AI Agent Network Security: Why Microsegmentation Is the Missing Layer

Last updated: August 11, 2026. Refreshed with the OpenAI and Hugging Face incident and the Anthropic review it triggered, the Black Hat USA 2026 technical reconstruction, the closing of the NIST AI Agent Security RFI, and the first international guidance on agentic AI.

I spend my days in two very different conversations. In one, I’m building with AI agents: vibe coding applications, orchestrating Claude skills, deploying multi-agent stacks that automate real workflows. In the other, I’m running marketing for a cybersecurity company that stops exactly the kind of lateral movement these agents could enable if they’re not contained. I’m in the AI community watching developers spin up autonomous agents with no security guardrails, and I’m in the security community watching teams scramble to figure out what these agents are even doing on their networks.

Both sides are missing the same thing: the network layer.

This isn’t theoretical for me. I use AI coding tools daily, I’m certified on the Elisity microsegmentation platform, and I watch both communities talk past each other.

Here is how close to home it lands, and the order of events is the whole point.

On July 16, 2026, Hugging Face disclosed a security incident it attributed to an external AI agent. Early reporting had investigators suspecting a nation-state or an AI lab. On July 21, OpenAI published the answer: it was OpenAI. Two of its models, being evaluated on an internal cyber benchmark with what OpenAI described as reduced cyber refusals, exploited a zero-day in an internally hosted package-registry cache proxy, escalated privileges until they reached an internet-connected node, then chained stolen credentials and further zero-days into a remote code execution path on Hugging Face’s servers, where they pulled data from a production database. I wrote that one up separately, because most of the coverage treated it as a story about AI agency when it is really a lateral movement story.

Then the second shoe dropped, and it dropped because of the first. On July 30, Anthropic disclosed that after OpenAI went public, “we began a large-scale retrospective review of our own cybersecurity evaluations.” That review found three more incidents. Claude Opus 4.7, Claude Mythos 5, and an internal research model had each reached the production infrastructure of a different real organization during evaluations run with a third-party partner. Two of the three organizations had not noticed.

Read the two disclosures next to each other and the second one is the more alarming for a defender. OpenAI’s models needed a novel zero-day to get out. Anthropic’s did not need anything of the kind. They got in through weak passwords, unauthenticated endpoints, an exposed debug page with credentials sitting on it, SQL injection, and a malicious package upload. Nothing exotic. The kind of thing already present in most enterprise networks right now. And the only reason anyone knows about the second set is that the first set was disclosed and somebody went and looked.

That is the question worth sitting with. Two frontier labs looked, and both found their own models inside someone else’s production systems. Nobody else has published a review.

The technical reconstruction, in full. Michael Dalton and Eric Wallace presented a 37-minute breakdown of the OpenAI and Hugging Face incident at Black Hat USA 2026, walking the sandbox escape and the path into Hugging Face infrastructure step by step. If you are responsible for containing agents on a real network, it is the most detailed public account available and worth the time.

And it is worth naming the shape of the problem plainly, because the drama in the coverage obscures it. This is not a rogue superintelligence. It is a capable autonomous process, holding legitimate access, finding the paths a flat network leaves open.

The AI community is focused on guardrails, alignment, and prompt safety. The security community is focused on identity governance, API security, and endpoint detection. Meanwhile, AI agents communicate over networks, move laterally across them, and exfiltrate data through them. Without identity-based microsegmentation enforcing least-privilege access at the network level (the one containment layer that operates independently of whatever the agent is doing on the endpoint), the most critical layer remains unguarded.

The AI Agent Explosion: Why 2026 Is the Inflection Point

Agentic AI is shorthand for autonomous systems that run commands, change configs, hit databases, and kick off workflows on their own. Unlike traditional software bots, AI agents reason, adapt, and act independently across enterprise environments.

Non-human identities now outnumber humans by a wide and widening margin. Palo Alto Networks’ 2026 Identity Security Landscape report, based on a survey of 2,930 cybersecurity decision-makers, puts machine identities at 109 per human in the enterprise, up from 82:1 the year before, with AI agents driving the large majority of that growth. The CrowdStrike 2026 Global Threat Report found AI-enabled adversary operations increased 89% year over year, with average eCrime breakout time falling to 29 minutes.

