Quick answer: Zero trust for AI agents means giving every agent its own verifiable identity, the minimum permissions it needs, continuous re-authentication on every request, and a full audit trail — rather than trusting it by default once it’s inside the network. Traditional zero trust was built for human sessions and static devices; agentic AI breaks those assumptions at machine speed.
Three hundred thousand. That’s how many AI chatbot credentials IBM’s X-Force team discovered up for sale on the dark web, as reported in the X-Force Threat Intelligence Index 2026. Not employee passwords. Not VPN logins. Credentials for the AI systems that companies rely on to read files, query databases and act on their behalf.
That one number is responsible for shifting zero trust for AI agents from theory to a board-level decision in a matter of weeks. IBM released a webinar titled, ‘Eliminating agentic blind spots: modernising your zero-trust program for AI’ which explains that security leaders’ current frameworks weren’t designed for non-human identities that act autonomously.
Days later, AWS launched Continuum, a system that reasons over infrastructure, permissions, and business context to police agentic workflows in something closer to real time. And Patronus AI closed a $50 million Series B to build simulation environments that train and evaluate agents against exactly the failure modes security teams now have to defend against.
Three separate signals, one shared conclusion: zero trust AI agents enterprise security is no longer a subset of identity and access management. It’s becoming its own discipline, and most CISOs are still applying yesterday’s rulebook to it.
The traditional zero trust approach was designed for humans and devices: Authenticate the user, validate the endpoint, restrict access, log the user and session. Agentic AI breaks every one of those assumptions at once.
IBM’s own AI agent security explainer lays out why. Agents present an expanded attack surface because they sit inside larger systems of APIs, databases, and other agents. They take autonomous actions at speed, without a human approving each step. Their reasoning is probabilistic, so even defenders cannot fully predict what an agent will do next. And because the underlying models are largely opaque, root-cause analysis after an incident is slower and harder than with conventional software.
AWS is responding to the same pressure from the infrastructure side. Continuum, announced on 17 June 2026, starts agents in a supervised “learn mode” with a human in the loop, and moves them to an “enforce mode” only as their trust is earned category by category. That graduated-trust model is a direct response to a problem many companies face: agents accumulating permissions they no longer need, with no way to revoke them.
The numbers back up the urgency. Alongside the 300,000 leaked AI credentials, the same IBM report found a 44% year-on-year increase in the exploitation of public-facing applications, and that 56% of all vulnerabilities disclosed required no authentication at all. Every enterprise AI agent attached to a document store, a CRM, or an in-house tool now falls within this exposure.
In agentic AI, the zero-trust approach is to treat every agent like a new, unvetted employee — except one that can act thousands of times a minute.
Give every agent its own verifiable identity
An agent should never inherit a human’s session or a shared service account. It must have its own credential, audit trail, and revocation process, independent of whoever built or deployed it.
Enforce least privilege by default, not by exception
IBM’s advice is clear here: agents should only have the minimum rights necessary for what they’re doing, not “just in case.” Role-based and attribute-based access controls should limit both the information an agent can access and the tools it can use — not just its ability to log in.
Authenticate continuously, not once per session
Context-aware authentication should evaluate each request an agent makes — what it’s asking for, when, and from which data — rather than relying on a single token for the duration of a workflow.
Sandbox and microsegment agent actions
Run code execution and tool calls in an isolated environment so a compromised agent can’t move sideways into systems it shouldn’t touch.
Keep a complete, immutable audit trail
Every document an agent reads and every action it takes must be logged against the original, verified source. Without that record, an agent’s actions — and inactions — after an incident become a matter of speculation.
This is precisely the layer Vaultiscan was built to secure. Most zero trust conversations focus on network access and endpoint identity. Vaultiscan sits one level deeper, at the knowledge gateway itself, governing which agents can reach which documents, under what conditions, every time a query runs.
Vaulti Lake enforces permissions and access scope at the data layer, so agents retrieve only the content they are authorised to see, with full metadata on source, version, and ownership attached to every result. Vaulti GPT gives teams a private assistant that answers exclusively from that governed, permissioned knowledge base rather than an open connection to public models. Vaulti SDK lets engineering teams build that same governed retrieval and access-control layer into their own agentic applications, instead of bolting permissions on after the fact.
Enterprise data never leaves your environment, every access is scoped and logged, and the AI audit trail your compliance team requires doesn’t need to be added on as an afterthought.
It means every agent gets its own identity, minimum necessary permissions, continuous re-authentication on each request, and a full log of what it accessed and did — rather than being trusted by default once it’s inside the network.
Because they were designed around human sessions and static devices. Agents act autonomously, at machine speed, with probabilistic reasoning that can’t be fully predicted — which breaks the assumptions those frameworks were built on.
Permission sprawl: agents accumulating access they no longer need, with no automated process to detect or revoke it, combined with a lack of governed access controls at the document and data layer.
APIs and microservices are static, predictable, and human-authored. AI agents act autonomously and probabilistically, so controls must evaluate intent and context on every request rather than trusting a fixed identity or endpoint.
Inventory every agent currently connected to your systems and what it can access today — most enterprises are surprised by how much permission sprawl already exists before they design any new controls.
With a single objective and three different approaches from the likes of IBM, AWS, and Patronus, agentic AI requires a security model built for non-human identities operating at machine speed, not yesterday’s perimeter defences. The solution isn’t just about one product; it’s about a discipline: verified identity per agent, least privilege by default, continuous authentication, and a thorough audit trail from source document to final action. Businesses that treat this as part of their governance process, rather than an afterthought, will continue to be trusted with sensitive data the next time a credential leak makes the news.
Learn how Vaultiscan enforces access controls on your enterprise knowledge: book a security review.
Fill in your details and our team will contact you to discuss your use case and next steps.
Just a few details to begin.
By submitting, you agree to our Terms & Privacy Policy.
