Zero trust meets its agentic AI reckoning

For years, security leaders have championed zero trust as the definitive answer to modern network threats. But the rise of agentic AI — autonomous software that can chain actions and make decisions — is exposing cracks in that framework that may prove fatal. Experts say the core principles of zero trust, designed for discrete requests from known users, are fundamentally at odds with the dynamic, multi-step nature of AI agents.

Two different balance sheets

Part of the problem is a mismatch in how security teams and business leaders evaluate AI agents. "The business gets measured on what the agent saved or produced. Security gets measured on everything that happens when it goes wrong," points out Nik Kale, a member of the Coalition for Secure AI (CoSAI) and ACM's AI Security (AISec) program committee. "They're looking at the same agent through two completely different balance sheets."

This disconnect creates a fundamental tension. While CISOs are tasked with minimizing risk, CEOs and boards are pushing for rapid deployment of agentic AI to deliver ROI. The pressure to accelerate can lead to shortcuts in security protocols, including skipping proper onboarding or ignoring potential vulnerabilities.

Five legal doors, one exfiltration

Kale argues that the very nature of agentic AI is the polar opposite of zero trust. "Zero trust was designed to evaluate requests one at a time, which is fine when the thing making the requests isn't strategically assembling them into something bigger. Agents change that. An agent can be allowed to read a document, allowed to query another data source, allowed to summarize what it found, allowed to write it to a file, allowed to send an external email, and every one of those decisions is correct on its own. Put them in that order and you just authorized an exfiltration path," Kale notes.

This combinatorial risk is difficult for traditional security systems to detect because each individual action appears benign. "An agent can walk through five perfectly legal doors and end up somewhere the business never authorized," he adds. "In finance, you can have 10 transactions that each sit under the escalation threshold and a total nobody would have signed off on."

"You have to know what that identity has become, what authority it's carrying, what sequence it's putting together, and whether the next system agrees the authority is valid. Otherwise, we took an allowlist, gave it better marketing, and called it zero trust."

— Nik Kale, member of the Coalition for Secure AI (CoSAI) and ACM's AI Security (AISec) program committee

Identity crisis for agents

Zero trust relies on strong identity verification for every user and device. But with AI agents, the question of identity becomes murky. "Whether the thing using that identity today is still the thing you approved" is the harder question, according to Kale. "Update the model, add a tool behind the same interface, let the memory fill up with context nobody reviewed, give it a delegate, and none of that touches the identity," he explains. "The list still says approved. You can have a materially different machine on Friday wearing the badge than what you approved on Monday."

This lack of contextual knowledge is critical. An agent's behavior can evolve as it learns and interacts, making it difficult to trust that an approved identity still represents the same risk profile. The static nature of identity checks fails to account for the dynamic nature of AI agents.

Subagents and secrecy

Agentic AI introduces additional complexities that exacerbate the zero trust challenge. Authorized agents can spawn subagents that inherit all the originator's privileges but without a recognized identity. This creates a loophole where unauthorized actions can be taken under the guise of a trusted agent. Furthermore, agents can communicate with other agents, potentially passing malicious instructions. Despite this security hole being widely known for at least a year, no vendor has delivered a mechanism to pierce that agent-to-agent secrecy. At best, systems might detect that a communication has happened, but not what was said.

This lack of visibility into agent-to-agent communication is a significant blind spot. Attackers could exploit this by embedding malicious instructions in images or audio/video files, which are often not scrutinized by security tools.

Shadow IT of agents

The typical recommended control for agent activity is to require agents to be onboarded by IT or security teams, issuing each agent an identity that can be tracked. However, the reality is far different. The overwhelming majority of agents in enterprise environments are not registered, whether because they were dispatched by workers who didn't bother with the paperwork (shadow IT) or due to credentialed third parties launching agents in your environment without asking for permission. And that's not even considering that, like any identity, attackers — especially state actors — can hijack them. As one expert put it, IT is left like a security guard protecting a restricted area with only a list of approved license plates, not knowing who is actually driving any of the agents.

"Your governance model is often aimed at the incorrect layer. Some 80% of your agents are not on your list. That's not a control. It's an inventory of the compliant minority," says Krti Tallam, senior member of technical staff for security engineering at Kamiwaza.ai. "This inventory model has never survived real contact within any enterprise. We have to stop pretending that we control the environment. [Agentic] didn't kill zero trust. It killed a convenient lie, a comfortable lie."

Sophisticated attacks ahead

Tallam is skeptical that CISOs will ever gain full visibility into agent-to-agent messages, but she expects attackers to become more sophisticated. Hijacked agents already limit the number of agents they contact and contaminate with malicious instructions to avoid suspiciously high numbers. The tactic is to let the original hijacked agent get caught and shut down, with the real passed-along attack happening days later when the infected agents carry out their poisoned instructions.

The traditional defense is to monitor the behavior of all agents so that infected agents will also be shut down as soon as they engage in malicious behavior. However, Tallam expects hijacked agents to begin learning what their victim agents are supposed to be doing and what they are allowed to do, possibly by simply asking the agents for that information. "The trick is to split the attack instructions among many agents in such a way that none of them meaningfully deviate from their legitimate instructions," she says.

Delegation lessons from GPG

Mike Wilkes, enterprise CISO at Aikido Security, suggests CISOs take a lesson from GPG/OpenPGP, where a user "retains a strongly protected primary identity and delegates limited, short-lived signing subkeys or cryptographically signed credentials to an agent, with still narrower delegated credentials for subagents."

That would give agents a mix of "rate limits, transaction boundaries, spend and data budgets, sandboxing, approval gates for high-consequence actions, and immutable activity trails," Wilkes says. "Most importantly, autonomous systems need quick and confident undo buttons. Type 2 decisions, where the consequences are reversible, are much safer to delegate than Type 1 decisions such as deleting production data, changing IAM policy, transferring funds, or making irreversible infrastructure changes."

Implementing such granular control over agent actions could help maintain security without sacrificing the benefits of automation. Yet practical examples remain rare.

Woefully underprepared

Brian Vecci, field CTO at Varonis, argues that the agent situation is worse than most believe. Enterprise CISOs "are woefully underprepared for NHI with their non-deterministic actions. You need to assume that identity is a woefully inadequate level of control," Vecci says.

Gathering as much information as possible about agent activity is a fine goal, but the accuracy and feasibility of collecting such telemetry is difficult. Vecci notes that many enterprise agent telemetry efforts are like "trying to find a needle in a haystack by throwing more hay on it."

Why it matters

The tension between zero trust and agentic AI is not just a technical headache; it's a governance and risk-management challenge that could define the next era of enterprise security. As CEOs push to deploy agents for competitive advantage, security teams are left trying to retrofit a model built for a less dynamic world. The failure to reconcile these two could lead to catastrophic business losses that the board will ultimately be held accountable for. The disconnect—where business sees only the upside and security sees only the downside—needs urgent resolution before the inevitable high-profile incident forces it onto every agenda.