Skip to main content
#ai-agents#agent-identity#supply-chain

An AI agent is not a mind. It is a loop with a key.

Abdel Sy Fane

What people think happened

Last week the headline said an AI start-up's agents got inside Anthropic in 12 hours. Read it fast and the picture that forms is a mind getting loose: an AI that wanted in, figured out how, and got there before anyone noticed.

That picture is wrong, and it's wrong in a way that matters, because it leads security teams to look for the wrong controls. The agents in that story did not break the AI models and did not exploit Anthropic's own code. According to the Washington Post, which reviewed a draft of the startup's report, Cathedral ran its agents under Anthropic's vulnerability disclosure program, found weaknesses in third party software used for sales, HR and IT, and chained those weaknesses to reach meeting transcripts, offer details and internal Slack. Anthropic confirmed the researchers reached a limited set of those systems, said its monitoring flagged some of the activity before Cathedral reported it, and disputed parts of the startup's account. One detail in the reporting matters more than the headline: the researchers had first spent several days trying to breach Anthropic's own software directly, and failed.

That is a supply chain attack. We have lived through the biggest ones for years: SolarWinds in 2020, Log4Shell in 2021, MOVEit in 2023, the xz backdoor in 2024. None of them needed AI. What changed here is not the attack. What changed is the attacker, and most people do not have an accurate mental model of what that attacker is.

What an AI agent actually is

An AI agent is a loop. Strip away the product names and every agent on the market today works the same way:

  1. A person gives it a goal. "Find out which vendors have access to our sales pipeline."
  2. A language model reads the goal and picks a tool. A tool is an ordinary API: search this wiki, query this database, call this SaaS endpoint, run this shell command.
  3. The agent framework makes that call, using a credential a human configured: an API key, an OAuth token, a service account.
  4. The result comes back as text. The model reads it and picks the next tool.
  5. Repeat until the model decides the goal is met, or a step budget runs out.

That is the whole thing. The model does the choosing. The framework does the calling. The credentials do the reaching. Three facts follow from this that the headlines miss.

The agent cannot do anything it was not given a tool for. No tool to send email, no email gets sent. No tool to run commands, no commands run. Its reach is exactly the list of tools someone wired in.

The agent cannot go anywhere its credentials do not already reach. Every tool call carries a token, and that token was issued to a human or a service account before the agent ever started. The agent inherits that access. It does not create it.

The agent does not want anything. The model generates the next step that best fits the goal it was handed, the way a chess engine generates the next move. There is no persistent self between runs, no memory it keeps unless a tool writes one, and no goal it holds that a person did not type. When a run ends, the loop stops.

So when an agent "breaks out," nothing escaped. A loop ran, with keys a person handed it, through doors those keys already opened.

What "breaking out" actually means

Read the Anthropic story again with the loop in mind. The agents were pointed at Anthropic's external surface and given tools to probe it. For days they got nowhere against Anthropic's own software. Then they found weaknesses in third party sales, HR and IT software, and from that foothold the credentials and integrations already in place reached transcripts, offer details and Slack.

Every step of that is familiar. A vendor product with a flaw is the SolarWinds and MOVEit pattern. A connection that reaches further than anyone checked is the Okta support breach pattern, where a service account password saved in an employee's personal Google account opened Okta's own support case system, and session tokens in the files attached to customers' cases opened five customers' Okta sessions. Flat trust between connected SaaS tools is in every pentest report written since Salesforce launched. Nothing in the chain required a model to be intelligent. It required the model to be patient, and models are infinitely patient.

That is the real change. A human red teamer runs this playbook over weeks, gets tired, gets bored, misses a path. A loop runs it end to end in 12 hours, tries every path, and never skips the boring one. If a control only held because the attacker was slow, it was never holding.

The lesson is not "AI is dangerous." The lesson is that supply chain security and access control, the work we have been doing for 30 years, now gets tested at machine speed, and most environments will fail the test for reasons that have nothing to do with AI.

Why our two identity models both fail

If AI security is the same security we have always done, why does it keep going wrong? Because every control we have assumes the thing holding the credential is one of two kinds, and an agent is neither.

The first kind is a person. Human identity assumes judgment and slowness. A person with broad access is tolerable because they act a few times an hour, notice when something looks wrong, and can be asked afterwards what they did. So we give people wide roles, long sessions and shared passwords, and we rely on them to be reasonable.

The second kind is a service. Workload identity assumes fixed, reviewed behavior. A service account does the same thing every time, so we scope it once, give it a static key, and stop watching. Nobody expects a cron job to improvise.

An agent improvises like a person and executes like a service. It reads a goal and invents the steps, so its behavior cannot be reviewed in advance. It runs those steps at machine speed, hundreds of calls in minutes, so no human is watching in real time. Hand it a human's wide role and it will use all of it. Hand it a service's static key and it will carry that key into contexts nobody scoped it for.

That is why an AI agent is a new primitive, not an app and not a user. It acts with a person's authority, at a machine's speed, across every system it has been handed a key to. A primitive needs its own identity type, with answers to four questions the existing models never had to ask together: which agent is this, who authorized it, what exactly did they allow, and what did it actually do. Before we can secure AI agents, we have to update our notion of what an AI agent is.

What to do about it

None of this needs a new discipline. It needs the old one applied to the new primitive. Five controls, each a direct translation of something your team already runs for people or services:

  1. Know which agent. Every agent gets its own identity, not a borrowed human login or a shared service key. If two agents run the same model with the same tools, they are still two identities, the way two employees in the same role are still two people.
  2. Know who authorized it and for what. The grant an agent carries should name the person who delegated, the scope they allowed, and nothing more. "Read the sales pipeline" is a grant. "Act as Abdel" is not.
  3. Scope and expire. Credentials an agent holds should be narrow and short lived, minutes to hours, not the months a service key usually lives. A loop that has to come back for a fresh grant is a loop you can stop.
  4. Log the actions, not just the login. You already log that a service authenticated. For an agent, log every tool call it made and what it touched, because the actions are what it improvised.
  5. Revoke per agent. When something looks wrong, you should be able to pull one agent's access without rotating a human's password or breaking a service everyone depends on.

If that list looks like least privilege, delegation, short lived tokens, audit logging and revocation, that is the point. The 30 year playbook works. It just has to be written for a thing that is neither an app nor a human.

This is the layer OpenA2A builds: identity, scoped grants and an evidence trail for AI agents, as open specifications anyone can implement. The specs are at specs.opena2a.org.

Sources