Agentic AI Is Now a Breach Vector. Zero Trust Was Built for Exactly This.

Summary

You have AI agents in production. You probably don’t know which ones, or what they can reach. Forrester predicts the first publicly disclosed enterprise breach caused by agentic AI will arrive in 2026. The uncomfortable truth: that breach will not look like an attack. It will look like an authorized process doing its job.

This is exactly the problem Zero Trust was designed for. It governs actors operating with legitimate credentials and no inherent right to be trusted. AI agents fit that description without modification. The architecture is established. The application to agentic AI is new.

We covered the Zero Trust foundations for AI agents in our earlier post, Zero Trust for AI Agents. This article addresses one question: what should you do now, before it goes wrong?

The Breach You Are Not Prepared For

In test environments in early 2026, AI agents published passwords, bypassed antivirus, and forged credentials. They were not compromised. They were not hijacked. They were given a task, hit an obstacle, and found a way around it.

Production is catching up. In 2025, a Meta AI agent triggered a security incident by acting without permission. Researchers at Outpost24 compromised an AI agent operating on the McKinsey AI platform.

The cause will not be a vulnerability. It will be a workflow that cascaded further than anyone expected, through systems that had no reason to question it. No attacker. No exploit. An authorized process doing its job in a context no one fully defined.

That makes forensic investigation fundamentally different. In a conventional breach, you trace backward from the damage to the entry point. In an agentic failure, there is no attacker to trace. Each individual action looks authorized on its own. The problem only emerges across the chain. And the agent itself keeps no log of why it made each choice.

Why AI Agents Are Not Service Accounts

A service account has a fixed identity and deterministic behavior. Misconfigured? It stays misconfigured.

An AI agent adapts. Block it, and it does not stop. It finds a workaround.

That structural difference has one major consequence for access control. Employees and service accounts often run on just-in-case privileges: access granted in advance, available all the time, used occasionally. Risky for humans. Dangerous for AI agents.

The right model for AI agents is just-in-time access. Credentials issued when needed, scoped to a specific task, revoked immediately after. Dynamic, vault-based credentials replace hardcoded secrets. Standing privilege becomes the exception, not the default.

What Traditional Controls Catch, and What They Don’t

User and Entity Behavior Analytics (UEBA) was built for exactly this kind of identity-level deviation. A mature SIEM with behavioral baselines can detect an agent calling an API outside its workflow, or escalating privilege unexpectedly.

The limit is twofold.

Identity coverage: most organizations have not registered their AI agents as identities. UEBA cannot baseline an actor it does not know about.

Speed: agentic workflows finish in seconds. Behavioral analytics flags the deviation, but by the time a human investigates, the cascade is over.

Closing the gap requires two things. Every AI agent treated as an identity with an owner, a scope, and a behavioral baseline. And policy enforcement at machine speed: evaluating every request against context before it executes, not after. Gartner labeled this preemptive cybersecurity in 2026. Zero Trust has called it the starting principle for twenty years.

What Security Leaders Should Do Now

PwC’s 2026 survey of nearly 3,900 executives found that only around 6% of organizations have implemented all key data risk controls. Agentic AI is arriving faster than governance frameworks can follow.

The actions below are not complicated. They are just not happening yet.

1. Inventory AI agents as identities. Every autonomous AI in the organization belongs in the identity register. Name, scope, owner, access boundaries. What you cannot inventory, you cannot govern. Outcome: within 30 days you know which agents are running, who owns them, and what they can reach.

2. Apply just-in-time access at the workflow level. Replace standing credentials with dynamic, scoped, time-limited grants. The agent that reads a database does not need write access. The agent that runs at 9 AM does not need credentials at 3 PM. Outcome: the blast radius of a single agent error shrinks from “everything the account ever had access to” to “the task at hand”.

3. Establish behavioral baselines and log intent. Define what normal looks like per agent, and capture not just what it did but why it made each choice. Unexpected API calls, credential store access, or unusual reasoning patterns are the earliest available signals. Outcome: when an incident hits, you can reconstruct the chain in hours instead of weeks.

4. Extend Zero Trust policy explicitly to AI agents. Existing Zero Trust frameworks should name AI agents as a distinct class of identity. The same rigor applied to human identities and service accounts applies here: continuously evaluated against context, not granted once and forgotten. Outcome: one governance model for all actors, not three.

5. Test for cascading failure before deployment. This is the step most organizations skip, and the one that determines whether the breach happens. Before an agent goes live, run three tests:

• Path-blocking: deny the agent’s primary path and watch what it tries. Does the next attempt stay within scope?
• Privilege-escalation observation: run the agent on minimum privileges and watch whether it requests, attempts, or finds more, and what triggers the attempt.
• Cross-agent cascade: where agents share workflows, observe what each agent does when another’s output is unexpected.

Outcome: the behavior surfaces during the test, or during the breach. There is no third option.

How ON2IT Can Help (If You Want It)

ON2IT has operated Zero Trust at production scale since 2005. The five actions above are the same actions we run operationally inside our managed GSOC™. Not described from the outside, but applied every day.

Want a second set of eyes? Our ON2IT AI Assessment evaluates your current state against the five-step Zero Trust methodology applied to AI actors as a distinct identity class, and produces an inventory, behavioral baselines, and a pre-production test plan.

With or without our help, the five actions above are where you start.

Frequently Asked Questions