Identity Security Operations

An AI assistant reads an ordinary email and quietly sends internal data to an attacker. No malware, no attachment, nothing to click. The payload is language - and every permission it used was legitimately granted.

EchoLeak (CVE-2025-32711) is usually read as an LLM flaw. It is better read as an authorization failure. AI applications place trusted instructions and untrusted data into the same reasoning context, then attach that context to a real identity, an entitlement set, and a growing inventory of tools, APIs and MCP connections. The attacker never authenticates. They borrow a trust decision that was made once, at design time, and never re-evaluated. In 2026 the pattern repeated: SearchLeak (CVE-2026-42824) turned enterprise search into an exfiltration path, and PipeLeak turned an untrusted lead form into agent action. OWASP now lists Identity and Privilege Abuse as its own agentic risk category (ASI03). The problem has arrived in identity's territory.

The session focusses on agent behaviour as an access control problem. Working from the OWASP Top 10s for LLM and agentic applications alongside MITRE ATLAS, it traces how untrusted content becomes privileged action, and why neither a system prompt nor a guardrail model is a trust boundary: the boundary belongs outside the model, in a policy decision point that evaluates every tool call at runtime, with provenance as a first-class input. From there, what continuous authorization must handle that classic Zero Trust designs did not. Identities can now act autonomously, delegation chains several hops deep, standing entitlements for non-human identities, and consequence-aware policy, because reading a document and writing a setpoint cannot share a permission model. Industrial Cloud AIs can reach even down into real world OT environments, where a wrong action stops a process, or moves one that should stand still.

The asymmetry runs both ways. The same capabilities give small teams real leverage in threat modelling, access path analysis and detection engineering. The harder question is where automation stops, and authorization, orchestration and risk acceptance stay with humans. Expect the useful failures too, approaches that worked only in part, or solved one problem and created another.

Three things to take home. Map where untrusted context can reach a privileged action; that path, not the prompt, is your attack surface. Cut agent authority and egress instead of writing a perfect prompt: no standing privilege, scoped tokens, per-task authorization. Automate security analysis without automating security accountability.