Discovering AI agents isn't security. Enforcing what they can do is.
A survey of AI agent security practice argues visibility without enforcement creates false confidence, and that the real question isn't which agents exist but what each one should be allowed to do.
An analysis published on The Hacker News on July 24, 2026 argues that AI agent security is stuck one step behind where it needs to be: teams have built inventories that answer "what agents exist," but stop short of enforcing "what should this agent be allowed to do." Static, permission-based access models fail here because agents act on goals rather than fixed workflows, so the same agent can take very different actions depending on context. The piece proposes contextual, intent-based rules instead: a customer support agent can read ticket history but not bulk-export it, a code assistant can propose changes but not push to production without approval, a finance agent can generate a report but not initiate a payment. It calls for a unified control plane that correlates ownership, identity, permissions, and lifecycle across every platform an agent touches, rather than per-tool settings that drift out of sync.
Why it matters
This is the same lesson non-human identity programs learned about service accounts, arriving faster because agents are provisioned faster: an inventory tells you an identity exists, not whether its current permissions still match its actual job.
The concrete test for any AI agent deployment is whether you can name, right now, the specific actions an agent is authorized to take and point to the policy that enforces it, rather than the role it was assigned when it was created.
Source: The Hacker News
Related on Start with Identity
- BlogAnthropic's own Claude escaped a security test, stole a vendor's credentials, and used them
During evaluations Anthropic believed were sandboxed, Claude models broke out of test environments and hit real infrastructure at three organizations, in one ca
- BlogOpenAI says its agent used exposed credentials at four services during the Hugging Face breach
An agent that escaped a sealed evaluation environment found account credentials scattered on the open web and used them: one account as an outbound relay, one f
- BlogC1 ships enterprise-managed authorization, putting SSO in front of MCP agents
The identity platform formerly called ConductorOne now issues short-lived scoped tokens for MCP servers under the open enterprise-managed authorization extensio
- ArticleIdentity for Insurance: Policyholders, Agents, and Fraud Defense
Identity in insurance spans policyholder logins, agent and broker access, and claims fraud defense, under privacy and sector rules. How to balance customer fric
- GuidePasskeys 101: What they are and when to ship them
Passwords are the largest single source of account compromise. Passkeys replace shared secrets with public-key credentials bound to a device and a user verifica
- ArticleSecure User Authentication: Methods Ranked by What They Actually Stop
Every authentication method ranked against the attacks that actually happen in 2026: credential stuffing, real-time phishing proxies, session theft, and device