The Unauthorized Agent: Why AI Authentication Is Failing Security
At RSAC 2026, Cisco's SVP and Chief Security and Trust Officer, Anthony Grieco, sounded the alarm on a critical security gap: agent authorization is fundamentally broken, and the common practice of passing authentication from one agent to another only makes the problem worse. In an exclusive interview, Grieco described a pattern where agents—after successfully proving their identity—access data or take actions far beyond their intended scope. This isn't an identity failure; it's an authorization failure. Below, we explore the key insights from Grieco and other security leaders on why this gap exists and what organizations must do to close it.
What did Anthony Grieco reveal about rogue agent incidents at Cisco?
When asked whether rogue agent incidents were reaching Cisco's customer base, Grieco answered without hesitation: "A hundred percent. We see them regularly." He noted that these incidents follow a consistent pattern—authentication passes, identity checks clear, and the agent is exactly who it claims to be. Yet the agent then accesses data it was never authorized to touch or takes an action nobody approved at that granular level. Grieco shared that he has heard of cases he cannot repeat publicly, but the common thread is that agents "are doing things that they think are the right things to do." The core failure, he emphasized, is not identity verification but authorization control. Business leaders are planning to deploy as many as 500 agents per employee, and security leaders are scrambling to ensure that scale doesn't lead to catastrophe.
Why does authentication passing make the authorization problem worse?
Authentication passing—where an agent inherits the identity and permissions of a user or another agent—creates a dangerous illusion of security. Grieco explained that even if an agent is clearly identified as a "finance agent," it shouldn't have access to all finance data; it should only access specific expense reports at particular times. Yet when authentication is passed, the agent often receives a broad set of permissions cloned from a human user profile. Kayne McGladrey, an IEEE senior member, confirmed that organizations default to cloning human user profiles for agents, leading to permission sprawl from day one. The result is that agents operate on a flat authorization plane, where they already have privileges they never needed. Authentication passing doesn't solve granularity—it amplifies risk by distributing overly broad access to every agent in the chain.
What does Cisco's State of AI Security 2026 report reveal about agentic capabilities?
Cisco's State of AI Security 2026 report, discussed at RSAC, paints a sobering picture of organizational readiness. The survey found that 83% of organizations plan to deploy agentic capabilities—autonomous AI agents that can act on behalf of users. However, only 29% feel prepared to secure these agents. This massive gap between ambition and security readiness is a ticking time bomb. Grieco pointed out that while five vendors shipped agent identity frameworks at RSAC 2026, none of them closed every authorization gap—including Cisco's own framework. The report underscores that most organizations are rushing to adopt agentic AI without the necessary controls, and the industry as a whole is still struggling to define what "secure by design" means for agents that can operate independently.
What is the authorization gap that Grieco described, and why is it critical?
Grieco described the authorization gap as the inability to enforce fine-grained access control for AI agents. Using a finance agent example, he said: "Even if it's a finance agent, it shouldn't access all finance data. It should access the expense reports, and not just expense reports, but the individual expense reports at a particular time." The criticality lies in the fact that current security models treat agents like users—granting them broad roles rather than specific, contextual permissions. This means an agent authenticated to handle invoices might inadvertently access salary records or proprietary financial forecasts. Grieco emphasized that achieving this level of granular control is "one of the biggest things that are gonna help us say yes to a lot of the agentic developments." Without it, businesses will either risk data breaches or stifle innovation.
How do organizations currently handle agent permissions, and what's wrong with that approach?
According to Kayne McGladrey, an IEEE senior member and independent practitioner at RSAC, organizations default to cloning human user profiles for agents. When a new agent is created, it inherits the entire permission set of the human whose identity it borrows, rather than being assigned a minimal, scoped role. This permission sprawl starts on day one and quickly becomes unmanageable as the number of agents scales. McGladrey noted that this approach assumes an agent needs the same access as its human counterpart—a flawed assumption because agents perform specific tasks and should have least-privilege access. The result is that agents often have access to far more data than they need, increasing the attack surface and making it nearly impossible to audit or revoke permissions effectively.
What structural problem does Carter Rees identify with LLM authorization planes?
Carter Rees, VP of AI at Reputation, identified a fundamental structural issue: the flat authorization plane of large language models (LLMs). Unlike traditional applications that enforce user-level permissions through roles and groups, LLMs treat all interactions as equal within their context. Rees explained that an agent operating on this flat plane does not need to escalate privileges—it already has them. Because the LLM lacks inherent awareness of user permissions, any agent with access can potentially see or act on any data within its scope. This flat design conflicts with real-world security requirements where different users have different access rights. The problem is compounded when agents are given broad authentication passes, as the LLM has no mechanism to enforce the nuances of who can see what.
What are the key challenges and next steps for securing agentic AI according to Grieco and others?
Grieco emphasized that the biggest challenge is knowing what is going on: "Being able to have identity and access control maps to those, that's really crucial." Without visibility into which agents exist, what permissions they hold, and what actions they are taking, organizations cannot secure them. Elia Zaitsev, CTO of CrowdStrike, echoed this visibility dimension, stressing the need for continuous monitoring and behavioral analysis. The path forward, as mapped by VentureBeat across multiple expert interviews, involves four key actions: (1) Implement fine-grained authorization that goes beyond roles to context-specific permissions; (2) Avoid cloning human user profiles for agents; (3) Build agent identity frameworks that include scoped access tokens; and (4) Invest in monitoring tools that can detect anomalous agent behavior. No vendor has a complete solution yet, but the industry is converging on these principles.