AI Agents Are Expanding the Attack Surface. Here's How to Respond.
Key Highlights
- AI agents are expanding enterprise attack surfaces by introducing new access paths, identities and permissions that traditional perimeter security was not designed to protect.
- Zero Trust principles can help secure AI environments by treating AI agents like privileged users with least-privilege access, continuous authentication and network segmentation.
- Organizations can strengthen AI security without slowing innovation by inventorying AI systems, protecting credentials, defining access controls and continuously monitoring agent behavior.
It’s hard to ignore the business impact of artificial intelligence (AI). From generative AI tools that handle customer service interactions to internal AI pilots aimed at connecting business platforms, companies are racing to unlock AI’s competitive advantages.
However, AI is being implemented faster than security teams can adapt their controls. In some cases, organizations are prioritizing functionality over governance or allowing “shadow AI,” all in an effort to avoid slowing innovation.
The result is a growing security gap, where AI systems are being rapidly integrated into sensitive workflows without the protections needed to prevent misuse, data leaks, and cyberattacks.
To close this gap without stifling innovation, organizations must move beyond traditional security practices and adopt Zero Trust principles. Once in place, Zero Trust tools can govern AI systems with the same rigor that security teams apply to their users and critical business assets.
How organizations are using AI
Most AI adoption is driven by business needs rather than a centralized technology strategy. Teams are using AI to increase efficiency, automate processes, and derive insights. Although these use cases have delivered tangible value, they have also introduced new access paths into enterprise systems.
The rise of ai-driven SaaS tools — For many organizations, AI adoption begins with cloud-based tools embedded in productivity platforms or offered as standalone services. These systems are commonly connected to corporate databases, CRM platforms, and knowledge repositories to generate insights and automate processes.
Because these integrations are often implemented quickly, security teams are excluded from early planning, leaving AI tools with broad permissions and limited oversight.
Enterprise AI pilots and internal integrations — Additionally, many organizations are launching internal AI initiatives tied directly to core business platforms. These projects help accelerate research, introduce automation, and improve decision-making, but governance policies are often an afterthought. As a result, identity controls, system segmentation, and data monitoring are ineffective.
The emergence of AI agents — Organizations are also deploying AI agents: autonomous software that can reason, take actions, and invoke tools. Unlike traditional automation, these agents inherit the access and permissions of the user or service that launched them. When an engineer’s AI coding assistant can reach everything they can, the blast radius of a single compromised agent mirrors that of a compromised user, but at machine speed.
High business value, but growing exposure — As AI systems become embedded in sensitive workflows, data access expands rapidly and integrations multiply. Unfortunately, visibility into how these automated agents interact with enterprise systems frequently lags behind adoption. What begins as experimentation quickly becomes core infrastructure, significantly expanding the organization’s attack surface.
How threat actors are exploiting AI-based systems
As organizations integrate AI into their core business processes, threat actors are exploiting new ways systems are connected. This reality introduces new attack vectors:
- Prompt injection: Attackers craft inputs that get AI systems to bypass security safeguards and reveal sensitive information or perform unauthorized actions.
- Digital assets breaches: If an attacker discovers a vulnerability in an AI integration that lacks necessary segmentation or access controls, it can expose multiple datasets or systems at once.
- AI-powered cybercrime: Cybercriminals can use AI to automate enumeration, create attack campaigns, and modify existing exploits to move and adapt faster than traditional security tools.
- Uncontrolled connectivity: If an agent can reach the intranet, cloud APIs, databases, and third-party services, each connection becomes an ungoverned access path. Attackers who compromise a single agent can exploit this reach to move across systems far faster than traditional malware.
- Shadow agent proliferation: As employees adopt AI assistants through browser extensions, IDE plugins, and personal accounts, organizations face a form of shadow IT that can access enterprise data and take actions without visibility or approval.
Applying Zero Trust principles to AI environments
These new attack vectors are particularly dangerous because traditional security models are limited. AI platforms leverage cloud connectivity, API-driven workflows, and continuous data exchanges to dissolve the perimeter and connect the dots across internal and external resources.
