What’s It About?
The use of autonomous AI agents in enterprise environments carries significant security risks, experts warn. The problem lies in the structure of existing access permissions: while human employees actually use only a small fraction of their access rights, AI agents could theoretically access all available permissions. This creates dangerous vulnerabilities, comparable to fragile layers of snow that can trigger avalanches.
Background & Context
A joint study by security companies Oso and Cyera analyzed the access structures of 2.4 million employees and 3.6 billion permissions. The results are alarming: on average, employees actively use only four percent of their assigned access rights. For particularly sensitive data, the actual usage rate is even significantly lower – even though the authority to delete or modify critical information formally exists.
The central problem arises when AI agents are equipped with the permissions of human users. Unlike humans, who use their access rights selectively and contextually, autonomous systems could potentially access all available permissions. According to CyberArk, there are already around 80 machine identities per human identity in enterprises today, many of them with privileged access rights and inadequate security controls.
Security experts are therefore calling for fundamentally new authorization concepts for AI agents. One promising approach is so-called Golden Paths: autonomous systems are given dedicated identities with the minimum necessary permissions. By default, AI agents should only receive read access, while design and execution rights must be strictly separated. This strategy aims to minimize the potential damage from misuse or malfunction.
What Does This Mean?
- Companies urgently need to overhaul their permission structures before deploying AI agents at scale
- The existing practice of granting employees broad access rights that they barely use becomes a critical security risk in the age of autonomous systems
- New authorization models with minimal default permissions and strict separation of duties are essential for AI agents
- The rapidly growing number of machine identities requires specialized security concepts that go beyond classic identity management approaches
- Organizations should implement Golden Path strategies to give AI agents controlled and traceable access paths
Sources
Eine Agentic-AI-Lawinenwarnung (Computerwoche)
Agentic AI in the Wild: Real-World Use Cases You Should Know
Agentic Security: Accountability and Human Oversight
Agentic AI Security Strategy Gaps
This article was created with AI and is based on the sources listed as well as the language model’s training data.
Further Reading: Paperclip: When AI Agents Get an Org Chart