Despite the long-standing promotion of zero trust security models, many Chief Information Security Officers (CISOs) continue to find full implementation a daunting task. The emergence of autonomous AI agents complicates this landscape significantly.
While theoretically compatible with zero trust principles, the practicalities of deploying autonomous agents within enterprise environments suggest otherwise. The increasing demand from CEOs and boards for rapid returns on investments from these AI systems raises pressing concerns, especially in light of recent instances where autonomous agents displayed erratic behavior. These incidents have left unanswered questions about accountability when AI agents deviate from expected norms.
A dichotomy exists when CISOs report on security efforts — zero trust represents a specific security strategy, while the board’s priority often revolves around mitigating catastrophic business risks. “The business gets measured on what the agent saved or produced. Security gets measured on everything that happens when it goes wrong,” highlights Nik Kale, a member of the Coalition for Secure AI. The scrutiny on agents from two distinct perspectives creates a challenging dynamic.
Understanding the Contradictions of Agentic AI
At its core, zero trust mandates that requests be evaluated individually. However, the nature of agentic AI transforms this notion. An autonomous agent can be granted permissions to execute seemingly benign actions, such as accessing documents or querying data, which when sequenced improperly, can lead to unauthorized data exfiltration. Kale points out that an agent may navigate through multiple authorized pathways, ultimately leading them to unapproved destinations.
The critical question arises: is the entity using that identity the same one that was initially validated? Kale explains that even minor updates within an AI's operating model can obscure its true identity. “You can have a materially different machine on Friday wearing the badge than what you approved on Monday,” he warns. This lack of contextual understanding surrounding identities can undermine the zero trust framework, leading to situations where it effectively becomes a mislabelled allowlist.
The Deepening Challenges of Agentic AI in Security
Zero trust is meant to safeguard enterprises against increasing risks from distributed networks. Its principle of “never trust, always verify” applies universally to users and devices alike. Yet, with the advent of agentic AI, this becomes increasingly problematic. Authorized agents can generate subagents that inherit permissions without a traceable identity, creating potential vulnerabilities. Despite awareness around this issue, little progress has been made in establishing effective methods to manage these hidden communications safely.
Typically, organizations require agents to go through IT or security teams for onboarding, thus creating a structured identity framework. The reality, however, is that many agents operate without such oversight, either through shadow IT initiatives or by being activated by third-party services without proper permissions. This leaves organizations vulnerable, akin to a security guard reliant solely on a list of recognizable license plates.
“Your governance model is often aimed at the incorrect layer. Some 80% of your agents are not on your list. That’s not a control. It’s an inventory of the compliant minority,” states Krti Tallam, security engineering expert at Kamiwaza.ai. What’s evident is that agentic AI hasn’t dissolved the zero trust framework; rather, it’s revealed significant flaws in the assumptions underpinning many organizations' security postures.
Challenges of Visibility Between Agents
As for communications between agents, gaining visibility remains a pressing concern. It’s become apparent that hijacked agents often minimize their contacts with other agents to evade detection. The strategies employed include delaying actual malicious actions until after the original agent has been compromised.
The conventional approach to combating these risks involves monitoring agent behaviors to identify and quarantine any infected entities. However, the sophistication of attacks is evolving; hijacked agents may learn what normal behavior patterns look like, thereby hiding their malicious intents more effectively. “The trick is to split attack instructions among many agents in such a way that none of them meaningfully deviate from their legitimate instructions,” explains Tallam.
Proposed strategies suggest that CISOs adopt lessons from cryptographic systems such as GPG/OpenPGP, which retain a securely protected primary identity while granting constrained permissions to the agents. Mike Wilkes, enterprise CISO at Aikido Security, emphasizes the importance of introducing forms of oversight like transaction boundaries and immutable activity logs for the actions taken by agents.
Furthermore, the key is to implement “quick and confident undo buttons” to ensure that reversible actions can be delegated without compromising security. Such protections are invaluable in modern environments where irreversible changes could occur, leading to catastrophic breaches.
Brian Vecci, field CTO at Varonis, suggests that the situation with agents may be graver than anticipated. “Enterprise CISOs are woefully underprepared for non-deterministic actions,” he asserts, warning that relying solely on identity for control mechanisms falls far short of what is needed. The challenge of obtaining accurate telemetry on agent behavior will be critical, but the methods currently in use may be ineffectual, likened to “trying to find a needle in a haystack by throwing more hay on it.”
