Nearly 70% of Companies Lack Control Over AI Agent Privileges, PAM Survey Finds
A new survey highlights a critical gap in Privileged Access Management (PAM) practices: organizations are struggling to secure the growing number of machine identities created by AI agents, automated services, and cloud infrastructure.
Just a few years ago, privileged access primarily referred to human system administrators receiving root or Administrator rights. Today, however, non-human entities such as programs, services, and AI agents routinely hold equivalent or greater privileges. These machine identities can deploy applications to production, access databases, or create and delete virtual machines through CI/CD pipelines, API integrations, and cloud roles.
According to the AM Media poll, privileges of AI agents and automated services remain outside full control in 68% of cases. API keys, tokens, and secrets follow closely at 67%, while CI/CD and DevOps tool access accounts for 63%. Cloud roles reached 52%. In contrast, human system administrator accounts sit at 34% and service accounts at 26%.
Dmitry Simak, Product Manager for PAM Infrascope at NGR Softlab, explained that machine accounts frequently interact with multiple systems simultaneously and are therefore granted wide privileges. Their compromise can therefore grant attackers access to every connected system rather than a single target.
Ruslan Sharifulin of Safeinspect at Solar Group stressed that humans cannot respond to AI-driven threats in milliseconds. The primary task of modern PAM is therefore to place strict boundaries around non-human entities and enforce least-privilege principles.
Survey respondents indicated that usability for administrators and end users (72%) and simplicity of implementation (63%) are the top factors when choosing a PAM solution. Only 41% cited price as a primary concern.
Denis Morozov, CEO of JumpServer PAM, suggested that integrating AI into PAM platforms could analyze complex permission matrices, calculate risk scores, and present clear recommendations to security teams. Participants concluded that while AI agents introduce new threats, PAM remains essential and must evolve to cover machine identities.
Related articles
GPT-6 Astra Shows Strong Tool Use and Math Results but Trails in Text Quality Tests
OpenAI released GPT-6 Astra on 3 September 2026 with capabilities for long-horizon tasks involving code, documents and external tools. Independent benchmarks from Artificial Analysis, Epoch AI and others reveal a mixed picture: the model leads in Epoch Capabilities Index and certain coding agent tests yet falls behind Claude Fable 5.1 in text generation and some professional document tasks. Astra solved two previously open problems on FrontierMath Erdős and reached 99.9 percent on ARC-AGI-3 when paired with a state-preserving adapter. The model was rated Critical for cyber capabilities after scoring 100 percent on ExploitBench and discovering two previously unknown vulnerabilities. Pricing starts at $10 per million input tokens, 2.5 times higher than GPT-5.6 Sol, while real-world costs vary sharply depending on task length and retries.
Stop Asking If AI Agent Skills Are Safe — Focus on Capability Disclosure Instead
A new approach called capability disclosure is proposed for evaluating skills used by AI agents, replacing unreliable safety badges. The shift comes after documented cases where malicious SKILL.md files survived system reinstalls through backups and executed data theft via prompt injection. Snyk's ToxicSkills analysis of 3984 public skills found 36.8% with security issues and 13.4% critical, including 76 confirmed malicious payloads. The skill-xray tool provides structural scanning and tiered reporting from T0 (inert text) to T4 (opaque runtime code loading) without issuing safety verdicts. Real-world examples include CVE-2025-6514 affecting mcp-remote with over 437,000 installations. The method emphasizes revealing what a skill can access rather than promising it is harmless.
OpenAI GPT-6 Astra Deploys Multi-Agent Parallel Processing, Increasing Local CPU Load and Security Risks
Early users of GPT-6 Astra have observed the model distributing complex tasks across multiple specialized agents that plan, solve, test code, verify results, and iterate after failures. This multi-agent approach enables faster handling of multi-step workflows compared to sequential chatbots. OpenAI states that Astra can control computers, operate browsers and applications, and install or test software, though it has not officially confirmed a native multi-agent architecture. Main computations run in the cloud, but agent tools can execute on user devices or corporate servers, leading to noticeable processor load when multiple agents compile code, launch browsers, run tests, and operate containers simultaneously. Corporate environments face added complexity as each agent requires virtual machines, sandboxes, internal data access, and careful environment cleanup. The increased autonomy has prompted OpenAI to strengthen monitoring of Astra actions and permission boundaries for subscribers of ChatGPT and enterprise clients.
Microsoft Copilot Can Surface Overshared Data Despite Permission Boundaries
Microsoft documentation states that Copilot only accesses data authorized for the signed-in user, yet default SharePoint and OneDrive sharing settings often grant broad access that the AI then respects literally. This creates accidental oversharing risks where Copilot retrieves documents shared too widely years earlier. Administrators can use Content Management Assessment and Data access governance reports, including the EEEU report covering the top 100 sites shared in the past 28 days, to identify problematic content. Two distinct controls exist: Restricted Access Control removes access entirely while Restricted Content Discovery hides items from Copilot and search without altering permissions. Sensitivity labels combined with encryption can exclude programmatic access for agents, though Microsoft does not guarantee outright blocking. Interaction logs stored in Microsoft Purview retain user prompts, Copilot responses, and citations to accessed documents, providing an audit trail for oversharing incidents.