Zero Trust for AI Agents: Why Separate Identity Alone Is Not Enough
Denis Korbakov, Technical Director at Smart-Soft, argues that conventional identity and access management systems are ill-equipped for the new class of autonomous AI agents that independently choose tools, switch contexts, and delegate permissions.
NIST SP 800-207 has long included non-person entities in its Zero Trust model, yet most corporate IAM implementations remain designed either for interactive human sessions or for long-lived static service accounts. AI agents sit between these two paradigms, requiring dynamic, task-specific credentials rather than persistent broad rights.
February 2026 data from the Gravitee State of AI Agent Security report reveal that only 21.9% of teams assign agents their own identity. Meanwhile 45.6% reuse shared API keys across agents and 44.4% rely on generic tokens. Cloud Security Alliance and Aembit findings indicate that 68% of organizations cannot clearly separate agent actions from human actions, 74% observe excessive access grants, and 52% record rights inheritance from users or other systems.
Reducing Zero Trust to three operational principles—explicit verification, least privilege, and assume breach—Korbakov maps each to agent workloads. Explicit verification demands that every tool invocation carries a verifiable agent identity together with a short-lived, narrowly scoped authorization decision that records the resource, operation, task, and initiator.
Least privilege requires binding rights to the exact task at hand rather than to the agent’s theoretical maximum permissions. Each logical agent receives a base machine identity, while every delegated sub-task obtains a short-lived derived context that preserves the full delegation chain: user → agent → sub-agent → tool.
Assume breach means that even if an agent is compromised through indirect prompt injection—an attack highlighted in OWASP LLM01:2025—or its runtime credentials are stolen, the resulting damage must be technically limited by architecture. The proposed three-layer model comprises machine identity, tool-level authorization, and independent policy enforcement points at the network (NGFW), Kubernetes (service mesh), or external API/MCP gateway layers.
A practical ticket-diagnosis workflow demonstrates the difference. Instead of a single broad token, the agent receives a 300-second credential limited to reading one specific repository and writing a single comment. Network traffic is forced through a dedicated VLAN segment enforced by Traffic Inspector Next Generation, producing both rule-hit syslog records and NetFlow metadata that can be correlated with agent-platform logs.
The article leaves open the question of sub-agent identity inheritance versus independent credentials and invites practitioners to share where they store and verify delegation chains—in IAM, API gateways, agent runtimes, or MCP gateways. Reference materials including OPA/Rego policies, stop-criterion matrices, and prompt-injection incident runbooks are provided for pilot deployments.
Related articles
Deepfake Videos for Business Attacks Drop to Just $5 per Minute as AI Costs Plummet
The cost of creating convincing deepfake videos for attacks on companies has fallen roughly 100 times over the past two years. A single minute of high-quality fake video can now be produced for as little as $5, compared with several hundred dollars previously. The drop in prices was reported by Russian newspaper Izvestia, which also noted that underground marketplaces now sell ready-made templates that further reduce expenses. Lower prices significantly lower the barrier for criminals to conduct business email compromise and CEO impersonation scams. Experts warn that recognizable faces combined with urgent requests for wire transfers or credential sharing make traditional verification methods less reliable. Organizations are advised to confirm all financial instructions through an independent, pre-established channel rather than relying on video calls alone.
Over a Dozen AI Platforms Breached in One Month for API Keys in LLM-Jacking Operations
Between late September and early November, at least a dozen AI developer platforms were compromised in a coordinated campaign targeting API access tokens rather than customer data. Affected organizations include Andromeda, NVIDIA Brev, CommandCode, Fireworks AI, Lightning AI, Northflank, OpenCode, Railway, Trigger.dev, Warp, Zeabur, Chainstack, and WorkOS. Attackers exploited third-party components and internal sales applications to reach stored credentials used for AI inference services. The stolen tokens enable LLM-jacking and model distillation activities, with multiple threat groups observed reusing the same credentials shortly after disclosure. The open-source penetration testing framework Artex was used to automate reconnaissance and exploitation, lowering the barrier for less skilled actors. Companies such as Chainstack and WorkOS confirmed the incidents through their own disclosures, highlighting risks in non-core systems that store high-value AI credentials.
NIST Publishes Draft Taxonomy SP 2400-102 for Attacks on AI Agents
The National Institute of Standards and Technology released the first public draft of SP 2400-102 E2026 on 9 November 2026, extending its 2025 machine learning attack taxonomy with a dedicated chapter on AI agents. The document provides a common terminology for attacks targeting task formulation, planning, tool execution, and result interpretation stages. Attack goals include availability disruption through infinite tool calls, integrity violations that alter outputs or trigger unauthorized actions, sensitive data disclosure, and malicious agent misuse. Vectors range from direct user prompt bypasses and supply-chain model poisoning to indirect prompt injection via untrusted documents, persistent memory poisoning, compromised tools, and inter-agent message spoofing. NIST also examines layered defenses combining model-level detection of parasitic instructions with system-level restrictions, tool isolation, and human confirmation for high-impact operations. The draft references OWASP LLM03:2026 Excessive Agency and aligns with Russian standards GOST R 56939-2024 and GOST R 59276-2020 for testing and trust evaluation. Comments are accepted until 18 December 2026 before final publication.
Fake ITSM Tickets Allow Attackers to Trick AI SOC Agents into Dismissing Real Incidents
An experiment with the DeepSeek model showed that AI agents in Security Operations Centers can be reliably deceived by forged change-management tickets rather than classic prompt injection. Attackers with limited rights edit already-approved tickets in an ITSM system, changing the server and maintenance window while preserving the “Approved” status. The agent reads the ticket, matches the observed actions to the documented work, and automatically closes the alert. Human analysts reviewing the closed case later see only the reassuring link to the ticket and may also accept the decision. Three common LLM-based defenses—strict prompting, a secondary critic model, and supplying audit logs—either blocked too many legitimate changes or still allowed a quarter of attacks through. Only a deterministic code gate that cross-checks the ticket against immutable logs, role directories, and time windows achieved zero false closures on the test set while still automating 97 percent of genuine maintenance events.