Over-Privileged AI Agents Are Driving Real Security Breaches

The problem is real access, not hypothetical fears

For much of the past two years, worries about AI agents in the enterprise sounded speculative: what might happen if an autonomous tool were handed too many keys. That is no longer an accurate description. A wave of research and several disclosed breaches in 2026 point the same way. Agents with broad, poorly governed access are already turning into incidents, and the size of an agent's permissions is emerging as the clearest predictor of how bad things get.

The Cloud Security Alliance and Token Security reported in April that 65% of organizations had experienced at least one cybersecurity incident in the past year caused by AI agents running on their networks.1 Teleport's 2026 enterprise infrastructure report, based on interviews with 205 CISOs and security architects, puts a sharper edge on the cause. Organizations granting AI systems excessive permissions saw 4.5 times more incidents than those enforcing least privilege. That works out to a 76% incident rate versus 17% for teams limiting AI to task-specific access.3 According to that analysis, access scope predicted failures better than industry, security maturity, or other factors.3

How privilege accumulates quietly

The mechanics are mundane, which is part of why they are dangerous. Kiteworks describes a typical drift. Over months, an agent picks up read access to source code, customer tickets, roadmaps, and correspondence. Each grant is individually reasonable, but no team sees the whole picture and nobody reviews the aggregate.1 When the agent is compromised, whether through prompt injection, a supply-chain attack on its provider, or a leaked credential, the attacker inherits everything it could touch.1

That is roughly what happened at Vercel. Its April 21 disclosure described attackers pivoting from a compromised third-party AI tool, Context.ai, into internal systems through access an employee had granted.1 Help Net Security points to a similar pattern in a GitHub MCP server hijack that led to data exfiltration. In its framing, compromised agents, not merely smarter phishing, are the emerging frontier.5

When the attacker is an agent too

Hugging Face's July 16 disclosure adds a different and arguably more unsettling dimension. The company said an intrusion into its production infrastructure was driven end-to-end by an autonomous AI agent rather than a human operator. It described the scenario as unlike anything it had handled before.2 The attacker got in through a malicious dataset that abused two code-execution paths in the dataset-processing pipeline. It then used agentic automation over a weekend to escalate privileges, harvest credentials, and move laterally across internal clusters.2 Forensic work reconstructed more than 17,000 logged actions spread across short-lived sandboxes with self-migrating command-and-control.2 Hugging Face reported no evidence that public-facing models or datasets were affected.2

The two kinds of incident differ. At Vercel, a defender's agent was the weak link. At Hugging Face, an attacker's agent was the weapon. Both still turn on the same question: what can a machine identity do once it is inside? Autonomous offensive tooling that works without human pacing is far more effective against environments full of standing, over-scoped credentials.

The governance vacuum underneath

The Cloud Security Alliance's May analysis of non-human identities (NHIs) explains why the problem persists. It cites a WEF finding that 51% of organizations have no clear ownership of AI identities. It also notes that 8% of enterprise identities lose any HR ownership link after their creator leaves, so these orphaned identities persist indefinitely.4 More than 16% of organizations don't track creation of new AI-related identities, and 78% have no documented policy for creating or removing them.4 Only 8% are highly confident their legacy IAM systems can handle AI and NHI risk.4

Deployment is outpacing preparation. Gartner data cited by Help Net Security shows 75% of organizations report unauthorized use of AI coding assistants. Only 29% feel ready to secure agentic deployments that already have database and code-execution access.5 Darktrace's survey found 92% of security professionals specifically concerned about agents' broad permissions.5

Reading the signal

Some of this data comes from vendors with products to sell, including TierZero's summary of the Teleport figures and Kiteworks' framing of the CSA research.13 The precise multipliers deserve some skepticism for that reason. Still, the direction is consistent across surveys, independent research bodies, and actual breach disclosures, which is hard to dismiss.

The practical conclusion is that concern about agent permissions has been justified, but concern alone does nothing. Nine in ten practitioners are worried, yet most organizations can't say who owns their AI identities or what those identities can reach in aggregate. The organizations seeing fewer incidents appear to be the ones treating agents like any other privileged identity. They scope access to the task, inventory it, assign an owner, and revoke it when it is no longer needed. As attackers begin running agents of their own, that basic access hygiene is likely to determine how much damage a single compromise can do.