AI Agents Break Identity and Access Management as Security Incidents Surge 80%

AI Agents Outpace Traditional Identity and Access Management Systems

AI agents now outnumber human identities 109:1 across enterprise systems, with that ratio expected to grow 85% this year alone, according to the 2026 Identity Security Landscape5

5

. Yet 80% of organizations report unintended actions by their AI agents5

5

, exposing a fundamental mismatch between legacy identity and access management architectures and autonomous AI agents that make decisions across multiple steps without human approval.

The core problem lies in how AI agent security depends on application configurations rather than the models themselves. When Salesforce Agentforce processes customer emails through Email-to-Case features, an unauthenticated outsider gains a direct route into internal agent instructions1

1

. The chain flows from public internet to email to case record to agent prompt to agent action to outbound reply, all using standard, documented features that were never designed for autonomous workflows.

SalesBleed Vulnerabilities Expose Prompt Injection Risks

Zenity Labs disclosed three SalesBleed vulnerabilities in Salesforce Agentforce on September 24, 2026, demonstrating how prompt injection attacks exploit AI agent governance gaps3

3

. Researchers planted malicious instructions in a public Web-to-Lead submission that remained dormant until an employee asked an agent to help with recent leads. The agent then processed the poisoned record, queried account data, packed sensitive values like company names and deal sizes into hostnames, and rendered image tags pointing to attacker-controlled infrastructure.

Two findings bypassed Salesforce's Trusted URLs control, enabling zero-click data exfiltration3

3

. The third exploited Agentforce's Slack integration, where the Reply to a Slack Thread action required no user confirmation and showed no visible attribution. Combined with URL bypass techniques, external attackers could force agents to post phishing messages into internal Slack threads under the agent's trusted identity.

Zenity reported the issues on June 1, 2026, and Salesforce confirmed fixes by September 21, with no evidence of exploitation3

3

. However, the pattern mirrors ForcedLeak, disclosed by Noma Security in September 2025, which used the same Web-to-Lead entry point to exfiltrate data to an expired domain purchasable for $5.

Shared Credentials Undermine AI Agent Governance Efforts

VentureBeat's September 2026 survey of 102 enterprises revealed that 17 of 40 teams claiming to enforce scoped identities and runtime permission checks still share credentials across some or most AI agents4

4

. Only 14 of the overall 102 respondents said they could revoke AI agent access within minutes4

4

.

Shared credentials prevent independent credential revocation because revoking one key can break other workloads using it. When a single prompt to a public-facing agent on Amazon Bedrock AgentCore returned temporary AWS credentials, those credentials could launch other agents, read their sessions, and pull secrets because the default IAM role covered every AgentCore resource in the same account and region4

4

. AWS initially marked the error as "informative" but the excessive permissions remained until at least June 22, 2026.

Andrew Obadiaru, CISO at Cobalt, explained that autonomous AI agents break the service-account model because "even when you revoke those tokens, sometimes they move so fast for you to be able to claw them back"4

4

. The agents move faster than rotation cadence.

Accountability Gaps Emerge as Sub-Agent Delegation Multiplies

When AI agents create sub-agents to divide tasks, accountability chains become unclear. An agent receives a goal and spawns several others to complete pieces of work, raising questions about permission inheritance and ownership2

2

. Should sub-agents inherit the parent's identity and permissions, or should their authority narrow based on assigned tasks?

The OWASP Top 10 for LLM Applications (2025 edition) ranks prompt injection first and attributes damage from excessive agency to three root causes: excessive functionality, excessive permissions, and excessive autonomy3

3

. When untrusted inputs can influence how an agent exercises its privileges, conventional access reviews miss the risk because they only examine what an identity has been granted, not how autonomous workflows chain that authority.

Long-running agents that monitor tickets and take action eventually become part of normal operations. When the person who created the agent leaves the company, ownership transfers remain undefined2

2

. Did responsibility automatically move to the person's manager, a successor, the team, or the enterprise?

Governance Failures Stem from Visibility Gaps

The OWASP Agentic Skills Top 10 describes governance failures under its "No Governance" category, noting that skills deployed inside third-party platforms remain unreachable by external scanners1

1

. Tools pointed at the problem from outside cannot see inside the venues where most AI agents live. Governance fails because rules get written before security teams can see what the rules apply to.

Which intake features are enabled, which triggers fire, which objects are exposed to guest users, which automation passes untrusted data where, and which model version the agent calls underneath—these variables decide whether the Agentforce chain creates a support-queue nuisance or data exposure1

1

. A vendor risk review performed at procurement sees none of them because the agent did not exist at procurement.

Jaya Baloo, co-founder of AISLE, traced the tension to service accounts: "In an average company, you have tens of thousands of service accounts. We have no clue what they're doing. And now you're adding AI to the mix with API keys, and you have no idea what they're doing"4

4

.

EU AI Act Penalties Mirror GDPR Enforcement Approach

The EU AI Act carries penalties up to €35 million or 7% of global annual turnover for prohibited practices, and up to €15 million or 3% for other violations1

1

. Every framework converging on it assumes operational evidence exists. GDPR already showed what happens when compliance exists on paper but cannot be evidenced operationally—British Airways faced £20 million and Marriott £18.4 million in fines not for imperfect policies but for inability to demonstrate compliance when regulators asked.

A governance practice built bottom-up generates evidence as a byproduct: the inventory, the owners, the configurations, the review history1

1

. Platforms like Reco discover AI agents across multiple vantage points, including those that never touch SSO, and assign each a risk profile before any policy can be applied.

Industry Standards Emerge for AI Agent Identity and Privilege Management

Microsoft Entra Agent ID, generally available since April 2026, provides AI agents with purpose-built identities, dedicated authentication flows, conditional access, and lifecycle governance, extending to agents running on AWS and Google Cloud5

5

. Amazon Bedrock AgentCore's Policy feature, generally available since March 3, 2026, lets teams write rules in plain language that convert automatically into Cedar policy language, with the AgentCore Gateway checking each tool request against those rules5

5

.

The OWASP Top 10 for Agentic Applications 2026, developed by more than 100 industry experts, provides a common language for risks including tool misuse, privilege abuse, and rogue agents5

5

. Just-in-time privileges should grant system access only for the duration of a specific workflow step and revoke it automatically when the step completes, with immutable end-to-end traces of an agent's reasoning path, tool calls, context signals, and touched data.