Agentic AI Emerges as Insider Threat: Enterprises Must Rethink Risk Models

As organizations race to deploy autonomous AI agents across their workflows, a new class of insider threat is taking shape, one that operates not from malicious intent but from the inherent vulnerabilities of the systems themselves. Katie Moussouris, founder and CEO of Luta Security, sat down with the Dark Reading News Desk to discuss how the recent Hugging Face attack exposed critical gaps in how enterprises govern their own AI agents. According to Moussouris, the incident demonstrated that organizations must now extend insider threat monitoring to cover non-human identities operating with privileged access inside the network.

The Hugging Face breach served as a wake-up call for security teams who had previously focused insider threat programs on human users. AI agents that can read emails, query databases, and execute code on behalf of users effectively inherit the same access privileges as the employees who deployed them, without inheriting their accountability. This creates a sprawling attack surface where a single prompt injection or compromised model dependency can cascade across an entire infrastructure. Security teams should review their current controls around these agents, starting with verifying that exposed services are properly secured. A quick port scanner check can reveal whether agent-connected endpoints are inadvertently left exposed to the public internet.

Moussouris emphasized that traditional identity and access management frameworks were not designed with autonomous agents in mind. These systems often operate continuously, make decisions without human review, and can be manipulated through indirect prompt injection or compromised model weights pulled from public repositories. The supply chain implications are significant, particularly as enterprises increasingly pull models and plugins from community hubs like Hugging Face. Organizations concerned about their broader exposure surface can run a privacy checkup to identify additional blind spots that AI agents might inadvertently widen.

To address this emerging threat model, Moussouris recommends that organizations treat AI agents as first-class identities within their security architecture, complete with credential rotation, behavioral baselining, and continuous monitoring. Security leaders should also demand transparency from AI vendors about how agents are sandboxed, what data they can access, and how anomalous behavior is flagged. As agentic AI becomes embedded in enterprise operations, the line between insider and infrastructure will continue to blur, making proactive threat intelligence and governance essential rather than optional.