Security | Threat Detection | Cyberattacks | DevSecOps | Compliance

AI agent security is an identity problem, but it often starts as a secrets and credential problem. Do your AI agents operate using static API keys, tokens, and other reusable credentials? They might bypass traditional identity controls, creating a governance blind spot.

Netwrix's 2026 research found a 4x gap in breach rates between organizations where AI has significantly grown their identity count and those where it hasn't. Static credentials are AI’s easiest way in: passwords, keys, and tokens that never expire and never get checked. AI didn't invent the over-privileged credential, it just found the fastest way to use one.

As a CISO advisor, I am observing a familiar pattern gaining a new, critical dimension. What we historically identified as "Shadow IT", the use of unapproved SaaS and tools, is rapidly evolving into "Shadow AI." Employees are increasingly leveraging AI bots for drafting, analysis, code generation and strategic decision-making.

Most AI code review tools fail the same way. They work, in the sense that comments appear on the pull request. Then you read the comments and they are 80% “consider extracting this into a helper”, “missing test coverage”, “this variable name could be clearer”, and within a couple of weeks everyone has learned to scroll past anything the bot wrote. These are not false positives. They are true and irrelevant, which costs the same attention and is harder to argue with.

Three organizations had their production systems compromised by an AI model in April, and found out in late July when the model's developer called them. None of them had detected the activity. One was a security company whose own package scanner was the entry point. ‍ Anthropic published that account on July 30, nine days after OpenAI disclosed a related incident of its own.

The answer changed on a specific date. Until the start of 2026, most organizations were covered for AI losses by silence rather than by grant, because policies neither affirmed nor excluded AI and the question would have been argued at claim time. On January 1, 2026 the standard forms organization introduced generative AI exclusion endorsements for commercial general liability, and carriers began attaching them at renewal. ‍

Claude Code, Cursor, GitHub Copilot, and Gemini CLI are running on developer machines across your enterprise right now. They're browsing the web, writing to your filesystem, committing code to your repositories, and calling external APIs under the identity of your engineers. Most security teams have no visibility into any of it. This isn't a future problem.

Enterprise AI agents stopped being a pilot project a while ago. They read email, touch source code, operate browsers, and increasingly make decisions inside production systems, which means the security model built for chatbots and prompts no longer covers what is actually happening inside the enterprise. Black Hat USA 2026 turned out to be the week that gap became impossible to ignore.

Two weeks ago, we published the Agent Baseline alongside Docker and Keycard. In it, we describe six security outcomes, 35 controls, and an open reference architecture for running AI agents at the enterprise level. Last week, we stress-tested it: we took it to a panel at Black Hat and spent about one hour being asked hard questions about it. Play Video: Snyk x Docker x Keycard | Agent Baseline Panel @ Black Hat 2026 The most useful question came from someone who had actually already read it.