The New Insider Has No Pulse: Securing Privilege When the Actor Is an AI Agent
Summary: In July 2026, CREST launched an AI Charter with more than seventy cyber firms as signatories, built around nine principles covering accountability, transparency, and defined scope for AI systems in client environments. Days earlier, the UK's NCSC and DSIT published the Cyber Shield blueprint for agentic AI in cyber defense, requiring that agents be enabled by foundations of data, identity, reliability, cyber security, and regulatory compliance and secure the means to identify, trust and communicate between themselves.
Why it matters: OWASP's 2025 Non-Human Identities Top 10 ranked improper offboarding as the top risk, followed by secret leakage, over-privileged NHIs and long-lived secrets - and Verizon's 2025 DBIR found stolen credentials in roughly a fifth of breaches and nearly nine of ten basic web application attacks. An agent holding a long-lived, broadly scoped credential with no lifecycle is an insider that never sleeps and can be steered by anyone who compromises its inputs.
Read the original at The Hacker News ↗
- Topics
- Identity & Access Management
- Related
- FBI flash alert says Artex tool automating cyberattacks at ‘machine speed’ Cyber Risks · Nov 13, 2026Connect Wise Cloud Backup application abused in cross-tenant token sweep Cyber Risks · Oct 19, 2026Sponsored: Specter Ops on the impact of AI agents on Blood Hound Cyber Risks · Sep 20, 2026