All ArticlesRuntime Truth
Visibility & Shadow AI
Threat Explainer
Risks Of Agentic Ai

Risks of Agentic AI: The Complete Threat Overview for Security Teams

AI agents are not just a new tool category. They are a new threat class, and the security tools you already own were built for a world where humans took actions and machines waited for instructions.

Obsidian Editorial Team
Security Research
·
Obsidian Security
·
May 13, 2026
May 14, 2026
Key Takeaways
  • Agentic AI risks are fundamentally different from generative AI risks because agents take actions, inherit credentials, and chain operations across systems without human checkpoints.
  • Maker mode credential inheritance, orphaned agents, and unsanctioned MCP server connections represent the highest-severity individual risk factors in enterprise deployments today.
  • Toxic combinations of medium-severity risks compound into critical incidents. A single over-permissioned, org-wide accessible, orphaned agent represents a critical-priority exposure.
  • Existing IAM, SIEM, and posture tools miss agentic risks because they were designed to govern human behavior and static configurations, not probabilistic agents operating at runtime.
  • Effective detection requires a complete AI agent inventory, runtime visibility into what agents actually do, and deterministic guardrails that enforce least privilege before damage occurs.

What Makes the Risks of Agentic AI Different From GenAI Risks

Most security programs treated generative AI as a data leakage problem. An employee uploads a contract to ChatGPT. A prompt contains PII. The risk was human-to-model: a person made a choice, and the model received data it should not have. That framing is incomplete in 2026.

The risks of agentic AI operate in the opposite direction. The threat is model-to-system. An agent receives a goal, selects tools, authenticates to downstream applications, and executes a sequence of actions without a human approving each step. The agent is not waiting for instructions. It is issuing them.

This shift matters because every control layer you have was designed to govern human decisions. Zero Trust policies evaluate user identity. DLP rules scan human-initiated uploads. Access reviews ask managers to certify employee permissions. None of these controls have a concept of an AI agent acting on behalf of a user, using credentials the user never directly touched, inside applications the user may not even have access to.

Agents also inherit credentials. A model does not hold a bearer token or an OAuth grant. An agent does. That token persists. It does not expire when the user logs out. It does not trigger an MFA challenge. It does not appear in your identity governance platform's access review queue. It operates as a machine identity, and machine identities now outnumber human identities in most enterprise environments by a factor of 25 to 50.

The predecessor framing of "AI security" addressed the model layer. The current threat class lives in the action layer, and it requires a different detection framework entirely.

The Core Risks of Agentic AI, Categorized

Understanding the specific mechanics of each risk is the prerequisite for building effective controls. Here are the seven risk categories that security teams need to address.

1. Maker Mode Credential Inheritance and Privilege Escalation

When an agent is built in maker mode, it runs using the creator's credentials for every downstream connection. Any user who invokes that agent, regardless of their own permission level, effectively operates at the creator's privilege level inside every connected system. A user without Salesforce access can invoke a Copilot agent built by a Salesforce administrator and read CRM records they were never provisioned to see. The agent did exactly what it was designed to do. Your access controls were bypassed by design. This is maker mode privilege escalation, and it is one of the most common critical-severity findings in enterprise AI agent assessments today.

2. Orphaned and Shadow Agents

An orphaned agent is one whose creator account has been disabled. The agent continues running. Its credentials remain valid. No one owns it, no one monitors it, and no one will notice when it is invoked. Shadow agents are the broader category: agents deployed by business users without IT or security oversight, untracked, unmanaged, and unknown to any governance process. Enterprise inventories routinely surface hundreds of Copilot agents that no one had catalogued, and thousands of agents created before any inventory existed. You cannot govern what you cannot see.

3. Action Chaining and Blast Radius Expansion

A single agent action is rarely the threat. The threat is the sequence. An agent reads a document, extracts data from a CRM record, writes a summary to a shared drive, and sends an email notification. Each individual action may be within policy. The chain of actions moves sensitive data across four systems in under a second. This is action chaining, and it expands the blast radius of any single misconfiguration exponentially. The more tool connections an agent has, the larger the potential blast radius of a compromised or misconfigured workflow.

4. Unsanctioned MCP Server Connections

Model Context Protocol servers are the connective tissue between AI agents and external tools. They are also largely invisible to security teams. Developers and business users connect agents to MCP servers without security review. Those servers may access unregistered domains, hold hardcoded credentials, or expose tools that the agent was never intended to use. An MCP server inventory, distinguishing sanctioned from unsanctioned connections, is a foundational requirement for agentic AI security that most organizations have not yet built.

5. Toxic Combinations of Medium-Severity Risk Factors

No single risk factor in this list is necessarily critical in isolation. An org-wide accessible agent is a medium-severity finding. A maker mode connector is a medium-severity finding. An orphaned creator account is a medium-severity finding. When all three exist on the same agent, the combination is critical. This is the toxic combination pattern: individual risk factors that compound into a high-priority exposure when they co-occur on a single agent. Prioritizing alerts by toxic combination detection is the difference between actionable security intelligence and alert fatigue. For a deeper look at how these combinations are scored, see AI agent toxic risk combinations.

