Zero trust AI agents demand a different kind of security
In this interview, Chris Webber, VP, Product Marketing at Teleport, explains why zero trust principles need to change for AI agents. He covers how agents act fast, unpredictably, and continuously, and why old ideas like least privilege and point-in-time verification fall short.
Webber also discusses Teleport’s approach: trusted runtimes with zero starting privileges, and identity security that watches agent behavior in real time. He argues that security teams must move from spotting anomalies after the fact to enforcing rules at every step an agent takes.
Why is zero trust insufficient for agents?
Zero trust principles have been core to good identity hygiene and cybersecurity practice for well over a decade – and they remain as important for the human and machine identities they were designed around. Agents act in ways that were never considered as part of zero trust principles – fast like software, unpredictable like people, and able to operate continuously (some might say relentlessly!) to achieve a goal.
Zero trust starts with a critical concept: “Verify explicitly.” This verification has generally taken the form of discrete points of authentication. But these points are not enough when an agent can act anonymously, or impersonate a human, for example. This concept needs to evolve beyond point-in-time authentication, and beyond static permissions – instead extended into runtimes that architecturally enforce access, execution and communication boundaries for the agents, all based on unique identity.
Similarly “Use least privileged access” remains a valid and important concept for people and service accounts, but needs to evolve to govern collective behavior. A swarm of agents must be considered explicitly. Actions that are individually authorized at a single agent level can be collectively destructive. We need to set decision boundaries around what groups of agents can do, not just individual agents.
Zero trust’s third principle – “assume breach” – needs to be extended as well, to account for the possibility that agents may drift from their stated objective. This misalignment may indeed be due to attack techniques like goal hijacking or reward hacking, but can also result from benign misgeneralization or context shift over time. Regardless, the outcome is the same, whether by attack, error, or drift.
With these zero trust principles extended for agentic characteristics, we can define the operational tooling needed to govern this new class of actors.
What are some of the ways in which Teleport is innovating to deliver these agentic controls?
We can think of this in two ways: the architecture required to contain and control agents, which are Teleport Trusted Runtimes, and the monitoring and response required to act when needed, which are part of Teleport Identity Security.
To start, every agent must have a unique identity that is explicitly attestable to a human or platform. Those agents also must only operate within a trusted runtime – an environment that architecturally enforces boundaries for operational access, execution and external communication. When instantiated, that trusted runtime should have zero initial privileges, to ensure that any connection must be explicitly provided and every action is explicitly authorized.
That trusted runtime should also never persist any longer than needed. When the agent’s work is complete, or risk is identified – the runtime is fully expired. This prevents runaway agents, eliminates standing privilege, and destroys any stored data.
With that architecture in place, Teleport provides continuous monitoring to identify collective and individual agent risk as it happens. Every interactive action agents take is captured and assessed to flag risk and take appropriate action. Everything is evaluated against declared objectives, not in isolation, to immediately identify sessions that actually resulted in real risk, and then take the appropriate action – up to and including termination and destruction of the trusted runtime and the agent that was operating within it.
Why must security strategies shift from detection-based models to continuous, agent-level enforcement?
Identity Threat Detection and Response was never meant to address an agentic landscape. When identities could be proven to be a person or a service account, and permissions were expected to be enough to ensure least privilege, then ITDR tools just needed to watch for anomalies. But what happens when an agent is acting with the credentials of the human that invoked it? What about when that agent spawns 25 clones to complete a task?
In this new era, systems need to be designed for continuous enforcement – agents need to be uniquely identified, and explicitly controlled. Governance and execution now need to be inextricably linked, with the ability to capture objectives, identify whether actions are consistent with the objective, and intervene at machine speed rather than route for human review.
