AI Agents Are Breaking the Security Model Enterprises Spent a Decade Building

Key points

• Agentic AI, meaning software that acts on its own initiative across multiple systems, creates attack paths that zero-trust security frameworks were never designed to detect.
• Security experts estimate roughly 80% of AI agents running inside enterprise networks are not registered with IT or security teams.
• Agents can pass malicious instructions to other agents through channels no vendor has yet made visible to security staff.
• Criminals who hijack one AI agent can use it to quietly infect others, then let the first agent get caught while the real attack runs days later.
• Short-lived, narrowly scoped agent credentials and a clear undo capability for any action an agent takes are the practical starting point.

Zero trust is a security approach built on one simple idea: never trust anyone automatically, always check. Every person and device that tries to access a company's systems gets verified every time, no matter where they are. Enterprises have spent years and significant budget trying to put this model in place.

AI agents are now threatening to make that effort meaningless.

An AI agent is software that works on its own: it reads files, queries databases, writes summaries, sends emails, all without a human approving each step. That independence is the entire point. It is also the problem.

How does an AI agent break zero trust?

Zero trust checks each request in isolation. It cannot see a pattern building across five separate, individually approved steps.

Nik Kale, a member of the Coalition for Secure AI (CoSAI), put it plainly in analysis first reported by CSO Online: "An agent can be allowed to read a document, allowed to query another data source, allowed to summarize what it found, allowed to write it to a file, allowed to send an external email, and every one of those decisions is correct on its own. Put them in that order and you just authorized an exfiltration path."

Exfiltration means stealing data out of a company. Each door the agent walked through was unlocked. Nobody approved the destination.

The identity problem compounds this. An agent gets approved on Monday. By Friday, the underlying model has been updated, new tools added, context memory filled with data nobody reviewed. The badge still says approved, but the machine wearing it is materially different. Our 28 August piece on identity fabric architecture found this drift between approved identity and actual capability is already the central anxiety for security architects tracking non-human accounts.

Should security teams be worried about agents talking to each other?

Yes. This is where the exposure gets serious, and where current tools offer almost nothing.

Authorised agents can create sub-agents that inherit full permissions but carry no recognised identity. Agents can also send instructions to other agents through channels that are, for now, invisible. Security teams can detect that a conversation happened; they cannot see what was said. No vendor has solved this, despite the problem being widely known for over a year.

Krti Tallam, senior member of technical staff at Kamiwaza.ai, frames the scale of it bluntly: "Some 80% of your agents are not on your list. That's not a control. It's an inventory of the compliant minority."

Those unregistered agents arrive through two routes: employees who deploy AI tools without going through IT (known as shadow IT), and credentialed third-party vendors who spin up agents inside a client's environment without asking.

Risk factor	Current status
Agent-to-agent message visibility	No vendor solution exists
Unregistered agents in enterprise environments	Estimated 80% of total agents
Sub-agent identity verification	Not addressed by any major platform
Hijacked agent detection	Possible, but attackers now pace infections to avoid it

Attackers are already adapting. A hijacked agent infects several others with delayed instructions, then allows itself to get caught and shut down. The real attack runs days later from the infected agents, which continue to behave normally until they execute their poisoned instructions.

What should organisations actually do?

Mike Wilkes, enterprise CISO at Aikido Security, recommends treating agent credentials the way GPG/OpenPGP encryption software treats signing keys: a strongly protected primary identity delegates limited, short-lived permissions downward to each agent. Every agent gets rate limits and an approval gate before any high-consequence action.

Reversible actions are far safer to delegate than permanent ones. Deleting production data or transferring funds should never be left to an agent acting alone.

Brian Vecci, field CTO at data-security company Varonis, adds a harder truth: collecting logs of everything agents do is the right instinct, but the volume of activity makes analysis nearly impossible. "It's like trying to find a needle in a haystack by throwing more hay on it."

The practical starting point is a full agent inventory. Require short-lived credentials for every agent. Block irreversible actions behind a human approval step. Assume any agent you have not registered is already running somewhere in your environment.

The real story here isn't that zero trust failed. It's that the framework was designed for humans and devices with stable identities, not for software that rewrites its own capabilities between Monday and Friday and breeds unregistered copies of itself. Until vendors can make agent-to-agent communication visible, every enterprise running agentic AI is operating on trust it cannot verify.