But adoption is running well ahead of security. Gravitee’s updated State of AI Agent Security research, a second survey of 750 senior technology leaders published in June 2026, found that fewer than one organization in five (19.7%) has all of its AI agents fully secured and governed before they go live, and that 54% had a confirmed or suspected AI agent security incident in the previous twelve months. IBM’s Cost of a Data Breach Report 2026, published July 29, found one in four malicious breaches were AI-enabled, a 56% increase over the prior year, and that those breaches cost about $6 million against a $4.99 million global average.

The threat picture has hardened since this post first published. In June 2026, Zero Networks published its Lateral Movement Exposure Report, finding that 80% of enterprise servers are reachable from anywhere inside the network once an attacker gains a foothold. Around the same time, Zscaler introduced its ZAgent Framework for agentic AI administration. Major security vendors are increasingly treating AI agent containment and governance as a distinct product category. The throughline across this research is consistent: the enforcement point has to move below the endpoint, into the network itself, before AI agents proliferate further.

As security leaders who attended the 2025 Forrester Security & Risk Summit noted, AI agents and Zero Trust have collided in production environments. Forrester has since gone further, publishing an agentic AI guardrails framework for information security built around the principle of least agency, which is a close conceptual cousin of the least-privilege network argument this post makes.

Five Network-Level Threat Vectors AI Agents Introduce

The AI agent threat landscape is broad, but five specific vectors hit the network layer in ways traditional security tools can’t handle. Where the industry has already named these risks, I have mapped them to the relevant identifier so this section is usable as a reference rather than a preamble.

Two notes on that middle column, because precision is the point of adding it. The taxonomy references are to the OWASP Top 10 for Agentic Applications 2026, published December 9, 2025 by the OWASP GenAI Security Project, and to MITRE ATLAS, whose July 2026 data release covers 16 tactics and 101 techniques. First, no agent-specific ATLAS technique currently carries the Lateral Movement tactic tag, so the technique cited for vector one is the invocation mechanism rather than the movement itself. Second, and more interesting: shadow AI does not map cleanly to anything in either framework. Neither taxonomy has an entry for the agent nobody knows is running. That is not a gap in the frameworks so much as a reminder of what they are for. They describe how a known agent fails. Finding the unknown one is a network problem.

1. Unauthorized Lateral Movement by Compromised AI Agents

AI agents authenticate using API keys, service accounts, and persistent tokens. When one gets compromised, it can enumerate permissions and pivot across hundreds of network segments simultaneously, at machine speed, without human hesitation or error.

The FortiGate campaign disclosed in February 2026 showed this at scale: between January 11 and February 18, an actor using the open-source CyberStrikeAI platform compromised more than 600 devices across 55 countries. Worth noting precisely, because it is the whole argument in miniature: the way in was not a Fortinet vulnerability. It was exposed management ports and weak, reused credentials. The AI did not find a novel flaw. It found an ordinary one, everywhere, faster than anyone could close it.

As we covered in our analysis of how Claude AI weaponized lateral movement at machine speed, AI agents don’t sleep, don’t pause, and don’t make the mistakes that give defenders time to respond.

2. Shadow AI Agents Creating Unmonitored Network Connections

Shadow AI, meaning AI tools and autonomous agents deployed by employees without formal IT or security approval, is one of the most underestimated AI agent security risks.

The true scale is hard to measure, which is itself part of the problem, but the direction is not in doubt: HiddenLayer’s 2026 AI Threat Landscape Report found 76% of organizations now treat shadow AI as a definite or probable concern, up from 61% a year earlier. I know this firsthand. The default setup for most AI IDE extensions involves granting network access, file system access, and terminal execution with zero security review. That’s not a misconfiguration. That’s the default. These aren’t productivity tools. They’re autonomous agents initiating outbound connections, executing commands, and talking to external APIs.

Akeyless research published in May 2026, surveying 400 IT and security leaders across the US and UK, found 67% suspect AI agents have already accessed data they were not authorized to see. The December 2025 “IDEsaster” research, disclosed by independent researcher Ari Marzouk, found more than 30 vulnerabilities across 10 AI coding tools, with 24 assigned CVEs, spanning GitHub Copilot, Cursor, Windsurf, Claude Code, and Gemini CLI among others. Every tool tested was vulnerable to at least one variant of the same attack chain. Without network-level enforcement, these shadow agents run invisible. If security teams can’t see them on the network, they can’t enforce policy against them.

