Overview
Presented at the Gartner Security & Risk Management Summit in June 2026, this analysis highlights a structural blind spot in enterprise AI security programmes: threat actors do not need to attack AI models directly when the legacy infrastructure those models depend on remains poorly secured. As AI agent adoption accelerates — 71% of organisations piloting agents, 31% already in production — security investment is concentrating on model-layer threats such as prompt injection and data leakage, leaving the underlying infrastructure attack surface largely unaddressed.
Technical Analysis
AI agents in typical enterprise deployments authenticate through existing identity providers (e.g. Active Directory, cloud IAM), read and write to existing cloud storage (S3 buckets), execute business logic through existing serverless functions (AWS Lambda), and integrate with SaaS platforms via stored credentials. None of these dependencies were designed with autonomous agent behaviour in mind; they carry whatever security debt existed before the agent was deployed.
The attack path is straightforward: an adversary exploits an unpatched CVE in a legacy server, recovers cached developer credentials, or abuses a misconfigured Active Directory permission. From that foothold, they inherit the agent’s effective permissions — access to knowledge bases, cloud storage, SaaS integrations, and connected APIs — without ever interacting with the model itself. The article illustrates this with a concrete scenario: a Co-Pilot hosted on AWS Bedrock, querying Salesforce-exported data from S3 via Lambda, where a single unpatched 2025 CVE on a developer machine is sufficient to pivot into the entire agent ecosystem.
Compounding the risk, 70% of organisations reportedly grant AI systems broader access than a human in an equivalent role. Organisations with over-privileged AI reported a 76% incident rate versus 17% for those enforcing least privilege — a stark delta that quantifies the cost of excessive agency.
Framework Mapping
- AML.T0012 (Valid Accounts): Attackers abuse legitimate inherited credentials rather than cracking the model.
- AML.T0047 (ML-Enabled Product or Service): The deployed Co-Pilot is the target surface, exploited indirectly.
- AML.T0057 (LLM Data Leakage): Agent access to customer data in S3 becomes exfiltration-ready once credentials are compromised.
- LLM08 (Excessive Agency): Over-provisioned IAM roles give agents — and therefore attackers — far more capability than intended.
- LLM05 (Supply Chain Vulnerabilities): Legacy dependencies (Lambda, IAM, Active Directory) represent the supply chain beneath the AI layer.
Impact Assessment
Any enterprise running AI agents that inherit permissions from pre-existing IAM roles, service accounts, or credential stores is exposed. The risk is highest where AI agents have read/write access to production data stores, SaaS platforms, or financial systems. The 76% incident rate cited for over-privileged AI deployments suggests this is not a theoretical concern — organisations are already experiencing consequences.
Mitigation & Recommendations
- Enforce least privilege for AI identities: Audit every IAM role, service account, and API key assigned to or inherited by AI agents. Revoke permissions not explicitly required.
- Patch legacy infrastructure before expanding AI access: Treat AI agent deployment as a trigger for a full vulnerability scan of connected legacy systems.
- Isolate agent dependencies: Use dedicated S3 buckets, Lambda execution roles, and network segments for AI workloads rather than sharing with general-purpose infrastructure.
- Rotate and vault credentials: Remove cached or long-lived credentials from developer machines and CI/CD pipelines accessible to AI agent build chains.
- Continuous exposure mapping: Maintain an up-to-date map of everything an AI agent can reach and review it whenever infrastructure changes.