-control policies should never be left to an agent acting alone.

Brian Vecci, field CTO at data-security company Varonis, adds a harder truth: collecting logs of everything agents do is the right instinct, but the volume of activity makes analysis nearly impossible. "It's like trying to find a needle in a haystack by throwing more hay on it."

For security teams, the practical starting point is a full agent inventory, including everything employees and third parties have already deployed without approval. Require short-lived credentials for every agent. Block irreversible actions behind a human approval step. And assume that any agent you have not registered is already running somewhere in your environment.