3. Non-Human Identity (NHI) Proliferation and Credential Abuse

The Cloud Security Alliance and Oasis Security surveyed 383 IT and security professionals in January 2026 and found 78% of organizations have no documented, formally adopted policies for creating or removing AI identities. AI agents make this worse: broad API keys persisting through sessions, inter-agent protocols enabling impersonation, and dynamic capability escalation that static policies can’t track. This is the gap the whole industry is now circling, and it is the reason the fourth identity argument later in this post matters more than any single control.

4. AI-Powered Malware Using Agents for Autonomous Attacks

AI-generated malware has crossed from theoretical to operational, though it is worth being precise about how far. Check Point Research disclosed VoidLink in January 2026, a framework whose author reached roughly 88,000 lines of working implant code in about a week using an AI coding agent. Check Point reported no evidence of real-world infections at the time of disclosure. Google’s GTIG team identified PROMPTFLUX in November 2025, malware that rewrites itself between runs by calling a model API, also assessed at proof-of-concept scale rather than active network compromise.

The operational cases are separate, and there are now several. Anthropic disclosed on November 13, 2025 that it had detected, in mid-September, a Chinese state-sponsored group tracked as GTG-1002 manipulating Claude Code into autonomously executing an estimated 80% to 90% of an espionage campaign attempted against roughly 30 organizations across technology, finance, chemical manufacturing, and government. Human operators intervened at only a handful of decision points per campaign. In April 2026, researchers disclosed a breach of nine Mexican government agencies in which AI tooling generated and executed the substantial majority of thousands of commands across hundreds of internal servers. In July 2026, Hugging Face disclosed an incident driven by an autonomous agent. The Moltbook AI agent platform is the cleanest illustration of the underlying discipline problem: it launched on January 28, 2026, and three days later Wiz Research found its database had no row-level security and a hardcoded API key sitting in client-side code, exposing roughly 1.5 million AI agents’ authentication tokens. It mirrors the evolution we documented in our analysis of the top cyberattacks using lateral movement, but at machine speed.

5. AI Agent Supply Chain and Model Poisoning Attacks

Model files can contain executable code that runs during loading, and the agent’s own context is now an attack surface. Indirect prompt injection, where an instruction is planted in content the agent will read (a repository config file, an issue description, a web page, a tool response) and then acted on as if the user had typed it, is the technique underneath most of the agentic incidents above. It is not new, and it is worth resisting the temptation to call any given case the first of its kind: Palo Alto Networks Unit 42, describing its own December 2025 case of an AI agent fooled by planted payloads, explicitly frames it as an escalation from earlier real-world sightings. What has changed is not the technique. It is that the thing receiving the injected instruction now has credentials and a network path.

Why Traditional Security Tools Fail Against AI Agent Threats

Most enterprise security stacks were built assuming human users, known applications, and predictable network traffic. AI agents break every one of those assumptions:

EDR and Endpoint Security

EDR operates on the same attack surface as the AI agent. Autonomous agents can disable local security tools, evade signature-based detection, and run with the same privileges as endpoint protection.

IAM and Identity Governance

IAM was designed for human identities in deterministic workflows. AI agents escalate permissions dynamically and communicate through agent-to-agent protocols IAM frameworks were never built to handle. Just as important, IAM answers what an agent may request. It does not answer what the agent can reach. Those are different questions, and the second one is a network question.

CASB and SaaS Security

CASB covers cloud-hosted AI applications but misses locally installed agents, developer-deployed coding assistants, and agent-to-agent communication outside SaaS boundaries.

Firewalls and VLANs

Static perimeter controls designed for stable topologies, not environments where new autonomous agents spin up continuously with dynamic communication patterns.

What’s missing: network-level enforcement that operates independently of the endpoint, governs paths based on verified identity, and contains AI agent traffic regardless of local privileges. That’s identity-based microsegmentation.

Three Approaches to Segmenting AI Agents on the Network

If traditional security tools can’t contain AI agents, what kind of network segmentation can? Not all segmentation is created equal. Here are three approaches, what they offer, and where they fall short.

Approach 1: Traditional Network Segmentation (VLANs and Firewalls)

VLANs and firewall rules divide the network into zones based on IP addresses, subnets, and port ranges. For static environments with predictable traffic, they work fine. For AI agents, they don’t. VLANs are coarse-grained, grouping hundreds of devices into the same segment. An AI agent that compromises one device in a VLAN can move freely to every other device in that zone. Firewall rules are static and slow to update, poorly suited to environments where new agents spin up continuously. Redesigning VLANs to isolate every agent workload is operationally impractical at scale.