This means that once an attacker compromises a single AI integration point, legacy architecture enables lateral movement while implicit trust within systems allows unmonitored access to other assets and processes.
Properly securing AI environments requires a shift to Zero Trust models that assume no system or user is inherently trusted.
Under this model, AI agents should be governed like human users, with assigned identities, defined roles, and least-privilege permissions that restrict their access. Similarly, enterprise AI platforms must be treated as critical assets — isolated, controlled and requiring continuous authentication.
This shift to Zero Trust requires moving away from input filtering and reactive safeguards toward a model with structural access controls. By embedding identity-based verification and segmentation into AI environments, organizations can limit the impact of a breach while scaling innovation.
This means that AI agents need more than application-level permissions. They require infrastructure-layer identity, where each agent is identified, its network connections are governed, and its access to models, tools, and data sources is controlled independently of the user who deployed it.
Critically, the tokens and credentials agents use to authenticate must be managed centrally, never exposed to developers or embedded in code, and revocable instantly through a single control point.
Zero Trust without slowing AI
Implementing Zero Trust doesn’t mean an organization has to slow or reverse the AI work that’s already underway. Instead, it starts with establishing visibility over AI use, enforcing clear access boundaries, and providing continuous oversight to ensure security controls match how AI systems function.
1. Inventory all AI usage
Start by capturing where AI is in use, including SaaS-based AI tools implemented at the enterprise- or team-level, embedded AI features within business platforms, and API connections linking AI systems to internal data sources.
2. Centralize and protect AI credentials
API keys, tokens, and credentials are the new crown jewels. Organizations should eliminate developer access to these secrets, centralize them through a proxy or gateway architecture, and implement controls that can revoke all agent access instantly. This single step addresses the common and dangerous pattern of API keys hard-coded in scripts, shared across teams, and impossible to rotate without breaking workflows.
3. Define roles and permissions
Each AI system should have specific access rights that match its business purpose. Document these access rights, including what data the AI can retrieve, what it’s allowed to do with that data, and what systems it can connect to. Highlight the lowest privilege the AI system needs to perform these functions.
4. Apply Zero Trust segmentation
Zero Trust segmentation principles should be applied to the AI system and the assets it can interact with across the broader network. Zero Trust tools will then continuously authenticate the traffic at the packet level, securing connections between systems.
5. Monitor AI behavior continuously
AI systems should have their security profiles monitored, just like any other privileged users, helping security teams identify anomalous access patterns, unexpected data requests, and other signs of abuse.
6. Establish incident response controls
Organizations need the ability to disable individual agents or classes of agents across all endpoints. They also need the ability to revoke agent sessions, connector permissions, and tool access in seconds. Without these controls, a compromised agent can cause damage at machine speed.
AI systems should also generate an audit trail of all interactions, including what data was accessed, what tools were invoked, and what actions were taken. Without this trail, organizations cannot investigate breaches involving AI agents, satisfy regulatory inquiries, or demonstrate due diligence to auditors.
Secure your innovation without slowing it
AI integration is only going to accelerate, and so are the threats to the systems and data that organizations fail to protect.
However, a security team’s goal should not be to block AI adoption, but to enable teams to use it securely. Zero Trust principles and the platforms used to implement them are powerful enough to allow organizations to build scalable security controls for AI systems.
Ultimately, AI’s power to transform productivity is only beginning to be realized. The organizations that will lead are those that implement security controls that work across every AI platform, model provider, and agent framework.
By treating AI agents as first-class identities and applying Zero Trust principles to their connectivity, credentials, and access, organizations can realize AI’s benefits without turning these new tools into their biggest vulnerability.
About the Author
Jaushin Lee
Dr. Jaushin Lee is the founder and CEO of Zentera Systems. He is a serial entrepreneur with many patents. He is also the visionary architect behind the CoIP Platform, Zentera's award-winning Zero Trust security overlay. Jaushin has more than 20 years of management and executive experience in networking and computer engineering through his experience with Cisco Systems, SGI, and Imera Systems.