Identity Threat Detection for AI Agent Identities

Non-human identities already vastly outnumber human identities across enterprise environments, and the ratio has been climbing for years. AI agents are the fastest-growing subcategory within that population. The NHI access management market sat at roughly $11.14 billion in 2025, growing at nearly 12% annually, with projections approaching $27.33 billion by 2033. Those numbers reflect infrastructure spend, not agent headcount, and the headcount is what keeps security teams up at night.

What makes this particularly hard to manage is how quietly these identities accumulate. Someone spins up an agent for a prototype, a one-off integration, a proof of concept that never quite dies. When the project winds down or the engineer who built it moves on, the credential stays. Active, scoped as it always was, sitting entirely outside the visibility of conventional IAM programs. No alert fires. No offboarding process catches it. It just persists, drawing no attention until it does.

The governance problem exists at scale right now. AI agents are the segment of it growing fastest, and they carry the largest potential blast radius per identity in the category.

Why MCP creates a new identity attack surface that existing tools were not designed to see

The Model Context Protocol is an open standard for connecting AI agents to external tools and data sources through a client-server model. It is now governed as a vendor-neutral specification and adopted broadly, which is itself the first signal worth paying attention to: standardization accelerates adoption, and adoption at this pace reliably outpaces security vetting. That is not a hypothesis; it is a pattern that has repeated across every major infrastructure layer for thirty years.

MCP relies on OAuth 2.1 and token-based scopes. Those credential models were built for human users authenticating to discrete services, not for autonomous agents dynamically chaining calls across dozens of connected servers inside a single session. The authorization model determines what is visible and what is enforceable. When the model was designed for one use case and deployed into a fundamentally different one, gaps follow.

The structural exposure is not subtle. The MCP authorization specification marks authorization as optional. An internet scan from mid-2025 found a meaningful number of publicly accessible MCP instances responding to unauthenticated requests. Optional authentication in a protocol designed to connect agents to file systems, code repositories, communication tools, and payment infrastructure is not a minor oversight; it is a load-bearing gap.

There is also a layer of attack surface that network controls and auth tokens simply cannot reach. An LLM sits between user intent and system action. The model's interpretation of instructions is part of the trust boundary, and a firewall rule has nothing to say about whether that interpretation was correct, or whether the instructions arrived intact. A single MCP session can connect an agent to dozens of servers simultaneously. A compromise at any one point propagates across the full chain, fast, without sleep, and without noticing when its instructions have been quietly altered.

The attack patterns that exploit AI agent identity at runtime

Tool poisoning

An attacker modifies a tool's description so the model misreads what the tool does. The agent calls what it believes is a benign function while executing something else entirely. Invariant Labs named and demonstrated this pattern in early 2025. The MCPTox benchmark later tested poisoned tool descriptions against real MCP servers and found high attack success rates alongside near-zero model refusal rates, which is the combination that makes a vulnerability practically exploitable rather than theoretically interesting.

Microsoft Incident Response published a detailed walkthrough tracing the pattern through four phases: silent description modification, dynamic re-trust without re-approval, agent execution, and exfiltration through an approved call. That last phase is the crux of it. The exfiltration moves through a channel the agent is authorized to use. No policy is violated at the credential level. The agent's credential is clean; its reasoning is not. Posture-based tools see nothing wrong because nothing, by their measure, is.

Prompt injection

Hidden instructions embedded in content the agent processes, a web page, a document, a tool output, get interpreted as legitimate commands. OWASP's Top 10 for Agentic Applications 2026 classifies this as the top threat category for deployed agents.

The EchoLeak attack, documented as CVE-2025-32711, demonstrated indirect prompt injection in a widely deployed enterprise AI product. Sensitive data moved out via HTTP requests. No large file transfers occurred. No DLP rules triggered. The exfiltration was semantic, carried in the content of legitimate-looking traffic. Existing detection tooling missed it not because it was evasive in a sophisticated sense, but because the tooling was simply not looking at what the content said.

