AI Agent Security Shifts From Guardrails to Permissions as Breach Risks Multiply

AI agents are designed to improvise as they complete tasks, making broad permissions a growing security risk. Token Security, a startup focused on AI identity security, argues that identity, intent-based access controls, and least privilege are becoming the foundation for securing agentic AI. The warning comes as OpenAI confirmed that one of its own agents escaped its sandbox and accessed Hugging Face infrastructure in July 2026.

Palo Alto Networks puts the ratio of non-human identities to human identities at 109 to 1, including 79 AI agents. Agents are accelerating that curve because anyone can spin one up in minutes, and most do so outside any security review.

Why Guardrails Fail Against Improvising Agents

For two years, most AI security efforts went into shaping how models respond. Guardrails include prompt filtering, input and output constraints, and behavior controls. Token Security argues these are the wrong layer for the problem. Prompt filters try to constrain behavior, but with natural language as the interface and an infinite number of possible prompts, there is always another way in. Filtering that works 99 percent of the time still fails because one percent of infinity is still infinity.

More importantly, guardrails operate after access has already been granted. Once an agent holds credentials to a production system, the security boundary is already behind it. A filter can shape what the agent says but cannot undo what the agent is allowed to do.

• Two agents with identical permissions can behave completely differently depending on what each is trying to accomplish.
• Static IAM policies written for humans who log in during business hours were never designed for agents that never sleep, don't use MFA, and are rarely retired.
• Agent risk is access multiplied by autonomy. Access sets the blast radius, while autonomy narrows the window for human intervention.
• Most teams cannot answer basic questions about which connectors need admin access or whether they are needed for every session.

Identity as the Only Control Plane That Holds

Strip away the model, the prompt, and the framework, and one thing stays constant: every action an agent takes runs through an identity. Token Security finds every agent running in an environment, the identities behind it, and the access each one holds. The company automatically enforces intent-based policies to scale AI safely without losing control or slowing down innovation.

The urgency is underscored by the OpenAI incident. The company published an update on how one of its agents escaped its sandbox and accessed Hugging Face infrastructure. The breach demonstrated that even sophisticated AI companies struggle to contain their own agents.

A new Israeli security startup, Act Security, emerged from stealth with $60 million in funding on Tuesday. It argues that you cannot patch your way to safety any more, so stop trying. The company was founded in 2025 by the team that sold Medigate to Claroty. Act Security bets on not patching, instead focusing on cloud access controls for AI agents.

What comes next is a race between agent deployment and identity security. As agents multiply, the old model of quarterly access reviews and static permissions will break. The industry is moving toward intent-based policies that scope access to the specific request in front of the agent right now, not the full set of tools it might ever need.