When AI Agents Break the Model

The Machine Identity Problem

Here's a statement that should make any security architect pause: in most enterprise environments today, machine identities - service accounts, API keys, deployment pipelines, and increasingly AI agents - outnumber human identities by a significant margin. In AI-native companies, that ratio is already 10 to 1 or higher.

Zero Trust was designed with human users as the primary subject. The model assumes identity belongs to a person who authenticated with credentials, uses a device you can evaluate, and accesses applications in recognizable patterns. AI agents don't fit that model.

What Changed When AI Entered the Picture

AI agents act autonomously. An AI agent running a workflow might make hundreds of API calls in minutes, query multiple data sources, generate and execute code, and trigger downstream actions - all autonomously. The behavioral baseline looks nothing like a human user.

AI agents operate across long contexts. A multi-hop, multi-system access pattern is exactly what lateral movement looks like. Distinguishing legitimate agent behavior from adversarial behavior is genuinely hard.

AI agents inherit and amplify permissions. If an agent runs in the security context of a human user or a service account with broad permissions, it can do whatever that identity can do - at machine speed.

AI agents can be manipulated. Prompt injection attacks - where malicious content embedded in data the agent processes causes it to perform unintended actions - are a real and growing attack class.

How Zero Trust Must Evolve for AI

1. Every AI Agent Needs Its Own Identity

An agent should not run under a shared service account or a human user's identity. It should have its own workload identity with permissions explicitly scoped to what that specific agent needs.

2. Least Privilege for Agentic Workflows

A more sophisticated approach uses just-in-time permission grants: the agent requests and receives the permission it needs for each step, uses it, and releases it. This is architecturally more complex but significantly reduces blast radius.

3. Protect AI Agent Inputs and Outputs

Prompt injection is the Zero Trust problem for the AI data plane. Treat all external content as untrusted data, not as instructions. Implement input sanitization before agent processing.

4. Behavioral Baselines for AI Agents

UEBA was built for human users. AI agents behave differently and require different baselines - agent activity should be logged separately with agent-specific context.

5. Human-in-the-Loop for High-Stakes Decisions

Irreversible high-stakes operations - sending external communications, modifying production data, executing financial transactions - should require human review before the agent proceeds.

The Multi-Agent Authorization Challenge

When AI agents call other AI agents, the authorization complexity compounds exponentially.

Agent Chain Depth	Authorization Decisions
1 agent	1
3 agents	7
5 agents	31
10 agents	1,023

Key threats in multi-agent systems include:

• Agent impersonation - an attacker posing as a legitimate agent in the network
• Delegation chain exploitation - accumulating permissions across a chain that no single agent should have
• Tool poisoning - compromising tools that agents share

The mitigation requires cryptographic identity verification for all agent-to-agent calls, permission diminishment rules where each delegation reduces available permissions, and maximum delegation depth limits.