6. Confused Deputy Attacks

A confused deputy attack occurs when an agent with elevated permissions is manipulated into performing actions for a user who does not have the right to request them. The agent is not compromised. It is doing its job. But its job involves permissions that the invoking user should not be able to exercise. The agent acts as a deputy for the user, and the user exploits that relationship to access data or execute actions outside their authorization scope. OWASP's emerging guidance on agentic AI risks identifies this as one of the primary escalation vectors in multi-agent environments.

7. Data Exfiltration at Machine Speed

Human data exfiltration leaves behavioral signals: anomalous login times, unusual download volumes, access to unfamiliar resources. AI agents move data at machine speed as part of normal operation. An agent that reads thousands of CRM records and summarizes them to an external endpoint looks identical to an agent performing a legitimate reporting task. The volume and velocity that make agents valuable also make their data movement patterns nearly impossible to distinguish from exfiltration using tools designed to detect human behavior anomalies.

How These Risks Compound. One Concrete Attack Chain

The following chain is a composite drawn from patterns across enterprise Salesforce and Copilot Studio deployments. It illustrates how individual risks combine into a critical incident.

Step 1. A sales operations manager builds a Copilot Studio agent to automate pipeline reporting. The agent uses a Salesforce connector configured in maker mode, using the manager's admin-level Salesforce credentials.

Step 2. The manager leaves the company. IT disables the manager's Active Directory account. The Copilot agent is not in any IT-managed inventory. The Salesforce connector credentials remain embedded and active. The agent is now orphaned.

Step 3. The agent was configured as org-wide accessible. Any employee in the organization can invoke it via the Teams interface. No one removed this setting when the creator left.

Step 4. A contractor with no Salesforce provisioning invokes the agent and asks it to pull a list of all enterprise accounts with contract values above a certain threshold. The agent executes the query using the embedded admin credentials. The contractor receives data they have no right to access.

Step 5. The agent's response includes data tagged with Microsoft Information Protection sensitivity labels. The contractor copies the output to a personal cloud storage account. The agent completed a legitimate tool call. The data movement looks like normal agent activity.

Step 6. The action chain touched four systems: Teams, Copilot Studio, Salesforce, and the contractor's personal storage. No single system logged the full sequence. No alert fired because each individual action was within the agent's configured permissions.

Step 7. The incident surfaces three weeks later during a routine audit. By then, the data has been accessed multiple times. The blast radius includes every record the agent's admin credentials could reach.

Real-World Toxic Combination Pattern Agent profile: Org-wide accessible, maker mode connector with admin Salesforce credentials, creator account disabled (orphaned), and sensitive data access confirmed Individual severity: Each factor scores medium in isolation Combined severity: Critical Why it matters: This combination means any employee, contractor, or compromised account that can reach the agent's Teams interface can extract admin-level Salesforce data. The agent is functioning as designed. The risk is invisible to every tool that sees only configuration, not runtime behavior.

Why Your Current Tools Don't Catch These Risks

Security teams are not failing because they are not paying attention. They are failing because their tools were built for a different threat model.

What IAM sees: User identities, group memberships, access certifications, MFA status. What IAM misses: the agent's effective authority inside each connected SaaS application, the relationship between the invoking user's permissions and the agent's embedded credentials, and whether the agent's token has been used to access data the invoker should not reach.

What SIEM sees: Log events from connected sources. What SIEM misses: the correlation between the runner's identity, the agent's maker credentials, and the downstream data access. MCP server interactions do not appear in SIEM logs. Agent-to-agent communication across platforms generates no unified log record. The sequence of actions that constitutes an attack chain is scattered across four separate log sources with no native join key.

What posture tools see: Theoretical configuration. What posture tools miss: runtime behavior. A posture tool can tell you that an agent has a maker mode connector. It cannot tell you whether that connector was used, who invoked it, what data was returned, or whether the invoker had any right to that data. This is the ghost chasing problem. Security teams review theoretical configuration signals with no runtime evidence of what actually happened.

The signal gap is structural. Posture tools see the agent as it is set up. Runtime tools see the agent as it operates. Most organizations have posture coverage and no runtime coverage. That means they know what could happen, not what did happen. Effective authority, what the agent can actually do inside each connected application after all entitlements resolve, is invisible to every tool that does not operate at runtime.

What Detection and Mitigation Require

Addressing the risks of agentic AI requires four capabilities working together. No single tool delivers all four, and no program is complete without all four.

1. Complete AI Agent Inventory

You cannot govern what you cannot see. The starting point for any agentic security program is a single pane of glass across every AI platform in your environment: who built each agent, when it was last used, what SaaS connections it holds, what MCP servers it connects to, and whether the creator account is still active. This inventory must cover sanctioned and unsanctioned agents, including shadow agents deployed by business users without security review. An AI agent risk assessment is the fastest way to understand the current state of your environment.