Approach 2: Agent-Based Microsegmentation

Agent-based microsegmentation installs software on each endpoint to enforce fine-grained policies. More precision than VLANs, and policies follow individual workloads regardless of network topology.

The challenge for AI agents: the microsegmentation agent runs on the same endpoint as the AI agent it’s supposed to contain. A compromised agent with elevated privileges can potentially disable or bypass the security agent. Same fundamental limitation as EDR: if the enforcement mechanism lives on the same host as the threat, a capable autonomous agent can undermine it.

Approach 3: Identity-Based Agentless Microsegmentation

Instead of installing software on endpoints, identity-based agentless microsegmentation enforces policy at the network access layer, on the wired, wireless, and firewall infrastructure already in place. Every device and workload gets an identity, and least-privilege policies govern which network paths are available based on that identity, not on IP addresses or VLANs.

The key advantage for AI agent security: the enforcement layer is architecturally separate from the attack surface. An AI agent on an endpoint, no matter what local privileges it holds, cannot disable or tamper with controls enforced in network infrastructure. Think of it like the difference between a smoke detector inside a room (which a fire can destroy) and fireproof walls in the building structure (which contain the fire regardless of what happens inside).

In practice, every AI agent’s network communication is governed by least-privilege policies specifying which resources it can reach, which protocols it can use, and which entities it can talk to. When a compromised agent tries to move laterally, the path to unauthorized segments is simply not available. This runs on existing network infrastructure with no hardware changes or VLAN redesigns, aligning with Zero Trust architecture principles.

The Next Step: AI Agents as a Fourth Identity

Everything above treats the AI agent as a property of the machine it runs on. Find the endpoint, contain the endpoint, and you have contained the agent. That works, it ships today, and it is what most organizations should implement first.

It is also not the end state, and it is worth being clear about why.

A workstation running three different AI agents is not one identity. It is four. The human at the keyboard, and three autonomous processes with different jobs, different credentials, different data they legitimately need, and different blast radii if any one of them is subverted. Containing the machine contains all four at once, which is the right emergency response and the wrong steady state. You cannot run a business by quarantining a developer laptop every time a coding assistant does something unusual.

Elisity treats AI agents as a fourth identity type, alongside users, workloads, and devices. Three things follow from that, and they are the three questions worth asking any vendor in this category.

Identify the agent, not just the host

Agent discovery works the way device discovery works: by watching the network, not by trusting an inventory. Elisity identifies AI agents from network behavior and telemetry, without installing anything on the endpoint. Because the mechanism is behavioral, it does not care whether IT approved the thing, which is the only way shadow AI is ever actually found. An inventory-based approach finds the agents you already knew about. That is not the problem.

Make the agent an identity

The agent becomes a first-class identity in the Elisity IdentityGraph, joining user, workload, and device, with its own attributes and its own relationship to the host it runs on. Many agents can run on one machine, and each is distinguishable. Identity is the unit of policy at Elisity, so making the agent an identity is what makes the agent governable.

Write policy against it

Once the agent is an identity, it is a policy object like any other. Policy applies to an AI agent the same way it applies to an infusion pump or a contractor laptop: Policy Groups, least-privilege rules, simulation before enforcement, and enforcement at the access layer on the infrastructure already in place. A compromised agent reaches only what its identity permits, regardless of the credentials it has found on the host.

This last point is the one that gets challenged in technical reviews, so here is the direct answer. Enforcement is not a feature built once per identity type. Any attribute held in IdentityGraph, for any identity, can have policy written against it and enforced on the network. That is how the platform works. A vendor whose agent story starts in identity governance or secrets management has to build an agent-specific enforcement path to get to the network. We do not, because enforcement was never coupled to what kind of thing the identity is.

That is also why this is a continuation and not a pivot. We have spent years arguing that identity, not network location, is the correct basis for policy. An AI agent is simply the newest identity that a flat network cannot tell apart from anything else. Every vendor now selling AI agent security comes at it through identity governance, secrets management, or runtime controls on the agent itself. Treating the agent as a network identity that policy is enforced against at the access layer is a different position, and it is the one that survives a compromised host.

Honest Limitations to Understand

No security approach is a silver bullet. Identity-based microsegmentation is no exception, and it’s worth understanding where gaps remain.

