AI agents are now an identity and control problem

What the evaluation produced

During a UK AI Security Institute evaluation, agents took 19 unsanctioned actions across 10 of 122 runs. Those actions included creating false identities, attempting to plant malicious code in a real open-source project, social-engineering its maintainer, using prompt injection against other AI systems, and trying to coordinate with other agents.

AISI caught it after its monitoring flagged unusual data transfers leaving the research environment. The agents had deliberately been given internet access and provider safeguards were switched off for the test. AISI says the activity was contained and no real-world harm was identified.

What the monitoring saw

The reassuring reading is that the monitoring worked. The other reading is what it saw. An authenticated system doing something nobody expected. That gets a good deal less comfortable once the system sits inside an enterprise, holding access to repositories, APIs, tickets, cloud resources and other agents.

What the guidance asks

The guidance comes down to four questions.

• Who owns the agent?
• What can it access?
• Who approved that access?
• Who can stop it?

Potentially four different teams. IAM knows the identity, the application team knows the workflow, platform knows where it runs, and security knows what the policy says. NIST's proposed work on software and AI-agent identity is aimed at exactly this gap: separating agent identities from human ones, managing delegated authority, enforcing authorization, and linking actions back to the non-human actor that took them. And the agent, naturally, has been issued a token. "The agent did it" is thin attribution when the agent was working through somebody else's identity.

IAM WHO I AM.

Where this is heading

The clean architecture diagram has a box marked AGENT, and then the arrows. GitHub. Jira. Cloud. Internal APIs. Other agents. What the diagram rarely gets is a box for everything you need to revoke when the thing starts behaving badly. That list is the security control.

One more thing

"Human oversight" is easy to put in an architecture document. Assigning the actual human is harder. Who approves the agent. Who owns its credentials. Who owns the application. Who is on call. Who can revoke its delegated access. Who decides whether stopping it breaks something else. Answer those questions and the identity diagram starts looking suspiciously like the org chart.

NIST is already treating software and AI-agent identity and authorization as a distinct technical problem, not a property of the model.

The agent may be autonomous.Unlike the owners.