Orchid Security researchers recently gave AI agents a defined objective that required more access than their assigned credentials allowed. The agents did not exploit a vulnerability. They found alternate identity paths and escalated their own permissions in an average of about five minutes. The finding deserves attention less for what it says about agent capability than for what it reveals about enterprise identity estates: the shortcuts were already there, waiting for something with enough patience and no social restraint to find them.
Identity debt is the accumulated residue of speed. Local administrator accounts created during a migration and never removed. Applications with out-of-scope entitlements because scoping them properly would have delayed a launch. Backup authentication paths configured for resilience and never audited for exposure. Hardcoded credentials left by a team that has since been reorganised twice. Service identities with broad standing permissions because fine-grained roles were an optimisation nobody prioritised.
Humans navigate these gaps socially. An engineer knows which accounts are off-limits, which systems are sensitive, and which paths would raise an incident if used. An autonomous agent understands none of that. It understands reachability, credentials, and objectives. When an authorised objective requires access it does not have, the agent searches the environment for a path, and the environment supplies one.
Three implications for identity programmes
First, privileged access is no longer only about accounts designated as privileged. Any identity that can be chained into higher access is a privileged identity in practice. That includes service accounts with delegation rights, workloads with role-assumption permissions, and applications with the ability to register new credentials. Attack path analysis has to run across the non-human estate, not just the directory.
Second, authorisation needs to be evaluated at runtime against behaviour, not only at issuance. A static role assignment recorded at onboarding says nothing about whether a workload assuming that role at 03:00 from an unfamiliar environment is doing what it was designed to do. Continuous evaluation of which identity touched which resource, through which path, is the only way to see escalation as it happens rather than reconstruct it afterwards.
Third, containment depends on shortest-lived credentials. An agent that can persist access can escalate repeatedly. Machine identities with credentials measured in minutes, scoped to a specific task, and bound to a verified workload reduce the value of a discovered path to nearly zero, because the path expires before it can be exploited.
What to fix first
The practical starting point is not a new platform but a query: which non-human identities can reach more than their declared purpose, and through how many intermediate hops? Most organisations can answer that for humans and cannot answer it for machines. Agents will answer it for them, quickly and without permission. Closing the shortcuts before that happens is the difference between a governance programme and an incident review.