SC Media • 1h
Securing AI Agents via Zero Trust and Non-Human Identity NHI Controls
Autonomous AI agents are vulnerable to Indirect Prompt Injection (IPI), where adversarial instructions embedded in third-party data—such as emails or web content—bypass probabilistic guardrails to execute unauthorized tool calls. This leads to "excessive agency," enabling credential theft, unauthorized data exfiltration, and lateral movement. Mitigation requires transitioning from linguistic constraints to deterministic Zero Trust architectures. By treating agents as Non-Human Identities (NHI), organizations can enforce granular OAuth scopes, utilize short-lived OIDC tokens, and implement hard Access Control Lists (ACLs) to isolate agentic workloads and prevent unauthorized API interaction.