Six-Hour Cloud Heist Shows Enterprise Identity Controls Cannot Keep Up With AI Agents
What happened
Security researchers writing in The Agent Smith Dilemma: Governing Agentic Identities examined identity and access risks created by autonomous AI agents operating inside enterprise cloud environments. A documented incident from Google Threat Intelligence Group shows a multi-agent framework completing a credential-harvesting campaign in under six hours. It did so by exploiting trusted-proxy relationships between agent components inside a victim's cloud environment. The analysis finds that conventional identity and access tools, designed around human login timelines measured in hours or days, cannot track agents that spin up and act in milliseconds. Authors recommend three structural controls: short-lived, task-specific credentials for each agent rather than inherited human credentials; AI Bills of Materials, known as AIBOMs, to track which software components make up each agent and where they came from; and a named human sponsor for every agent deployment to preserve an accountability chain when something goes wrong.
Why it matters
- ·Agents that inherit human credentials can access everything that employee was permitted to reach, meaning a single compromised or misbehaving agent can expose an entire cloud environment. Most enterprise privilege reviews do not cover agents separately from the users they impersonate, leaving this exposure invisible until an incident occurs.
- ·Without agent-specific audit trails, compliance teams cannot reconstruct what an agent did, whose authority it acted under, or whether it exceeded its permitted scope. This creates a direct gap in audit readiness obligations under the EU AI Act (Regulation (EU) 2024/1689) and the Interagency Revised Guidance on Model Risk Management (OCC Bulletin 2026-13, SR 26-2). Both frameworks require documented evidence of control over automated systems.
- ·The six-hour attack timeline documented here is a serious concern. So is the finding that 55% of organizations run system-changing AI agents without identity controls. Many enterprises face a fully realized attack class with no detective or preventive control in place.
Stay ahead of stories like this
Get every Global AI governance development like this one, plus the rest of the week's developments. Every Thursday.
Recent issues
- State-linked attackers and criminal operators are actively weaponizing AI tools as entry points into enterprise systems, turning internal platforms and open-source frameworks into live attack vectors.5 Nov
- Three separate incidents this week each created a new compliance action item: verify your AI vendors' data sourcing, demand agent monitoring coverage guarantees, and audit trusted app identities in your cloud environment.29 Oct
Free every Thursday. Unsubscribe anytime.
Governance controls affected
What to do now
- ☐Ask your identity and access team to produce a list of all AI agents that currently run under a human employee's login credentials or access tokens, and treat any agent on that list as a priority remediation item.
- ☐Require that each AI agent in production or staging environments be assigned its own distinct identity with the minimum access needed for its specific task, rather than inheriting a human user's permissions.
- ☐Confirm that your agent audit logs record the agent's own identity separately from any human identity it may be acting on behalf of, so that a post-incident review can distinguish agent actions from human actions.
- ☐Ask your procurement and engineering teams whether any AI agents deployed in cloud environments have an up-to-date component inventory, commonly called an AIBOM, that records what software parts they contain and where those parts came from.
- ☐Assign a named human owner to every production AI agent deployment and document that ownership in your AI model registry, so there is a clear accountability chain if the agent causes harm or triggers a regulatory inquiry.
What to watch next
Regulators and supervisors are moving toward requiring documented evidence of agent-level identity controls, not just general AI governance policies. Both the Interagency Revised Guidance on Model Risk Management (OCC Bulletin 2026-13, SR 26-2) and the Five Eyes Guidance on the Careful Adoption of Agentic AI Services have flagged credential management as a named gap. Compliance teams should watch for follow-on guidance from financial regulators on agent-specific privileged access requirements. They should also monitor whether the EU AI Office's inspection program begins requesting evidence of non-human identity separation as part of high-risk AI conformity assessments.