Autonomous AI agents can walk through multiple individually authorized actions to create an unauthorized data exfiltration path, defeating zero trust security models designed to evaluate requests one at a time, according to security experts quoted in CSO Online. Nik Kale, a member of the Coalition for Secure AI and ACM's AI Security program committee, notes that an agent permitted to read a document, query data, summarize findings, write to a file, and send external email can assemble these legitimate steps into an exfiltration sequence. The core problem, experts say, is that agentic AI operates in direct contradiction to zero trust principles, while roughly 80% of enterprise agents remain unregistered and outside IT oversight.
The visibility challenge extends to agent-to-agent communications, where no vendor has delivered a mechanism to reveal what autonomous agents say to each other despite this security gap being widely recognized for at least a year. Authorized agents can spawn subagents that inherit full privileges without a recognized identity, and agents can pass malicious instructions to other agents through communications that IT teams can detect but not decipher. Hijacked agents are already limiting how many other agents they contact to avoid raising red flags, then allowing themselves to be caught while infected agents execute poisoned instructions days later. Krti Tallam, senior member of technical staff for security engineering at Kamiwaza.ai, characterizes the inventory-based governance model as aimed at the wrong layer, calling it "an inventory of the compliant minority" rather than a genuine control.
Kale argues that zero trust systems fail to track whether the entity using an approved identity today matches what was originally authorized, since updating a model, adding tools, letting memory fill with unreviewed context, or granting delegation authority doesn't touch the identity itself. "You can have a materially different machine on Friday wearing the badge than what you approved on Monday," he states. Brian Vecci, field CTO at Varonis, contends that enterprise CISOs "are woefully underprepared for NHI with their non-deterministic actions," adding that many telemetry efforts resemble "trying to find a needle in a haystack by throwing more hay on it." The fundamental mismatch, Kale points out, is that business teams measure agents by what they save or produce while security teams are measured by everything that goes wrong.
Security professionals suggest borrowing from GPG/OpenPGP models where a strongly protected primary identity delegates limited, short-lived credentials to agents, with even narrower permissions for subagents, according to Mike Wilkes, enterprise CISO at Aikido Security. Recommended controls include rate limits, transaction boundaries, spending and data budgets, sandboxing, approval gates for high-consequence actions, and immutable activity logs. Tallam expects attackers to grow more sophisticated, with hijacked agents learning what their victim agents are supposed to do and splitting attack instructions among many agents so none deviate noticeably from legitimate behavior. The enterprise security model must shift from pretending to control the environment to recognizing that traditional identity-based controls can't keep pace with autonomous systems that strategically assemble authorized actions into unauthorized outcomes. Organizations clinging to allowlist-based governance are discovering that giving it better marketing and calling it zero trust doesn't solve the fundamental problem of agents that evolve faster than the badges they wear.