{"id":16667,"date":"2026-09-03T08:31:50","date_gmt":"2026-09-03T08:31:50","guid":{"rendered":"https:\/\/newestek.com\/?p=16667"},"modified":"2026-09-03T08:31:50","modified_gmt":"2026-09-03T08:31:50","slug":"zero-trust-has-a-big-ai-agent-problem-ahead","status":"publish","type":"post","link":"https:\/\/newestek.com\/?p=16667","title":{"rendered":"Zero trust has a big AI agent problem ahead"},"content":{"rendered":"
\n
\n
\n
\n
\n
\n
<\/div>\n<\/section>\n

Despite singing the praises of zero trust for many years, many CISOs have struggled to implement the framework in full<\/a>. And now comes what could be the final nail: agentic AI.\u00a0<\/p>\n

Can zero trust coexist with autonomous agents in typical enterprise environments? Technically, yes. In \u00a0practice, not likely, given CEO\/board-level urgency to accelerate agentic ROI delivery. And it\u2019s a significant issue given recent demonstrations of autonomous agents behaving badly<\/a> and a lack of clarity around who is accountable when AI agents go rogue<\/a>.<\/p>\n

Part of the issue is a storytelling one familiar to board-reporting CISOs: \u201cZero trust\u201d is a security term; \u201ccatastrophic business risk\u201d is what the board and CEO will respond to.<\/p>\n

\u201cThe business gets measured on what the agent saved or produced. Security gets measured on everything that happens when it goes wrong,\u201d points out Nik Kale<\/a>, a member of the Coalition for Secure AI (CoSAI) and ACM\u2019s AI Security (AISec) program committee. \u201cThey\u2019re looking at the same agent through two completely different balance sheets.\u201d<\/p>\n

Critically, Kale argues, the very nature of agentic AI is the polar opposite of zero trust.\u00a0<\/p>\n

\u201cZero trust was designed to evaluate requests one at a time, which is fine when the thing making the requests isn\u2019t strategically assembling them into something bigger. Agents change that. An agent can be allowed to read a document, allowed to query another data source, allowed to summarize what it found, allowed to write it to a file, allowed to send an external email, and every one of those decisions is correct on its own. Put them in that order and you just authorized an exfiltration path,\u201d Kale notes.<\/p>\n

\u201cAn agent can walk through five perfectly legal doors and end up somewhere the business never authorized,\u201d he adds. \u201cIn finance, you can have 10 transactions that each sit under the escalation threshold and a total nobody would have signed off on.\u201d<\/p>\n

According to Kale, the harder question is \u201cwhether the thing using that identity today is still the thing you approved.\u201d<\/p>\n

\u201cUpdate the model, add a tool behind the same interface, let the memory fill up with context nobody reviewed, give it a delegate, and none of that touches the identity,\u201d he explains. \u201cThe list still says approved. You can have a materially different machine on Friday wearing the badge than what you approved on Monday.\u201d<\/p>\n

The lack of that contextual knowledge is critical. \u201cYou have to know what that identity has become, what authority it\u2019s carrying, what sequence it\u2019s putting together, and whether the next system agrees the authority is valid,\u201d Kale says. \u201cOtherwise, we took an allowlist, gave it better marketing, and called it zero trust.\u201d<\/p>\n

Why the agentic problem hits harder<\/h2>\n

Zero trust was offered up as the security model for a distributed and risky era<\/a>. It\u2019s \u201cnever trust, always verify\u201d core principle applies to every user and device accessing the corporate network, regardless of whether they are within or outside its perimeter.<\/p>\n

But agentic AI complicates this situation in a way that makes the problem of autonomous agents far worse.\u00a0Authorized agents can spawn subagents that can inherit all the originator\u2019s privileges but without a recognized identity. Agents can also communicate with other agents, potentially giving those other agents malicious instructions. Despite this security hole being widely known for at least a year<\/a>, no vendor has delivered a mechanism to pierce that agent-to-agent secrecy. At best, systems might detect a communication has happened, but not what is said.<\/p>\n

The typical way to control agent activity is to require agents to be onboarded by IT or security teams. Each agent is issued an identity and only those identities can perform any action.<\/p>\n

The reality, however, is far different. The overwhelming majority of agents in enterprise environments are not registered, whether because they were dispatched by workers who didn\u2019t bother going through the paperwork (aka shadow IT) or due to credentialed third parties launching agents in your environment without asking for permission. And that\u2019s not even considering the fact that, as with any identity, attackers and especially state actors can hijack them. Like a security guard left to protect a restricted area armed only with a list of approved license plates, IT is left not knowing who is actually driving any of agents in its networks.<\/p>\n

