AI agents are rapidly becoming something cybersecurity teams have never really had to manage before: identities that can reason, act, communicate with systems and make decisions — without necessarily behaving the same way twice.
That makes them fundamentally different from the users, applications and machines around which most identity and access controls were designed.
For Roman Arutyunov, co-founder and chief product officer at Xage Security, that distinction makes the arrival of agentic AI more than another emerging technology problem. It creates a new urgency around something security teams have been trying — often unsuccessfully — to implement for years: Zero Trust.
“There’s never been a time that’s more important for Zero Trust than now,” Arutyunov said during the latest episode of CYBR.SEC.CAST.
Full episode and related article:
, and CYBR.SEC.Media
Bill Brenner
The reason is straightforward. AI agents are gaining access to increasingly sensitive enterprise resources while remaining inherently unpredictable.
“The agents themselves are non-deterministic,” he said. “It’s a different type of an identity. It’s not quite a user. It’s not quite a machine.”
And unlike conventional software, an agent doesn't simply execute a predetermined sequence of instructions. It can interpret information, choose actions and interact with other systems based on what it encounters.
That creates an uncomfortable security question: What happens when an identity with legitimate access stops behaving the way you expected it to?
The attacker may not need to install malware
That question becomes particularly important as researchers demonstrate attacks that manipulate AI agents through malicious instructions embedded in the information those agents consume.
An agent might encounter an embedded prompt inside a file, script or other resource and process those instructions as part of its normal operation. If that agent already possesses sufficient privileges, the attacker may not need to compromise the underlying system in the traditional sense.
The attacker can try to manipulate the agent instead.
Arutyunov put the problem more starkly: attackers may no longer have to go through the trouble of writing a Trojan and deploying it.
The agent is already there.
“They just have to feed remotely instructions to it,” he said.
That's an important inversion of the traditional endpoint security model.
Historically, defenders worried about malicious code obtaining access to legitimate resources. With agentic AI, security teams increasingly have to consider the possibility that legitimate code with legitimate access can be manipulated into taking malicious actions.
That makes the privileges assigned to the agent — and the controls surrounding every interaction it makes — enormously important.
Related:
Bill Brenner
Bill Brenner
Don't give AI agents the keys
Arutyunov's answer is to treat the agent as an untrusted identity regardless of where it came from or what it is supposed to be doing.
That means establishing an identity for the agent, determining exactly what it is authorized to access and continuously validating its interactions.
It also means something even more fundamental:
Don't hand the agent the real credentials to critical systems.
Instead, Arutyunov argues that organizations should broker access between agents and the resources they need. Network paths should exist only after an agent has been authenticated and authorized, and only to the resources the agent is permitted to reach.
“Don't ever give credentials to the agents, the real credentials to your assets,” he said. “Broker every access, no direct interaction.”
The goal is to create enforcement points where security teams can authenticate, authorize, monitor and, when necessary, terminate an agent's interaction with another resource.
In other words, an AI agent shouldn't receive permanent access simply because somebody decided six months earlier that it needed access to perform its job.
Every interaction becomes conditional.
AI is also attacking the patching window
Agentic AI creates another problem for traditional security models: speed.
Vulnerability management has always been a race between vulnerability discovery, exploit development and remediation. AI threatens to compress that timeline dramatically.
Arutyunov pointed to research showing vulnerabilities being identified more quickly and exploits potentially being generated in seconds.
Meanwhile, agents provide infrastructure capable of acting on those discoveries.
That makes the idea of simply patching faster increasingly unrealistic.
“You can never keep up with being able to patch vulnerabilities at that type of a scale,” Arutyunov said.
That doesn't mean organizations should stop patching.
It means patching cannot be the only thing standing between a vulnerability and an attacker.
Michael Farnum, co-host of CYBR.SEC.CAST, pointed to the distinction during the conversation: organizations still need to patch, but they can prioritize vulnerabilities that are actually reachable.
If Zero Trust controls prevent arbitrary connections to a vulnerable asset, the vulnerability remains important — but exploiting it becomes considerably more difficult.
The security question therefore shifts from simply “Is this system vulnerable?” to “Can anything actually reach it, and under what conditions?”
Zero Trust isn't finished — and AI isn't waiting
There is an obvious problem with all of this.
Many organizations haven't finished implementing the first generation of Zero Trust.
Farnum noted that throughout his consulting work he has seen organizations begin Zero Trust programs only to get a quarter of the way through, concentrate controls in one portion of the infrastructure or struggle to extend them across the enterprise.
Now AI agents are arriving across endpoints, cloud environments, data centers and operational environments.
Arutyunov doesn't believe organizations need to secure everything simultaneously. They can start with critical environments and expand.
But he warned against solving the problem by assembling a patchwork of firewalls, segmentation technologies, privileged access management products, API gateways and other controls that ultimately become another complex security architecture teams have to maintain.
That complexity, he argued, creates gaps and fatigue — precisely what organizations don't need as autonomous systems spread across their infrastructure.
Agentic AI therefore may be forcing organizations to confront a security project many never finished.
Zero Trust was originally built around a simple assumption: don't automatically trust an identity just because it happens to be inside the network.
AI agents take that principle one step further.
Now organizations can't necessarily trust an identity simply because they created it, authorized it and told it what to do.