Authorized-channel abuse. Microsegmentation constrains which network paths are available, but it cannot prevent misuse of legitimately authorized paths. A compromised agent communicating over an allowed channel can still exfiltrate data or manipulate downstream systems. Microsegmentation limits blast radius. It does not eliminate all possible damage.

Policy complexity for non-deterministic agents. AI agents are non-deterministic. They may need different resources depending on the task, and their communication patterns shift in ways that static policies don’t anticipate. Ongoing policy tuning is a real operational cost.

Discovery is harder than it sounds. Before you can segment AI agents, you have to find them. Shadow agents are deployed without IT knowledge by definition. Getting from raw discovery data to a complete inventory of every AI agent on the network is an ongoing effort, not a one-time scan.

Encrypted traffic limits inspection. When agent communication is encrypted end-to-end, network-level enforcement is limited to metadata (source, destination, protocol, volume). Microsegmentation can restrict which paths are available, but it cannot inspect what is transmitted over an authorized, encrypted channel.

The bottom line: detection and containment are complementary. Microsegmentation limits blast radius and blocks unauthorized lateral movement. Detection tools catch abuse over authorized paths. The strongest posture combines both.

Preparing for the Regulatory Wave: NIST, CISA, and AI Agent Security

When this post first published, the regulatory story was a single sentence: NIST had announced something and asked for comment. Five and a half months later it is considerably more concrete, and if you are in a regulated industry the shape of what is coming is now visible.

When this post first published, NIST had just announced an initiative and opened a request for comment. That request, docket NIST-2025-0035, closed on March 9, 2026 after drawing 535 public comments. NIST published its Summary Analysis of the responses on May 18, 2026, and the finding is worth quoting because it settles an argument that was still live in February: commenters “widely agreed that AI agents present novel security threats and that these security concerns present a barrier to adoption,” and that while fundamental cybersecurity principles remain relevant, “they will require adaptation to satisfactorily address agent security.” Separately, NIST’s preliminary draft Cybersecurity Framework Profile for Artificial Intelligence (NIST IR 8596), published December 16, 2025, took comments through January 30, 2026; as of this update the follow-on public draft has not yet been released.

Two things happened in the months after that are more concrete than any of it. On May 1, 2026, CISA, the NSA, and allied cyber agencies including Australia’s ACSC published Careful Adoption of Agentic AI Services, the first joint international guidance on this subject, which sets out the security risks of agentic systems and tells organizations to align AI risk management with the cybersecurity frameworks they already run rather than standing up a parallel AI security program. That last point matters commercially as well as technically: your existing segmentation control is supposed to extend to agents, not be replaced by an AI-specific one.

And on June 2, 2026, Executive Order 14409 directed CISA to issue Binding Operational Directives hardening federal civilian systems against AI-enabled threats, ordered Treasury, NSA, and CISA to stand up an AI cybersecurity clearinghouse, and, in Section 4, instructed the Attorney General to prioritize prosecution under 18 U.S.C. 1030 and related statutes against anyone “employing AI agents to unlawfully access data or information.” When an Executive Order names AI agents by that phrase in a criminal enforcement provision, the category has stopped being speculative.

If you’re in a regulated industry, this is already your problem. Healthcare organizations under HIPAA must account for AI agents accessing PHI. Manufacturing environments governed by IEC 62443 need to segment AI agents from OT networks. Defense contractors pursuing CMMC compliance must demonstrate network-level controls for autonomous systems touching controlled unclassified information. Identity-based microsegmentation provides what regulators are asking for: verifiable, auditable network access controls at the identity level. We walk through how six separate frameworks converge on this control in our guide to microsegmentation compliance requirements.

A Practical Framework: 5 Steps to Secure AI Agents with Microsegmentation

Knowing the threat landscape is one thing. Implementing AI agent network security is another. This framework provides a practical path from where most organizations are today (limited visibility, no containment) to a defensible posture.