Multi-turn attacks that unfold across extended conversations achieved very high success rates in testing across open-weight models. An agent that behaves correctly through the first dozen turns can be redirected by a payload it encounters much later. The session behaves correctly right up until it does not.

Cross-agent trust abuse and agent impersonation

When agents pass outputs to other agents, each handoff carries an implicit trust relationship. A compromised upstream agent can embed instructions into a downstream agent's context, and the downstream agent has no reliable mechanism to distinguish legitimate orchestration from adversarial injection. The downstream agent has no reason to be suspicious; it received input through the expected channel.

In practice: a compromised research agent injects hidden directives into its output. A financial agent consumes that output and executes actions the user never requested. The user authorized the original connection. The agent did the rest, faithfully, following instructions it could not verify. Malicious tool descriptions in one server's schema can redirect agent requests through a server the user never authorized, converting legitimate integrations into exfiltration paths without triggering any access control that operates at the credential level.

Credential and supply chain exposure

AI-related secrets, API keys, agent configuration tokens, LLM service credentials, are being hardcoded and leaked at an accelerating rate. GitGuardian's 2026 research identified them as the fastest-growing category of secret exposure on public code repositories. Within MCP ecosystems specifically, GitGuardian found a substantial number of secrets embedded in MCP configuration files on public GitHub.

The supply chain vector extends further still. A fake package mimicking a legitimate integration was found silently copying outbound data to an attacker-controlled endpoint. The MCP ecosystem's rapid growth outpaces its vetting processes, which is predictable. Developers integrate packages they trust by name, not by audit, because auditing does not scale at the speed they are moving.

Every one of these attacks exploits something that happens at runtime: how the model interprets instructions, the trust dynamics between agents, the dynamic assembly of a tool call. None of them would be caught by a posture scan of credentials at rest. That is not a tooling gap at the margin; it is the wrong category of tool entirely.

Where current NHI governance programs break down against agent behavior

Most NHI governance frameworks were built for static credentials. Inventory the key, verify its scope, rotate it on schedule, revoke it when someone offboards. That model was adequate for the problem it was designed to solve. It is not adequate for this one, and the failure modes are specific.

Posture-at-rest tools assess what a credential is scoped to; they cannot assess what an agent actually did with that credential across a multi-step workflow. Rotation cadences were designed for human-managed keys; agent-issued credentials accumulate faster than any manual rotation process tracks. Least-privilege enforcement assumes a knowable, static access need, and agents can reason about and request access to systems their operators never anticipated. Audit trails for human identities capture login events; agent audit trails need to capture tool calls, delegation chains, and the content of model-interpreted instructions, none of which traditional IAM logs include.

Roughly half of organizations report no clear ownership of AI identities, and a substantial share have no governance framework in place at all, despite near-universal AI agent adoption. That is not an edge case; it is the baseline condition most enterprises are operating from right now.

The blast radius problem is structural. Because agents chain calls across multiple systems inside a single session, a single point of compromise can propagate through an entire workflow before any alert fires. Average dwell time after an NHI breach already far exceeds dwell time for compromised human accounts. Agent breaches that unfold semantically, through content rather than known malware signatures, are harder still for existing detection tooling to surface.

What behavioral detection at runtime actually requires for agent identities

The central shift is from credential posture to behavioral analysis. The question changes from "what does this identity have access to" to "what is this identity actually doing, call by call, across this session." That reframing sounds modest. It requires a fundamentally different instrumentation architecture.

The signals that matter are specific. Tool call sequences: does the sequence of calls match the agent's stated intent, or does it reach into systems outside the workflow's expected scope? Scope drift: is the agent requesting or exercising permissions beyond what its initial authorization covered? Intent drift: does the agent's behavior remain consistent with the original user instruction across a session, or does it diverge in ways consistent with prompt injection or context poisoning? Data flow patterns: is data moving toward endpoints outside the expected workflow, in volumes or formats inconsistent with the task, even without triggering file-size-based DLP rules? Cross-agent delegation chains: when one agent delegates to another, has the delegated scope expanded beyond the delegating agent's scope, or stayed within it?

