Over the past seven days, another enterprise deployed an internal AI agent. A credential was issued. Probably not by a human. The organization did not notice: the agent needed CRM access, so someone clicked approve. No expiration. No bounded scope. No audit trail mapping tool calls to business outcomes. This is not a hypothetical failure mode. It is the default deployment pattern for AI agents entering corporate networks in 2026.
The signal is unambiguous: AI is moving from chat to execution. The security stack, however, was built for human identities. State root mismatch. Trust updated.
The uncomfortable part: blockchain infrastructure already solved this problem, for smart contracts. The same non-human identity crisis DeFi faced in 2020 has arrived in the enterprise. Most companies are repeating the same mistakes, in the same order, with the same predictable outcomes.
The narrative is everywhere: AI agents are accelerating into intranets. Modern agent frameworks ship with tool calling, function execution, RPA connectors, browser automation, and MCP — the Model Context Protocol — as first-class features. The agent is no longer a chatbot returning text. It is an execution engine with an API key, a service account, and increasingly, write access to production systems.
The security impact is not the model's emergent capabilities. It is the identity, permissions, and execution power granted to the agent's runtime. This analysis sits on title-level signals only: no original code, no vendor disclosures, no incident reports. ⚠️ Verification incomplete. Confidence: D. The underlying security trend, however, earns a B in my assessment, because the infrastructure makes it structurally inevitable.
I spent 2020 dissecting the EVM, mapping every SLOAD and SSTORE while DeFi exploded. The parallel struck me immediately: smart contracts are the original non-human identities. They hold assets. They execute autonomously. They get drained. Enterprise agents are the same class of actor — with worse security hygiene.
Three variables determine the risk of any internal agent deployment. Deployment form: Copilot, RPA plus LLM, autonomous agent, or MCP client. Permission model: user delegation, service account, or independent agent identity. Execution capability: read-only, write-capable, approval-gated, or fully autonomous. Most deployments are fuzzy on all three.
Consider permission inheritance first. When an agent operates on a user's delegated token, the access scope is implicit. The agent acts within the user's rights — but those rights were designed for a human, not a script. Over-privileged credentials are the rule, not the exception. Service accounts with folder-wide permissions get reused across staging and production. The agent borrows the blast radius of an entire department.
Then prompt injection. It is the reentrancy of the agent era. Reentrancy drained millions in 2016 because an attacker could invoke an external contract mid-execution and trigger unexpected state changes. Prompt injection manipulates an LLM into issuing malicious tool calls through a trusted execution path. The payload arrives inside innocuous email content or a shared document. The agent reads it. The agent holds tool access. The state changes. No heat in the human threat model.
The mitigations are known. Tool call whitelists are access control lists. Sandboxes are gas limits. Human approval gates are multisig transactions. Comprehensive audit logs are event logs. Blockchains standardized these patterns a decade ago. Enterprise agent frameworks are only beginning to adopt them, and adoption is uneven.
Data exposure is the other half of the problem. An internal agent with mail, document, ERP, CRM, and code repository access expands the attack surface by an order of magnitude. Legacy DLP tools model data flows between humans. They do not model an agent's tool call chain, its write operations, or its lateral movement across linked systems. The attack surface is not a network diagram anymore. It is a dependency graph of permissions.
There is also an operational dimension. Security operations centers are being told to augment analysts with agents. Alert triage, log correlation, and initial response are the candidates. The irony is dense: the industry's first buyers of agent security are the teams generating the security incidents. A SOC staffed by agents that itself gets prompt-injected becomes an amplification engine, not a defense.
Compliance is the unaddressed variable. Regulations like the EU AI Act and national data security laws are beginning to define liability for automated decision-making. The incident attribution chain is unresolved: model vendor, agent platform, enterprise, or security provider? Blockchain's answer was auditable state transitions — every write is signed and attributable. Enterprise agent stacks have no equivalent primitive for proving which prompt produced which tool call.
The dominant narrative is fear of AI autonomy. "The agent went rogue." That framing is comfortable but wrong. The most likely failure mode is boring: permission sprawl, missing identity governance, and absent human oversight. These problems predate LLMs by a decade.
Traditional RPA and cron scripts have been abusing over-privileged service accounts for years. The AI wrapper is new; the access problem is not. Blaming the model lets the real culprits — bad IAM, missing audit trails, unclear ownership — escape scrutiny.
There is also an information-economy angle. This analysis itself rests on title-level fragments: no source transparency, no vendor names, no data. The tone of such reports — "the main battlefield has changed" — is classic vendor-led agenda-setting. A security category is being constructed before a proven product category exists. Which budgets get raided? IAM, DLP, CASB, SIEM. Legacy perimeter firewalls and VPNs lose relevance as agents render north-south traffic patterns meaningless. And the winners are already positioning: identity-layer platforms, AI gateways, non-human identity management. The losers will be legacy perimeter vendors who discover their hardware cannot see east-west agent traffic either.
Watch for the first publicly disclosed enterprise breach attributed to a prompt-injected internal agent. I expect it within 12 to 18 months. The follow-on signal: OWASP or NIST publishing agent identity guidance — the moment the category becomes auditable and budget lines appear.
Until then, the checklist is clear. Treat every agent as a first-class non-human identity with its own lifecycle: bounded scope, expiring credentials, tool-call whitelists, full logging. Minimum privilege is not a slogan. It is a lint rule.
Opcode leaked. Liquidity drained. The DeFi lesson was that autonomous actors without identity boundaries get exploited. The enterprise is about to re-learn it — with worse consequences.