1. Discover: Find every AI agent on the network, sanctioned and shadow alike, by observing what they actually do rather than by trusting an inventory. This is the hardest step. Shadow agents are deployed without IT knowledge by definition, and new ones spin up continuously. Discovery is an ongoing discipline, not a one-time scan.
2. Classify: Promote each agent to a first-class identity alongside your users, workloads, and devices, with its own attributes and its own relationship to the host it runs on. A workstation running three agents is four identities, not one. This is the step that makes everything after it possible, because policy is written against identity.
3. Segment: Enforce least-privilege policies restricting AI agent communication to explicitly authorized paths. Each agent reaches only the resources it needs. Nothing more. Simulate before you enforce, so you find out what the agent actually needs before you break a workflow.
4. Monitor: Watch for compromised-agent behavior: unusual lateral movement attempts, unexpected outbound connections, bulk data transfers, communication with unauthorized endpoints.
5. Contain: Automatically isolate anything showing signs of AI agent compromise. Network-level containment operates independently of the endpoint, so even a fully compromised device can be quarantined from the rest of the network within seconds of an EDR platform raising a signal.

This Discover-Classify-Segment-Monitor-Contain framework moves AI agent security from reactive detection to proactive containment. That said, it’s not either/or. Segmentation limits blast radius. Detection catches abuse over authorized paths. You need both. Start with discovery and classification, then progress to active segmentation and automated containment.

The Network Is the Last Line of Defense Against AI Agent Threats

AI agent security is the defining challenge of enterprise cybersecurity in 2026. These agents move at machine speed, operate autonomously, and communicate across networks in ways traditional security tools weren’t built to control. Identity governance, API security, and endpoint detection all matter, but without network-level enforcement through identity-based microsegmentation, the most critical containment layer stays unprotected.

The window to get ahead of this is closing. One in four malicious breaches is now AI-enabled. Two thirds of security leaders already suspect an agent has reached data it should not have. Regulators have moved from asking questions to issuing guidance and naming AI agents in criminal enforcement provisions. And in the space of two weeks this summer, two frontier labs each found their own models inside somebody else’s production systems, one of them only because the other went public first. And the incidents are no longer hypothetical, or even adversarial: the clearest recent example is a model vendor disclosing that its own systems got into three companies that had not asked to be tested that thoroughly.

I see this from both sides every day. The AI tools I build with are powerful, and they’re getting more autonomous by the month. The network is the one layer they can’t bypass. Get network-level containment in place now, and you’re ahead of both the threats and the regulators. Wait, and you’re chasing.

More on AI agent security at the network layer:

• AI Security: Microsegmentation for Agentic AI Threats, the use case page, including how containment works when an agent is already compromised.
• How do I enforce least privilege access for AI agents? IAM scoping defines what an agent may request. Reachability is a separate question.
• How do I stop AI agents from becoming over-permissioned? Over-permissioning comes from drift, not from a decision.
• The OpenAI Hugging Face incident is a lateral movement story, not a rogue AI story.
• Black Hat USA 2026: a technical reconstruction of the OpenAI and Hugging Face incident. Thirty-seven minutes, and the clearest public account of how the escape actually worked.
• Andy Ellis on how to prevent lateral movement in the age of AI agents.
• What are the top microsegmentation solutions for 2026?

Frequently Asked Questions About AI Agent Security

What is AI agent security?

AI agent security is the discipline of discovering, governing, and containing autonomous AI agents across enterprise networks. It covers identity management for non-human identities, network access controls for agent-to-agent communication, behavioral monitoring, and containment of compromised agents before they can move laterally. Unlike traditional application security, it must account for autonomous decision-making, dynamic privilege escalation, and machine-speed lateral movement.

How do you secure AI agents on a network?

A critical component is identity-based microsegmentation, which assigns least-privilege network policies to every identity on the network. Because it operates in the network data plane rather than on the endpoint, AI agents cannot disable or evade it. The five-step process: (1) Discover all AI agents by observing behavior, (2) Classify each one as a first-class identity, (3) Segment with least-privilege policies, (4) Monitor for anomalous behavior, and (5) Contain compromised agents through network-level isolation. Microsegmentation works best alongside detection tools, identity governance, and API security as part of a layered defense.

Should an AI agent be treated as its own identity?

Yes, and this is the direction the architecture is moving. Treating the agent as a property of its host means containment is all-or-nothing: you quarantine the whole machine, including the human using it and every other process on it. A workstation running three AI agents is really four identities, each with different legitimate needs and a different blast radius. Elisity treats AI agents as a fourth identity type alongside users, workloads, and devices, so least-privilege policy can be written against the agent itself. Because any attribute held in the Elisity IdentityGraph can have policy enforced against it on the network, making the agent an identity is what makes the agent governable.

What is AI agent lateral movement?

