Autonomous agents are moving out of the sandbox and into production workflows, and the security industry is only beginning to price the risk. New research reported by Intelligent CISO highlights growing concern about the security exposure created by self-directed AI agents, and the finding lands squarely on the desk of anyone responsible for privileged access management. An agent that can plan, call tools and act without a human in the loop is, functionally, a new class of privileged identity.
The problem: agents accumulate privilege faster than governance
Traditional privileged account security assumes a human behind the credential. Someone requests elevation, a session is brokered, activity is recorded and the entitlement expires. Autonomous agents break every one of those assumptions. They authenticate with long-lived API keys or service credentials, spawn ephemeral sub-agents, and chain tool calls across SaaS platforms and internal systems. The permissions they hold are frequently broader than the task requires, because scoping precisely is harder than granting broadly.
The result is privilege sprawl that no one explicitly approved. An agent configured to summarise tickets might also inherit write access to the ticketing system. An agent orchestrating cloud deployments may carry credentials for the CI pipeline, the container registry and the production cluster. When research points to rising risk from autonomous agents, the underlying mechanism is usually this: machine-speed action combined with human-scale oversight.
Where PAM has to change
The first requirement is identity for agents, not just for people. Every agent needs a distinct, attributable identity with an owner, a purpose and an expiry. Shared service accounts inherited from an earlier era of automation cannot provide accountability when something goes wrong, and they cannot be scoped to a single workload.
The second is just-in-time privilege for machine identities. Short-lived tokens, brokered per task, with the credential issued at the moment of need and revoked on completion, reduce the value of a stolen secret. This is standard practice for human administrators and should be the default for agents that hold equivalent reach. Session management must extend to cover machine sessions, including the tool calls and API invocations an agent makes on its own initiative.
The third is behavioural guardrails. Rate limits, allow-listed destinations, approval gates for destructive actions and anomaly detection tuned to agent behaviour all matter, because an agent will not pause to reconsider the way an experienced administrator might. Privileged access management platforms that treat agents as first-class identities, with the same discovery, entitlement review and audit trail as human accounts, will be the ones that keep autonomous automation defensible.
Governance questions before scale
Before expanding agent autonomy, security teams should be able to answer a short set of questions. Which agents exist, and who owns each one? What credentials does each hold, and are they rotated automatically? Which actions can an agent take without human approval? Where is the record of what it actually did last week? If any of those answers requires a manual spreadsheet exercise, the estate is not ready for broader deployment.
The research is a useful prompt rather than a verdict. Autonomous agents deliver real operational value, but the privileged access they require is exactly the access attackers most want to inherit. Treating agent identity as a PAM problem, with discovery, least privilege, session control and continuous review, is the practical way to capture the benefit without writing a blank cheque on the risk.