AI Agent Security Needs More Than Least Privilege

AI agent security is creating a familiar problem for IT teams. Enterprises are giving autonomous agents access to applications, infrastructure, and sensitive data, sometimes with the same excessive privileges organizations have spent decades trying to eliminate from human accounts.

The difference is speed. An overprivileged human identity presents a security risk and an overprivileged AI agent can potentially act across an environment at machine speed.

“These are identities, these are entities,” said Heath Mullins, Chief Evangelist at ExtraHop and a former Forrester analyst. “They should be assigned appropriate permissions to accomplish the task at hand. And that task should not be overly broad.”

But least privilege only answers one part of the AI security problem. Organizations also need to know whether agents behave as expected after they receive access.

AI agent security starts with least privilege

The principle of least privilege isn’t new. Organizations have spent years trying to stop administrators, applications, and service accounts from receiving unnecessary permissions.

Mullins argues that enterprises should apply the same thinking to AI agents.

Some organizations, he said, are giving agents broad administrative permissions to find vulnerabilities, recommend remediation, and identify systems requiring patches. That sounds attractive because an agent can automate work across an enterprise.

But it can also create an autonomous administrator.

“Don’t let it go carte blanche,” Mullins said. “This is your task and that’s it.”

Microsoft Copilot, Gemini, Claude, and other AI systems need access to information to provide useful results. Organizations therefore need controls defining what an agent can access and what actions it can perform.

AI makes excessive permissions more dangerous

AI doesn’t necessarily reinvent the basic stages of a cyberattack. Attackers still need an entry point and may escalate privileges, establish command and control, and move laterally.

What changes is the speed.

“The attack cycle hasn’t really changed that much,” Mullins said. “The execution speed is what has changed.”

An AI-driven attack can potentially discover vulnerabilities, escalate privileges, and move through the network faster than a human attacker.

“We’re not talking weeks, days, even hours anymore. We’re talking minutes, and a human simply cannot keep up with that anymore,” Mullins said.

That makes excessive permissions particularly dangerous. But restricting permissions isn’t enough, because authorization tells security teams what an identity is permitted to do rather than whether its behavior is normal.

Permissions don’t tell you what an AI agent actually does

An AI agent might have legitimate credentials and authorization to access several enterprise systems. Individually, its actions may not trigger an obvious security alert.

That creates a second requirement: observing what the agent actually does.

This is where Mullins argues that network visibility becomes important.

ExtraHop combines network detection and response (NDR) with network performance monitoring (NPM). Its approach examines both security activity and operational behavior on the network.

“You cannot hide from the network,” Mullins said.

Mullins gave the example of a VMware instance suddenly consuming increasing amounts of memory, CPU, storage, or other resources. That activity might be harmless and might not correspond to a known indicator of compromise (IOC) or Common Vulnerabilities and Exposures (CVE) entry.

Combined with other network behavior, however, it could indicate that something has established itself and is preparing to attack other systems.

For AI agents, that distinction becomes increasingly important.

Identity controls establish what an agent should be able to do. Behavioral visibility can help establish what it is actually doing.

Shadow AI makes visibility even more important

Organizations must first know which systems and agents exist before they can monitor their behavior.

Mullins compares this emerging challenge to shadow IT. Employees can now use AI on smartphones, local systems, cloud services, and enterprise platforms, potentially outside approved processes.

“If you don’t know what’s on your network, how can you possibly know what’s happening on your network?” Mullins said.

His recommendation is to treat a new AI agent like completely unvetted software.

Organizations should evaluate the provider, establish strict permissions, test the agent in an isolated environment, and observe whether its behavior matches expectations before production deployment.

That validation shouldn’t end when the agent enters production. Mullins recommends regularly checking AI systems for behavioral drift, hallucinations, and unexpected output.

AI agents may be a new kind of enterprise identity, but the underlying security lesson is familiar. Least privilege still matters.

The difference is that with autonomous agents operating at machine speed, organizations also need enough behavioral visibility to know when an identity stops doing what they expected it to do.