Zero Trust for AI Agents: Why Separate Identity Alone Is Not Enough
Denis Korbakov, Technical Director at Smart-Soft, argues that conventional identity and access management systems are ill-equipped for the new class of autonomous AI agents that independently choose tools, switch contexts, and delegate permissions.
NIST SP 800-207 has long included non-person entities in its Zero Trust model, yet most corporate IAM implementations remain designed either for interactive human sessions or for long-lived static service accounts. AI agents sit between these two paradigms, requiring dynamic, task-specific credentials rather than persistent broad rights.
February 2026 data from the Gravitee State of AI Agent Security report reveal that only 21.9% of teams assign agents their own identity. Meanwhile 45.6% reuse shared API keys across agents and 44.4% rely on generic tokens. Cloud Security Alliance and Aembit findings indicate that 68% of organizations cannot clearly separate agent actions from human actions, 74% observe excessive access grants, and 52% record rights inheritance from users or other systems.
Reducing Zero Trust to three operational principles—explicit verification, least privilege, and assume breach—Korbakov maps each to agent workloads. Explicit verification demands that every tool invocation carries a verifiable agent identity together with a short-lived, narrowly scoped authorization decision that records the resource, operation, task, and initiator.
Least privilege requires binding rights to the exact task at hand rather than to the agent’s theoretical maximum permissions. Each logical agent receives a base machine identity, while every delegated sub-task obtains a short-lived derived context that preserves the full delegation chain: user → agent → sub-agent → tool.
Assume breach means that even if an agent is compromised through indirect prompt injection—an attack highlighted in OWASP LLM01:2025—or its runtime credentials are stolen, the resulting damage must be technically limited by architecture. The proposed three-layer model comprises machine identity, tool-level authorization, and independent policy enforcement points at the network (NGFW), Kubernetes (service mesh), or external API/MCP gateway layers.
A practical ticket-diagnosis workflow demonstrates the difference. Instead of a single broad token, the agent receives a 300-second credential limited to reading one specific repository and writing a single comment. Network traffic is forced through a dedicated VLAN segment enforced by Traffic Inspector Next Generation, producing both rule-hit syslog records and NetFlow metadata that can be correlated with agent-platform logs.
The article leaves open the question of sub-agent identity inheritance versus independent credentials and invites practitioners to share where they store and verify delegation chains—in IAM, API gateways, agent runtimes, or MCP gateways. Reference materials including OPA/Rego policies, stop-criterion matrices, and prompt-injection incident runbooks are provided for pilot deployments.
Related articles
Detecting Lateral Movement with Neural Networks Trained Solely on Synthetic Data
A researcher generated entire corporate network histories using a 135-line configuration file to create synthetic authentication logs containing lateral movement attacks. Neural networks trained exclusively on these artificial datasets were then evaluated against 1.65 billion real authentication events from Los Alamos National Laboratory, including 749 red team events across 301 compromised machines. The best ensemble of six models flagged 3.6 million hourly machine windows and placed 16 genuine attacks among the top 23 highest-scoring entries, producing only seven false positives. In comparison, a simple threshold counter required 161,000 false alarms to reach the same detection level. The approach also demonstrated an iterative feedback loop where detector errors directly informed refinements to the synthetic world generator. The work shows that synthetic data can reach AUC performance comparable to models trained on real labeled attacks while providing full control over the underlying attack definitions.
US Accuses Chinese AI Companies of Industrial-Scale Model Distillation Targeting Claude, GPT, Gemini and Grok
US agencies have accused six Chinese artificial intelligence firms of conducting large-scale unauthorized distillation operations to replicate advanced capabilities from leading models including Claude, GPT, Gemini, and Grok. The activity is reported to have begun at least by late 2024 and involved DeepSeek, Moonshot AI, Alibaba, MiniMax, StepFun, and Z.AI. Billions of tokens were extracted through millions of automated API requests routed via cloud providers, aggregators, and proxies to conceal origins and evade detection. The targeted capabilities included chain-of-thought reasoning, programming, software engineering, autonomous agent functions, and multimodal processing. Shared premium accounts and bulk subscriptions were used to lower costs while automated route-switching systems helped maintain access after blocks. Authorities assess that the sophistication and volume indicate distillation has become a core development method for these companies and likely occurred with Chinese government awareness. China has rejected the claims, stating its AI progress stems from independent innovation and calling the allegations unfounded.
Check Point Research Uncovers Cross-Session Command Channel in ChatGPT via JFrog Artifactory
Researchers at Check Point Research identified a covert channel that allowed commands to be passed between isolated ChatGPT sessions belonging to different user accounts. The channel exploited an internal JFrog Artifactory instance used by ChatGPT containers for package installation, enabling containers to read and write repository metadata that effectively served as a shared buffer. Attackers could inject malicious instructions into a victim's context through copied prompts, shared conversations, or custom GPTs, causing the assistant to execute hidden tasks while returning normal responses. In a demonstration, ChatGPT silently retrieved data from a connected Gmail account and forwarded it to the attacker's account. The technique potentially exposed chat history, uploaded files, and data from connected services including Google Drive, Microsoft Teams, and GitHub. OpenAI confirmed the affected Artifactory instance has been decommissioned, eliminating the channel, with no evidence of real-world exploitation reported.
Stop Asking If an AI Skill Is Safe — Ask What It Can Do Instead
A detailed analysis warns that AI agent skills distributed as simple text files can execute malicious commands with full user privileges. The article examines how prompt injection attacks embedded in skill.md files have already led to credential theft and persistent malware that survives system restores. Research by Snyk on 3984 public skills found that 36.8 percent contained at least one security issue and 13.4 percent had critical flaws. The author argues that traditional security badges are ineffective because skills can dynamically load payloads, target reviewers with injection, or change after initial review. Instead, a new tiered system called skill-xray classifies capabilities from inert text (T0) to runtime code loading (T4) and binds results to content hashes. The approach is implemented in an open-source MIT-licensed tool that combines static regex scanning with agent-based reporting to surface risks without issuing false safety guarantees.