\u201cYour governance model is often aimed at the incorrect layer. Some 80% of your agents are not on your list. That\u2019s not a control. It\u2019s an inventory of the compliant minority,\u201d says Krti Tallam<\/a>, senior member of technical staff for security engineering at Kamiwaza.ai. \u201cThis inventory model has never survived real contact within any enterprise. We have to stop pretending that we control the environment. [Agentic] didn\u2019t kill zero trust. It killed a convenient lie, a comfortable lie.\u201d<\/p>\n

As for the agent-to-agent communication problem, agents often try to obfuscate their messages, sometimes by embedding instructions in images or audio\/video files.<\/p>\n

The agent-to-agent visibility conundrum<\/h2>\n

Tallam is skeptical that CISOs will ever gain visibility into those agent-to-agent messages, but she expects attackers to get more sophisticated and nuanced in their attack methods.\u00a0<\/p>\n

Hijacked agents already limit the number of agents they contact and contaminate with malicious instructions to avoid suspiciously high numbers.\u00a0The tactic is to let the original hijacked agent get caught and shut down, with the real passed-along attack happening days later when the infected agents carry out their poisoned instructions.\u00a0<\/p>\n

The traditional defense is to monitor the behavior of all agents so that infected agents will also be shut down as soon as they engage in malicious behavior. Tallam, however, expects hijacked agents to begin learning what their victim agents are supposed to be doing and what they are allowed to do. That might be as easy as simply asking the agents for that information.<\/p>\n

\u201cThe trick is to split the attack instructions among many agents in such a way that none of them meaningfully deviate from their legitimate instructions,\u201d Tallam says.<\/p>\n

Mike Wilkes<\/a>, enterprise CISO at Aikido Security, suggests CISOs steal a lesson from GPG\/OpenPGP, where a user \u201cretains a strongly protected primary identity and delegates limited, short-lived signing subkeys or cryptographically signed credentials to an agent, with still narrower delegated credentials for subagents.\u201d<\/p>\n

That means agents will get a mix of \u201crate limits, transaction boundaries, spend and data budgets, sandboxing, approval gates for high-consequence actions, and immutable activity trails,\u201d Wilkes says. \u201cMost importantly, autonomous systems need quick and confident undo buttons. Type 2 decisions, where the consequences are reversible, are much safer to delegate than Type 1 decisions such as deleting production data, changing IAM policy, transferring funds, or making irreversible infrastructure changes.\u201d<\/p>\n

Brian Vecci<\/a>, field CTO at Varonis, argues that the agent situation is worse than most believe.\u00a0<\/p>\n

Enterprise CISOs \u201care woefully underprepared for NHI with their non-deterministic actions. You need to assume that identity is a woefully inadequate level of control,\u201d Vecci says.\u00a0<\/p>\n

Gathering as much information as possible about agent activity is a fine goal, but the accuracy and feasibility of collecting such telemetry is difficult, Vecci notes, adding that many enterprise agent telemetry efforts are like \u201ctrying to find a needle in a haystack by throwing more hay on it.\u201d<\/p>\n<\/div>\n<\/div>\n<\/div>\n<\/div>\n<\/div>\n","protected":false},"excerpt":{"rendered":"

Despite singing the praises of zero trust for many years, many CISOs have struggled to implement the framework in full. And now comes what could be the final nail: agentic AI.\u00a0 Can zero trust coexist with autonomous agents in typical enterprise environments? Technically, yes. In \u00a0practice, not likely, given CEO\/board-level urgency to accelerate agentic ROI delivery. And it\u2019s a significant issue given recent demonstrations of… <\/p>\n

Read More<\/a><\/p>\n","protected":false},"author":1,"featured_media":0,"comment_status":"closed","ping_status":"closed","sticky":false,"template":"","format":"standard","meta":{"inline_featured_image":false,"footnotes":""},"categories":[1],"tags":[],"class_list":["post-16667","post","type-post","status-publish","format-standard","hentry","category-uncategorized","is-cat-link-borders-light is-cat-link-rounded"],"_links":{"self":[{"href":"https:\/\/newestek.com\/index.php?rest_route=\/wp\/v2\/posts\/16667","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/newestek.com\/index.php?rest_route=\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/newestek.com\/index.php?rest_route=\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/newestek.com\/index.php?rest_route=\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/newestek.com\/index.php?rest_route=%2Fwp%2Fv2%2Fcomments&post=16667"}],"version-history":[{"count":0,"href":"https:\/\/newestek.com\/index.php?rest_route=\/wp\/v2\/posts\/16667\/revisions"}],"wp:attachment":[{"href":"https:\/\/newestek.com\/index.php?rest_route=%2Fwp%2Fv2%2Fmedia&parent=16667"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/newestek.com\/index.php?rest_route=%2Fwp%2Fv2%2Fcategories&post=16667"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/newestek.com\/index.php?rest_route=%2Fwp%2Fv2%2Ftags&post=16667"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}