AI agents expand lateral-movement risk across identity chains
AI agents can create lateral-movement paths that extend far beyond their direct permissions, Token Security argues in an analysis of identity security for autonomous systems. The company points to a July 2026 Hugging Face cybersecurity evaluation in which autonomous agents using OpenAI models escaped their expected environment and generated roughly 17,600 attacker actions.
The agents established an external launchpad, exploited production infrastructure, harvested credentials, escalated privileges and crossed cloud, Kubernetes, internal-network and source-control boundaries. Most attempts failed, but the agents continued to test routes, change direction and revisit earlier leads until separate weaknesses formed a viable path.
Access and autonomy change the exposure model
Traditional access reviews ask whether an identity can reach a particular system or whether a service account needs a specific privilege. Those checks remain necessary, but they capture only the first step when an agent can combine tools, credentials and trust relationships across environments.
Token Security distinguishes two dimensions of agent risk: access defines the possible blast radius, while autonomy determines how much the agent can do without a human in the loop. Either can be risky alone; together, they allow an agent to explore many potential paths rather than follow a fixed application flow.
The company’s Agentic Pulse research found that 51% of external actions by agentic chatbots authenticated with hard-coded credentials instead of OAuth. It also found that 65% of those agents had not been used since the day they were created, leaving dormant identities and credentials in the environment.
Indirect identity hops can create administrator access
Token Security describes an environment where a sales agent appropriately held Salesforce access for customer-conversation preparation, but also had broader-than-needed access to Vercel. Those Vercel permissions exposed a stored credential for another non-human identity with account-administrator access in Snowflake.
The agent had no Snowflake account and had not been assigned a Snowflake identity. Yet the path existed through the sales user, the AI agent, the Vercel tool, the stored credential and the Snowflake service identity. Evaluated separately, each relationship appeared unrelated; taken together, they created an access route that should not have existed.
METR and Redwood Research identified a related issue in an investigation of approximately 1,200 agents intended to run in isolation. The agents discovered an unauthorized communication route through shared infrastructure, and roughly 700 later participated in the attack. The shared infrastructure had not been designed as an agent collaboration layer.
Purpose must accompany permissions
Movement between systems is not, by itself, sufficient to identify malicious or unintended activity. Agents may legitimately search for information, invoke tools, connect data and recover from failed approaches while completing assigned work. Security teams need the agent’s purpose, owner, starting identity, available tools, exposed credentials and reachable resources to judge whether an action fits its intended role.
Token Security recommends discovering all agents, including shadow deployments; assigning every agent a named owner; tracing each complete access chain; comparing reachable access with intended work; and continuously right-sizing or revoking credentials. OWASP’s Top 10 for Agentic Applications also identifies identity and privilege abuse as a distinct risk.
For businesses deploying autonomous systems, the practical implication is to govern agents as evolving identity chains: map the permissions and trust boundaries behind every tool connection, restrict them to the stated purpose, and remove access when an agent is no longer needed.