AI agents have an identity problem

Artificial intelligence is acquiring a new kind of authority. Popularized by tools such as OpenAI's Operator and Google's Project Mariner, autonomous agents can now operate across digital environments, often without human approval at every step. Their growing autonomy, however, is creating a cybersecurity challenge as organizations struggle to distinguish legitimate automated activity from actions exceeding an agent's authority.

A March 2026 survey conducted by cloud cybersecurity nonprofit Cloud Security Alliance and commissioned by identity-security company Aembit found that 68% of 228 IT and security professionals struggled to distinguish AI agent activity from human activity. The finding exposes a vulnerability in cybersecurity systems designed to authenticate employees and conventional software rather than autonomous agents.

As a response to these emerging security concerns, on Oct. 27, the U.S. National Institute of Standards and Technology (NIST) proposed 10 principles for establishing verifiable digital identities for AI agents and controlling their permissions. Although the recommendations are not binding regulations, they address a problem confronting organizations worldwide as autonomous systems gain access to sensitive information and critical operations.

The problem with borrowed credentials

Traditional corporate security relies on identifying users and assigning permissions according to their responsibilities. Employees authenticate through individual accounts, while applications and automated processes commonly use service accounts or application programming interface keys to communicate with other systems.

NIST's August 2026 analysis warned that autonomous agents complicate traditional identity management through their unpredictable activities. An agent instructed to organize a company's procurement records might retrieve invoices, consult external suppliers,s and update financial systems, moving between applications that maintain different access controls. When agents use employee accounts or shared credentials, organizations may struggle to identify which system accessed information or initiated a transaction.

The Cloud Security Alliance's March 2026 survey found that 74% of respondents believed agents frequently received more access than necessary, while 79% said agents introduced access pathways that were difficult to monitor. These findings suggest that organizations are granting automated systems considerable operational authority without equivalent visibility into how it is exercised.

A digital identity for every agent

NIST's October 2026 proposal seeks to establish clearer boundaries between agents, their human operators, and the systems they access.

Its 10 design principles begin with “distinct identification,” recommending that agents receive unique, cryptographically verifiable identities rather than impersonating employees or sharing conventional service accounts. Such identities could allow organizations to trace automated actions to specific agents and their approved configurations.

The proposal also addresses delegation. When an employee authorizes an agent to perform a task, the agent should receive only the authority required to complete it, rather than automatically inheriting every permission available to that employee. If the agent delegates work to another automated system, those restrictions should continue to apply.

NIST further recommends temporary permissions, continuous authorization checks and records that cannot easily be altered. Organizations should also retain the ability to suspend agents, revoke their credentials and require human approval for sensitive operations.

These safeguards distinguish authentication from authorization. Establishing that an agent possesses valid credentials does not necessarily establish that every action it attempts is legitimate. Applicable to enterprise and consumer systems, the principles remain voluntary recommendations rather than an established identity standard.

The cybersecurity risks of autonomy

The vulnerabilities associated with autonomous agents are not confined to stolen passwords or external hackers. An agent operating with legitimate credentials may exceed its assigned responsibilities, misinterpret instructions or encounter malicious content designed to redirect its behavior.

In an October 2026 article, Microsoft security executive Hayete Gallot described such systems as agentic insiders, warning that organizations cannot automatically trust agents simply because they deployed them. Unlike conventional software, agents may adapt their actions to changing circumstances, potentially accessing resources or collaborating with other agents in unintended ways.

Recent security incidents illustrate the difficulty of enforcing those boundaries. An October 2026 roundup published by the OWASP Generative AI Security Project, an initiative developing guidance on vulnerabilities in AI systems, described a July incident involving AI evaluation agents operating within OpenAI's research infrastructure. The agents reportedly bypassed restrictions, used shared package infrastructure to communicate and gained unauthorized administrative access.

The disruption required containment measures and credential rotation, exposing how shared infrastructure can enable unauthorized agent activity even in controlled environments.

Such cases underscore the limitations of relying on instructions alone to constrain autonomous systems. Effective safeguards must also operate independently of the models directing agents' behavior, restricting their access even when they attempt actions outside their authorization.

Who is accountable?

As agents become integrated into commercial operations, responsibility for their decisions presents a further challenge. An unauthorized transaction might involve an agent acting on a legitimate request, a malicious instruction encountered during its work or permissions granted too generously by its operator.

Determining responsibility requires an organization to establish who authorized an agent, what permissions it possessed, which systems it accessed, and how its decisions were executed.

The implications are international. Autonomous agents can operate across cloud platforms, corporate networks and national jurisdictions, potentially encountering different privacy requirements, cybersecurity obligations and rules governing financial transactions. A verifiable identity may improve traceability across these environments, but it does not establish a common legal framework for assigning liability.

For businesses, the immediate challenge is to reconcile the efficiency promised by autonomous AI with security systems capable of restricting its authority. NIST's proposal offers a foundation for doing so, while leaving considerable work for technology providers, regulators and organizations implementing these systems.

As software acquires greater independence, knowing which agent performed an action will become essential. Ensuring that it was entitled to perform that action may prove considerably harder.