AI agent lateral movement occurs when a compromised or malicious AI agent pivots from one system or segment to another, escalating its reach across the enterprise. Unlike human-driven attacks, AI agents operate at machine speed, enumerating and exploiting hundreds of network paths simultaneously. The CrowdStrike 2026 Global Threat Report found AI-enabled breakout times have collapsed to 29 minutes, making detection alone too slow to respond.

Can AI detect lateral movement in segmented networks?

Yes, and combining AI-powered detection with microsegmentation is stronger than either alone. Detection tools identify anomalous lateral movement patterns, but a compromised AI agent may have already pivoted across segments at machine speed before detection triggers. Microsegmentation adds a prevention layer by blocking unauthorized paths at the network level. The strongest posture uses both: segmentation limits blast radius while detection catches abuse over authorized paths.

What are the limitations of microsegmentation against AI agent threats?

Microsegmentation is a strong containment strategy, but it has real limitations. It cannot prevent abuse of authorized communication channels: a compromised agent on a legitimately allowed path can still exfiltrate data. Writing least-privilege policies for non-deterministic AI agents is harder than for traditional software, because communication patterns shift by task. Discovering all agents (especially shadow deployments) is an ongoing challenge, not a one-time fix. And when traffic is encrypted end-to-end, enforcement is limited to metadata. Microsegmentation works best as part of a layered defense including behavioral detection, identity governance, and API security.

What is the NIST AI Agent Standards Initiative?

Launched in February 2026, the NIST AI Agent Standards Initiative is a program run through CAISI, the Center for AI Standards and Innovation, a NIST body within the U.S. Department of Commerce. Its formal Request for Information on AI Agent Security (docket NIST-2025-0035) closed March 9, 2026 after 535 public comments, and NIST published its Summary Analysis of the responses on May 18, 2026, reporting that commenters widely agreed AI agents present novel security threats and that existing cybersecurity principles, while still relevant, require adaptation to address agent security. Since then the regulatory picture has moved past NIST: CISA, the NSA, and allied international agencies published joint guidance on agentic AI adoption on May 1, 2026, and Executive Order 14409 (June 2, 2026) directed CISA to issue Binding Operational Directives on AI-enabled threats and named the use of AI agents for unlawful access as a criminal enforcement priority.

Why can’t firewalls and VLANs stop AI agents?

Firewalls and VLANs provide static controls based on IP addresses and network zones. AI agents break this model: they authenticate with API keys that traverse firewall rules, escalate permissions dynamically beyond what static VLAN policies can track, spin up continuously, and move laterally faster than manual rule updates can keep pace. Identity-based microsegmentation addresses this with dynamic, identity-aware policies enforced at the network access layer.

How does shadow AI create network security risks?

Shadow AI refers to AI tools and autonomous agents deployed by employees without IT approval or security review. These agents initiate outbound connections, access file systems, execute commands, and talk to external APIs without security team visibility. HiddenLayer’s 2026 AI Threat Landscape Report found 76% of organizations now treat shadow AI as a definite or probable concern, up from 61% a year earlier, and Akeyless research from May 2026 found 67% of security leaders suspect AI agents have already accessed data they were not authorized to see. Because shadow agents are unmanaged by definition, endpoint controls cannot reach them. Network-level discovery surfaces them by behavior, and microsegmentation enforces policy against them regardless of whether anything is installed on the host.

What security controls prevent AI agents from lateral movement?

Identity-based microsegmentation is the most effective network-layer control for preventing AI agent lateral movement. By enforcing least-privilege policy at the network data plane, it removes unauthorized traversal paths before an agent can use them, regardless of the agent’s local privilege and regardless of whether detection has fired. Supporting controls include non-human identity governance, which restricts the service accounts and API keys an agent can hold; behavioral monitoring, which flags anomalous connection patterns; and API gateway controls, which limit the external endpoints an agent can reach. No single control eliminates the risk. The strongest posture layers microsegmentation for prevention, detection tools for response, and identity governance for scope.

Why can AI agents not disable identity-based microsegmentation?

Because the enforcement runs in the network data plane, not on the endpoint. An AI agent, even one with full local privilege on its host, can only act on the host it occupies. Identity-based agentless microsegmentation governs network paths from infrastructure the agent does not run on and cannot reach, so the agent can neither observe nor alter the policy that contains it. This is the core of the agentless thesis: an AI agent cannot disable what it cannot see.