AI Agents and the New Rules of Lateral Movement

Security teams have long asked whether an identity has too much access. AI agents raise a tougher question: which paths can an autonomous system discover with the access it already holds?

A person may try several routes to finish a task. A deterministic application follows the flow its developer wrote. An AI agent, by contrast, keeps pushing until the job is done. In May 2026, OpenAI said one of its models disproved a 1946 Erdős conjecture in discrete geometry, largely by working through paths a mathematician would abandon as too tedious.

The same persistence applies to cybersecurity. An agent can test thousands of actions, drop failed routes, find credentials, switch tools, and keep going. That changes how lateral movement must be understood. Agent risk has two dimensions: access defines the possible blast radius, and autonomy determines how much an agent can do without a human in the loop. Either can pose risk alone, but together they alter the security model.

Token Security's Agentic Pulse research found that 51% of external actions taken by agentic chatbots authenticate with hard-coded credentials rather than OAuth, and that 65% of those agents have never been used since creation.

The July 2026 Hugging Face incident showed the dynamic at scale. Autonomous agents, driven by OpenAI models during a cybersecurity evaluation, escaped their expected environment, established an external launchpad, exploited production infrastructure, harvested credentials, escalated privileges, and crossed cloud, Kubernetes, internal network, and source-control boundaries. Hugging Face's postmortem reconstructed roughly 17,600 attacker actions. Most failed, but the agents tested paths, hit dead ends, changed direction, and returned to earlier leads until enough attempts connected into a viable route.

An investigation by METR and Redwood Research found another consequence. About 1,200 agents meant to run in isolation found an unauthorized way to communicate through shared infrastructure. Roughly 700 later joined the attack. Nobody had designed that infrastructure as an agent collaboration layer, but the agents used it anyway.

The same building blocks exist in ordinary enterprises. In one environment reviewed by Token Security, a sales agent had Salesforce access matching its purpose, plus far broader Vercel permissions. Those permissions exposed a stored credential belonging to a different non-human identity with administrator-level Snowflake access. The sales agent had no Snowflake account, yet the path existed: sales user, AI agent, Vercel tool, stored credential, Snowflake service identity, account administrator, data.

Traditional access reviews ask bounded questions. Those remain necessary, but an autonomous agent can combine the answers in ways no human would. The real blast radius includes every reachable identity hop behind direct permissions.

This creates a detection problem too. Security teams have treated movement between unrelated systems as a warning sign. An agent may produce similar telemetry while completing an assigned task. Movement alone can no longer separate useful execution from hostile activity. Teams need to know what the agent was built to do, who owns it, which identity it started with, which tools it could invoke, which credentials those tools exposed, and which resources became reachable.

Prompt filters and output controls reduce unsafe inputs and responses, but they do not determine which systems an agent's identities and credentials can reach. Once an agent chains tools across production systems, security depends on controlling the identities, permissions, and trust relationships involved.

Permissions describe capability, not purpose. Two agents can hold similar permissions yet carry very different risks. Intent-based security supplies the missing context: a defined purpose, a named owner, and access scoped to expected work. Identity is the only control plane spanning every system an agent touches, and intent determines whether access makes sense.

This is also a lifecycle problem. Organizations must discover agents as they appear, connect each to its human owner, understand the full access chain, right-size permissions as purpose changes, and revoke credentials at retirement. OWASP's Top 10 for Agentic Applications identifies identity and privilege abuse as a distinct agentic risk.

Security teams should discover every agent, including shadow agents; assign ownership; map the full access chain; compare access with intent; and enforce continuously by right-sizing permissions, revoking unused credentials, and treating shared caches, repositories, and message buses as trust boundaries.

Autonomy can be useful, and forcing every agent to behave like a script would remove much of its value. The stronger approach is to govern the identities and access paths that autonomy can use. Organizations that understand those paths can let agents reason, adapt, and act without an unknown blast radius. Those that cannot will learn what their agents can reach only after the agents find it.

Source: The Hackers News