Organizations are racing to deploy AI agents, but few understand the scale of the threat they’ve introduced. These agents don’t behave like traditional automation. They read, write, reason and act at machine speed – without human ethics, intuition, or hesitation. OWASP warns that AI agents evolve faster than the controls meant to contain them, bypassing decision‑making processes that once protected critical systems.
The result is a widening security gap. Attackers no longer need to break in; they can manipulate an agent into opening the door. IBM Newsroom estimates that the average cost of a data breach in the United States has reached US$10.22 million, while reputational damage can persist for years.
These agents can chain tools, escalate privileges and execute complex attacks that once required weeks of human effort. This fast-changing dynamic is inevitably exposing the soft underbelly of most traditional PAM architectures. They assume human behavior, pace and oversight, yet AI agents operate outside all three.
Omada warns that without proper governance, agents may accumulate permissions, bypass controls and act covertly. This leads to privilege chaining, cascading failures and the corruption of what agents use to justify, plan, and chain actions – their “Mythos,” often unseen by operators.
To keep pace with morphing cyber risks, organizations must rethink privileged access around continuous authorization, behavioral governance and zero implied trust for both human and non-human identities. These controls would also mitigate vulnerabilities identified by researchers that exposed the record count UI element on list pages. If exploited, attackers could have gained access to and exfiltrated personally identifiable information (PII), credentials and other sensitive data.
AI, from Helper to Hacker
The AI revolution began with simple calls and chatbots. It is evolving into multiagent systems capable of performing fully autonomous actions and operating at speeds that surpass those of most traditional PAM architectures.
According to ServiceNow’s 2025 vulnerability research, the shift from helper to hacker is already happening. Testing showed that hackers could impersonate users, create privileged accounts and gain full tenant access through the platform’s AI. Anthropic’s internal investigations reinforce the same notion. In April 2026, the company demonstrated AI agents capable of discovering vulnerabilities, writing exploit code and chaining attacks overnight without human guidance. AI agents don’t just accelerate productivity—they also accelerate cyber-attacks.
While navigating privileged access in an AI evolution can feel daunting, the task is not insurmountable. In the next section, I will share five architectural shifts that can rebuild PAM for this new era, treating agents as autonomous identities capable of both extraordinary value and astonishing harm.
Five Decisive Moves for Organizations to Modernize PAM
1. Treat Agents as First‑Class Identities
AI agents should be seen as individual entities, not extensions of human users. Each agent should have its own unique identity and should never inherit human permissions. It should be granted only the minimum privileges required to perform its designated functions, with no implied trust and tightly scoped access to APIs and tools.
For example, in a financial institution, an AI payments agent may prepare wire transfer requests or reconcile invoices. It should not create vendors, modify bank account numbers, approve payments or release funds. These actions require separate identities and human approval. This prevents attackers from manipulating an agent into quietly redirecting funds or creating fraudulent vendors.
These standards reduce AI‑related threats, including the one found by Anthropic’s internal red team. They showed that agents could identify vulnerabilities, write exploit code and chain actions with minimal input. Treating NHIs as first‑class identities reduces the risk of privilege misuse.
2. Institute Behavioral Guardrails
Further research into the risk potential of Mythos revealed how agents can have their intentions corrupted. This underscores the need to build walls around how agents interact with an organization. PAM architectures should construct a fully controlled pipeline for changes, in which every system checks policy before allowing an action, maintains strict tool boundaries and prevents autonomous privilege escalation.
In healthcare, for instance, an AI clinical agent may retrieve patient charts or summarize lab results, but it must never modify medication orders, update allergy lists or discharge patients. Any attempt to alter clinical data triggers mandatory human review, preventing life‑threatening errors and ensuring HIPAA compliance. These controls guard against manipulated agents, reduce operational disruptions and establish clear boundaries for monitoring and compliance.
3. Mandate a Human‑in‑the‑Loop
Labels should be applied to high-risk actions that trigger alerts requiring human approval across identity systems, including Active Directory, IAM, PAM, ERP platforms, databases and network devices.
Human approval should be required before an AI agent can perform activities such as:
- Configuration changes
- Password resets or password changes
- Financial transactions
- Large-scale data transfers
- System modifications
- Mass updates or deletions
- Administrative changes affecting user privileges or access
In SaaS environments, customer support agents may read tickets or draft responses, but they should not reset passwords, modify subscription tiers or access billing data without human approval. If a malicious prompt is embedded in a support ticket, plan-level monitoring detects the agent’s attempt to invoke administrative APIs and blocks the action before customer accounts are compromised.
Human oversight provides a final safeguard against unauthorized data deletion, configuration corruption, mass modifications and other irreversible actions performed by a compromised or manipulated AI agent.
4. Monitor Agent Plans
Imagine an employee uses company credentials for a personal account. That account is compromised and the information is exposed on the dark web. Or a successful social engineering campaign grants an attacker employee access to the network. Using those stolen credentials, the attacker manipulates an agent to infiltrate the system and elevate privileges.
Traditional monitoring only sees what an agent did, not what it intended to do. Attackers exploit this blind spot by manipulating the agent’s plan and the reasoning layer before the action occurs. Cloud Security Alliance calls prompt injection “the most persistent and difficult‑to‑fix threat,” highlighting the need for plan‑level monitoring.
PAM standards should monitor agent calls to tools or APIs and require agents to plan for oversight. Objectives must connect to user, session and policy data to track changes. Inputs need authentication and isolation to prevent poisoning. The process should validate intent, block unsafe steps, isolate prompts, sandbox tools and monitor actions to prevent prompt injections or manipulation.
5. Control Agent Sprawl
Organizations are already facing agent sprawl caused by user‑created and SaaS‑integrated agents. Most agents are unknown to IT, with no visibility into how many reside on their network, making it difficult to understand the extent of the potential threat surface.
Shadow agents with unknown privileges create an invisible attack surface, one that grows with every SaaS integration and user‑created workflow.
To counter agent sprawl, organizations must inventory agents, track privileges, enforce lifecycle governance and regularly certify access. These measures reduce outages, support audits and ensure compliance for third- and fourth-generation models.
IBM Newsroom reports, “63% of breached organizations either don't have an AI governance policy or are still developing a policy… and 97% lacked proper AI access controls.”
A Strategic Imperative
AI agents are accelerating, and so are attackers. Agents are manipulating systems, exploiting Mythos and leveraging AI’s speed to enhance their efforts. Many organizations are unprepared for current and emerging threats.
Securing AI identities is no longer a technical choice but a strategic imperative. Developing a PAM architecture to withstand AI advancements is feasible through anticipatory planning, robust governance and the safeguarding of all human or NHI identities.