2. Runtime Visibility Into Effective Authority

Configuration visibility is necessary but not sufficient. Security teams need to know what agents actually do at runtime: which users invoke them, what data they access, what tool calls they execute, and whether any of that activity is policy-aligned. This requires correlating agent configuration with SaaS entitlements, identity context, and real-time behavior into a single picture of effective authority. Runtime visibility is what separates evidence-based security from ghost chasing.

3. Deterministic Guardrails for Probabilistic Agents

AI agents are probabilistic by design. They select actions based on context and probability. Your access controls cannot be probabilistic. Deterministic guardrails apply fixed, predictable enforcement rules to dynamic agent behavior: blocking maker mode escalation before it completes, flagging org-wide accessible agents with sensitive data connections, and enforcing least privilege at the point of action rather than after the fact. Probabilistic agents require deterministic guardrails. This is not a philosophical preference. It is the only architecture that prevents action chains from completing before detection fires. For more on this framework, see AI agent governance.

4. Machine Identity Governance

AI agents are non-human identities. They hold tokens, execute actions, and make access decisions. Every existing insider risk program covers human behavior. None of them cover machine behavior. Machine identity governance extends your identity framework to cover agent credentials, token lifecycle, delegation chains, and the relationship between agent permissions and invoker permissions. The bearer token problem, where possession of a token grants full authority with no verification of who holds it, is the technical foundation of machine insider risk. The Salesloft-Drift and Gainsight incidents, where attackers used stolen bearer tokens to access more than 700 organizations' Salesforce environments without triggering authentication alerts, demonstrate the scale of the exposure. Addressing it requires treating agents as first-class identity subjects, not as tools that humans use. See bearer tokens explained: the hidden risk behind your AI Agent strategy for the technical detail.

For teams securing specific platforms, Microsoft Copilot agent defense and Salesforce Agentforce security are the highest-priority starting points given the privilege escalation patterns documented across enterprise deployments. Note: deterministic runtime guardrails are generally available on Microsoft Copilot today, with expanded platform coverage on the roadmap.

A New Threat Class Your Existing Tools Were Never Built to See

The risks of agentic AI are not theoretical. They are operational, they are compounding, and they are invisible to the tools most security teams currently rely on. Agents inherit credentials, chain actions across systems, and move data at speeds that make human-pattern detection irrelevant. The toxic combinations that create critical exposures are already present in most enterprise environments. They are just not visible yet.

The path forward is clear even if the work is not easy. Build a complete inventory of every agent in your environment. Move from theoretical configuration review to runtime visibility into effective authority. Apply deterministic guardrails to the highest-risk agent configurations. Extend your identity governance program to cover machine identities with the same rigor you apply to human accounts.

Configuration is not reality. Runtime truth is the only foundation for effective agentic AI security, and the time to build that foundation is before the next incident surfaces it for you.

Frequently Asked Questions

What are the most critical risks of agentic AI for enterprise security teams in 2026?

The highest-severity risks are maker mode credential inheritance enabling privilege escalation, toxic combinations of medium-severity risk factors on a single agent, and orphaned agents running with persistent credentials after their creator accounts are disabled. These risks are critical because they operate within the agent's intended design. Nothing is technically broken. The access controls were bypassed by architecture, not by exploit.

How are the risks of agentic AI different from traditional AI security risks?

Traditional AI security focused on the human-to-model interaction: what data a user sends to a model, and what the model returns. Agentic AI risks operate in the opposite direction. The agent takes actions autonomously, authenticates to downstream systems using embedded credentials, and executes multi-step workflows without human checkpoints at each step. The threat is model-to-system, not human-to-model.

Why do existing IAM and SIEM tools miss agentic AI threats?

IAM tools govern human identity lifecycle events. They have no concept of an agent's effective authority inside a connected SaaS application, or the relationship between an invoking user's permissions and the agent's embedded credentials. SIEM tools correlate log events, but agent action chains scatter their evidence across multiple disconnected log sources with no native join key. Neither tool operates at runtime with the context needed to distinguish legitimate agent behavior from privilege escalation or data exfiltration.

What is a toxic combination in the context of agentic AI risk?

A toxic combination occurs when multiple medium-severity risk factors co-exist on a single agent, compounding into a critical-priority exposure. The canonical example is an agent that is org-wide accessible, uses a maker mode connector with admin-level credentials, and has a disabled creator account. Each factor scores medium in isolation. Together, they create a condition where any user in the organization can access admin-level data through the agent, with no active owner to detect or remediate the misuse.

What does an effective agentic AI security program require?

Four capabilities are required: a complete AI agent inventory covering sanctioned and unsanctioned agents across all platforms, runtime visibility into what agents actually do rather than what their configuration says they should do, deterministic guardrails that enforce least privilege on probabilistic agents at the point of action, and machine identity governance that extends your identity framework to cover agent credentials and token lifecycle. None of these capabilities are optional. Each one is a prerequisite for the next.