Tamper-proof, structured audit logging is a prerequisite for all of this. Detecting behavioral anomalies requires a complete record of every tool call, every credential use, every delegation event, not just authentication logs.

OpenTelemetry tracing enables end-to-end visibility across agent sessions and tool calls. Without it, behavioral signals are fragmented across systems and uninterpretable as a sequence. Policy enforcement needs to operate at tool-call depth, not at the session or credential level. A policy permitting an agent to access a file system cannot be evaluated at login time; it must be evaluated at the moment the tool call is constructed, with the context of what the agent has already done in that session.

On the standards front, the OpenID Foundation's work on agentic identity and proposals like Invocation-Bound Capability Tokens are moving toward credential models that carry delegation chain and provenance information natively. These are emerging, not yet deployed at scale, but they indicate where the underlying infrastructure is headed.

How identity, detection, and access control need to work together across an agent workflow

Detection without enforcement is incomplete. Flagging intent drift or scope expansion matters only if the system can act on it: suspend a session, revoke a JIT credential, block a specific tool call before the action propagates downstream. An alert that arrives after exfiltration has occurred is forensics. It is not security.

Identity must be tied to every action, not just to the session. SSO and SCIM-based identity binding at session initiation does not answer who directed a specific tool call inside a multi-step workflow. Identity needs to carry through to the tool-call level, which is a different architectural requirement than what most current systems enforce, and one that requires deliberate design rather than incremental extension of existing patterns.

Credential handling for agents requires a genuinely different model than static API keys. Just-in-time credential issuance, scoped to the specific task and duration, limits the exposure window if an agent is compromised mid-session. Credentials that expire with the session cannot be exfiltrated and reused. Long-lived agent tokens can be, and frequently are.

The MCP ecosystem's structural reliance on OAuth scopes designed for human delegation compounds this. Without an additional control layer, agents accumulate and carry permissions far beyond what any single task requires. The scope that made sense for a human delegating calendar access behaves very differently when an autonomous agent carries it across a chained workflow touching a dozen systems.

A fragmented stack: a separate agent builder, a separate API gateway, a separate security monitoring tool, creates blind spots at every handoff between components. The behavioral signal an agent produces needs to be interpretable across its full session, not reconstructed after the fact from logs in different systems with different schemas and misaligned timestamps. Managing this across a large agent population argues for centralized policy enforcement with per-tool-call visibility, not per-agent manual configuration, which does not scale and was never going to.

What organizations should evaluate when assessing their current exposure

Start with inventory. Most organizations cannot currently answer how many AI agents are active, what systems they are connected to, or what credentials they hold. That gap is the baseline exposure. Everything else is secondary until it is closed.

The questions worth pressing on current tooling are direct. Do existing NHI governance tools produce visibility at the tool-call level, or only at credential issuance and rotation? Is there a complete, tamper-proof audit trail capturing the sequence of tool calls within an agent session, not just authentication events? Are agent credentials issued just-in-time and scoped to the task, or are long-lived tokens running across agent workflows? Is there any detection in place for MCP-specific threats including tool poisoning, prompt injection, and intent drift, or does current monitoring cover only network-layer and credential-based signals? When one agent delegates to another, is the delegation chain recorded and the scope of the delegated credential verified?

Shadow MCP usage deserves specific attention. Agents and MCP servers adopted outside IT-sanctioned channels carry the same risks as any shadow IT, but with a larger potential blast radius given how many systems a single MCP session can touch. Developers integrate MCP tooling because it is useful, not because it cleared a security review, and useful things spread fast.

The organizations most exposed are those with high adoption and no governance layer, where the agent population has scaled faster than the controls around it. The attacks described here are already documented in production environments. Dwell times associated with undetected NHI compromises mean the cost of inaction compounds over months. The agent population is not pausing while organizations wait for cleaner answers.