How to Secure Autonomous AI Agents with Zero Trust

TL;DR

Secure AI agents by assigning unique non-human identities, granting privileges only when needed, storing dynamic credentials in a controlled vault, and limiting agents to vetted tools and data sources. Apply security controls throughout the system, inspect inputs and outputs with an AI gateway or firewall, and operate under the assumption that attackers may already have access.

Transcript

We've entered the age of agentic AI, systems that don't just think, but they also act. Agents can talk to APIs. They can call tools. They can buy things. They can move data, even create sub-agents. But every new capability adds a new attack surface, yet another way the bad guys can get into our systems. So how do we protect this new ecosystem? We b... Read More

Key Insights

• Zero trust is a security model in which trust follows verification. It also replaces just-in-case access with just-in-time privileges, preserves least privilege, distributes controls throughout the system, and assumes attackers may already possess network, database, application, or elevated credential access.
• The assumption of breach is a central zero trust principle. Security architecture should begin from the possibility that an attacker is already inside the system, has stolen credentials, or holds elevated privileges, then design controls that restrict movement, exposure, persistence, and potential damage.
• AI agents increase attack surfaces because they can communicate with APIs, call tools, purchase items, move or write data, and create additional agents. Each capability, interface, service, credential, data source, and subordinate agent introduces another location that an attacker could potentially target or manipulate.
• Non-human identities require controls and visibility comparable to, or greater than, those applied to human users. A single agent may use multiple identities, and agents may create more agents, producing a growing identity population that needs access control, limited privilege, secure storage, and autonomous activity supervision.
• Agentic system threats can affect sensing, reasoning, augmentation, and action. Direct prompt injection can disrupt context, while poisoned policies, preferences, training data, or models can influence decisions. Attackers may also compromise interfaces, API calls, tools, services, data sources, other agents, or credentials.
• Unique credentials are necessary for every user, agent, and agent-created sub-agent. Each identity should receive only the privileges required, only when those privileges are needed, with access removed afterward instead of being granted permanently in anticipation of possible future use.
• Static credentials embedded in source code are prohibited under the proposed approach. Passwords and API keys should be kept in a vault that supports controlled credential checkout, credential renewal, just-in-time access, role-based access control, and strong authentication rather than permanent secrets inside applications.
• An AI gateway or firewall can provide inspection across the agentic system. It can examine incoming prompts for injection attempts, review agent outputs sent to tools, identify improper calls, detect information leaving systems when it should not, and block activity that fails established security checks.

Questions & Answers

Q: How can zero trust secure autonomous AI agents?

Zero trust can secure autonomous AI agents by verifying identities before granting trust, issuing privileges only when needed, and applying least privilege to every user, agent, and sub-agent. Controls should extend throughout the system rather than remain at the network perimeter. Security teams should also assume a breach has occurred, inspect agent activity, protect sensitive data, and limit agents to verified tools, APIs, databases, and data sources.

Q: What zero trust principles apply to AI agent security?

The applicable principles are verification before trust, just-in-time access, least privilege, pervasive security controls, and the assumption of breach. Verification establishes that an actor or resource is what it claims to be. Just-in-time access limits how long privileges remain available. Pervasive controls protect internal components as well as the perimeter, while breach assumptions guide designs that restrict attackers who may already be inside.

Q: Why do AI agents create additional security risks?

AI agents create additional risks because they do more than produce responses. They can call APIs, use tools, purchase items, move or write data, and create sub-agents. These abilities expand the number of interfaces, credentials, services, and data sources exposed to attack. Their autonomous operation also requires stronger supervision, particularly when an agent uses multiple non-human identities or delegates work to newly created agents.

Q: How should non-human identities for AI agents be managed?

Every agent and agent-created sub-agent should have a unique non-human identity with controlled, visible, and narrowly limited privileges. These identities should be stored in a protected system and governed at least as carefully as human accounts. Access should be issued just in time and withdrawn after use. This approach helps manage identity proliferation while supporting supervision of agents that operate without continuous human direction.

Q: Why should AI agent credentials be stored in a vault?

A vault keeps passwords, API keys, and other credentials outside the agent's code and supports dynamic credential management. Agents can check credentials in and out, receive newly created credentials over time, and obtain privileges only when required. The vault can also enforce role-based access control and strong authentication. This avoids static secrets embedded in applications, which the transcript identifies as an unacceptable programming practice.

Q: What attacks can target an agentic AI system?

An attacker can use direct prompt injection to break an agent's context and redirect its behavior. Other attacks can poison policies, preferences, training data, or the model itself. Attackers may also insert themselves into interfaces, compromise an MCP-style call, attack APIs, databases, tools, data sources, services, or other agents, and steal credentials to create accounts or increase their privilege level.

Q: How can organizations control which tools AI agents use?

Organizations can maintain a tool registry containing verified versions of approved APIs, databases, data sources, tools, and related services. Agents should use these vetted resources instead of unreviewed alternatives. The purpose is to ensure that the components feeding or supporting agent actions are trustworthy. Inspection controls can then examine the inputs sent to these tools and identify calls that violate established security requirements.

Q: What does an AI firewall or AI gateway inspect?

An AI firewall or gateway can inspect prompts entering the system, including possible prompt injection attempts, and review outputs or calls moving from an agent to tools and services. It can determine whether an input should be allowed, identify improper tool calls, and detect information leaking from systems when it should remain protected. When activity fails these checks, the inspection layer can block it.

Summary & Key Takeaways

• Zero trust requires verification before trust, just-in-time access, least privilege, pervasive controls, and an assumption that a breach has already occurred. These principles replace excessive standing permissions and perimeter-only defenses with access that is narrowly scoped, temporary, continuously controlled, and designed to limit damage after an attacker enters the system.

• Agentic systems expand the attack surface because agents can call APIs, use tools, move or write data, and create sub-agents. Threats can target prompts, models, policies, preferences, interfaces, services, credentials, and non-human identities. Security must therefore cover the complete path from sensing and reasoning to credentials and actions.

• Applying zero trust to agents requires unique identities, dynamic credentials, controlled privilege, vetted tools, registered interfaces, protected data, and supervision of autonomous behavior. Credentials should remain outside application code and be managed through a vault. An AI gateway or firewall can inspect prompt inputs, tool calls, improper outputs, and possible information leakage.