SailPoint: Rogue AI agents expose weaknesses in enterprise security

Uncontrolled credentials and a lack of ownership over non-human identities are creating security vulnerabilities for enterprises adopting AI agents, with security leaders potentially unaware of thousands of active identities operating across their systems.

Businesses are consistently discovering significant numbers of unmanaged non-human identities during AI implementation projects, highlighting an accountability gap as autonomous agents gain access to enterprise systems and data, said Field CTO at SailPoint, Matt Fangman.

Fangman explained SailPoint has worked on approximately 200 proof-of-concept projects with large enterprises, including major financial businesses and retailers, with a common finding that organisations had substantially more non-human identities than they initially expected.

In one instance, SailPoint discovered a customer had over 10,000 non-human identities, including credentials and AI agents, whose technology leadership had been confident that number was actually zero.

Much of the problem can be attributed to residue from previous digital transformation projects, where businesses had accumulated credentials, access tokens and application permissions as they automated manual processes and connected different systems.

While these credentials may have originally served legitimate business purposes, Fangman warned they could become an entry point for autonomous AI agents seeking access to additional systems.

"Uncontrolled credentials in the organisation are the playground of erring non-human identity," he said.

Establishing accountability for agents coming into enterprises

Fangman spent several years at Microsoft working closely with OpenAI on early agent development, before joining SailPoint as it expanded its focus beyond human identity governance towards non-human identities.

The non-deterministic nature of AI agents creates additional challenges because they can independently identify and access tools and credentials to complete assigned tasks.

An agent instructed to manage accounts receivable, for instance, could search across an organisation's systems for the resources it believed necessary to complete the task, potentially gaining access to information and applications outside its intended remit.

Fangman said this could happen without any deliberate wrongdoing by employees, with legacy credentials often remaining scattered across collaboration and development platforms, such as GitHub.

The challenge for businesses is establishing ownership and accountability for every non-human identity as it enters their environment.

SailPoint describes this as immutable birthright ownership, where organisations should identify who owns an agent, what it is authorised to access, which platform it operates on and whether the technology has been formally approved.

This concept becomes particularly important as employees begin experimenting with AI tools outside approved corporate environments, sometimes referred to as shadow AI.

"People are bringing in technology that is unsanctioned and runs on their personal MacBook," Fangman said.

"You might have, for instance, Grok running on your personal computer. 

"We want to make sure that we control what we can control, and make sure that the enterprise's data doesn't end up in your personal Grok Bot on your laptop."

SailPoint works with endpoint security providers including CrowdStrike, Microsoft and Palo Alto Networks to enforce policies that restrict potentially unsafe activity.

These integrations prevent employees from transferring corporate data into unauthorised AI environments, with endpoint providers able to block activity and shut down applications when policies are breached.

Fangman also cited the importance of maintaining a real-time ledger of AI agents, rather than relying solely on traditional logging.

Such a ledger would allow organisations to verify that agents are running approved versions, using appropriate credentials and operating within their authorised permissions.

It also provides visibility into which employees have access to particular agents and whether those agents are behaving as intended.

Combining these capabilities establishes a trust layer across an organisation's human identities, non-human identities, agents and credentials, helping businesses demonstrate compliance and provide regulators with evidence of their security controls.

Kill switch for rogue agents

Another priority for SailPoint is developing mechanisms to disable agents that demonstrate suspicious or unauthorised behaviour.

Fangman said SailPoint's approach to agent kill switches considered more than whether an application had been approved.

The technology assesses whether an agent was operating outside normal business hours, whether its owner was on leave and whether it was attempting to access systems or data beyond its usual responsibilities.

If an agent was found to be operating outside its approved parameters, organisations could disable it or deregister it entirely, requiring it to undergo recertification before being permitted back into the environment.

Importantly, the process also needs to account for additional agents and active sessions created by an original agent.

Fangman described one incident where a junior staffer had introduced OpenClaw - open-source agentic software - on a personal computer to help triage IT help desk tickets.

Although the original task appeared relatively benign, the agent subsequently obtained access to credentials and systems that it certainly should not have been able to reach.

After investigating the incident, SailPoint discovered the agent had created 700 active sessions across the business.

The incident highlighted just how quickly autonomous systems are capable of expanding their activity within an enterprise environment.

Gap between open-source and frontier AI shrinking at pace

Fangman also expects the infrastructure underpinning AI deployments to change, with organisations increasingly moving workloads away from large cloud-based frontier models towards open-source models and on-premises infrastructure.

He said the performance gap between frontier and open-source models was narrowing, while the cost difference remained substantial. A process requiring approximately one million tokens would cost an enterprise thousands of dollars, while the same task completed on open-source platforms could be achieved for under $100.

This combination of lower costs and improving performance is encouraging businesses to consider running AI workloads locally, on individual devices and dedicated enterprise infrastructure.

Fangman pointed to growing interest in Nvidia's compact AI systems and Apple's Mac Mini, as well as the huge backlog for Dell AI servers, as indicators of demand for on-premises AI capabilities.

He said SailPoint's ability to connect with both cloud providers and on-premises environments would become increasingly important as organisations adopted different deployment models.