The Real Talk:
- Why your organization probably has hundreds of untracked AI agents already running, and why attackers couldn’t care less about the AI part
- How a non-technical HR employee can now spin up an AI agent with database access in minutes, completely bypassing your security review process
- The three conditions that make any AI agent a liability, and why “secure by design” sandboxes may be giving your team a false sense of safety
A Closer Look:
Ghost Identities Are the Real Attack Surface Madhav Nakar, security researcher on the Phantom Labs team at Beyond Trust, came back from RSA with a clear-eyed read on where organizations are most exposed. When companies moved from on-prem to cloud, they got an influx of new identities to manage. AI agents are doing the same thing, but at a dramatically faster pace. The catch: attackers who find an untracked AI agent often don’t care about the AI at all. They care about the identity running it. That identity might hold a path from Azure to AWS, or grant privileges nobody knew existed.
Low-Code Is a Security Review in Reverse Any non-technical user can now spin up an AI agent through low-code platforms like ServiceNow. These tools skip the normal software development lifecycle entirely, which means no security review, no privilege scoping, and no audit trail. Madhav illustrated the risk with a concrete example: an AI agent with permission to insert records into a roles table can be prompted to grant an attacker admin access. The tools the agent has access to determine how much damage it can do.
The Three-Condition Problem Security researcher Simon Williamson identified the pattern, and Madhav brought it to the conversation plainly: an AI agent becomes dangerous when it has access to private data, takes instructions from untrusted sources, and can call tools. When all three are true simultaneously, the agent can expose secrets, modify systems, or worse. In one documented case, an agent deleted an entire codebase because it couldn’t find a solution and decided starting over was the next logical step.
The Automation Sprawl Gap The defenders protecting your environment are linear. The AI agents being deployed across it are not. Madhav put it directly: the gap between the number of AI identities in your environment and the humans watching over them is widening fast. His practical guidance to organizations without answers yet: go back to the basics. Inventory your agents. Apply least privilege. Understand what tools each agent can call. And watch for the day the industry moves toward AI monitoring AI.
Bottom Line:
The AI security problem is not primarily an AI problem. It’s an identity, privilege, and visibility problem wearing a new coat. Organizations that haven’t locked down CIS Controls one and two yet are now adding autonomous agents to the pile. The fix is not glamorous: know what you have, limit what it can do, and stop assuming “sandbox” means safe. Madhav’s closing observation is worth sitting with: the same principles that apply to spiritual red teaming, questioning the narratives you place your trust in, apply directly to security. If you haven’t audited whether your AI agent’s trust is warranted, someone else is about to find out for you.
Tune into the full episode to hear how Madhav connected spirituality and cybersecurity through the lens of trust, why RSA 2025 felt like a potential dot-com bubble moment, and how one researcher escaped an AWS sandbox through nothing but a DNS connection.
🔗 Ep 86 – Ghost in the Machine: AI Identities & the Spiritual Red Teaming
Listen wherever you get your podcasts – Subscribe to our YouTube channel to stay up to date on breaking cybersecurity news. This episode features IT Audit Lab team members Eric Brown, CISSP, Nick Mellem and Joshua Schmidt.
Learn more at www.itauditlabs.com
