--- title: AI Agents Security: Risks and Protection Strategies description: A comprehensive framework for securing AI agents treats each agent as a distinct security object defined by four properties: identity, credentials, tool... canonical: https://daily.dev/posts/ai-agents-security-risks-and-protection-strategies-cyzimgapb twitter:card: summary_large_image twitter:site: @dailydotdev og:type: website og:site_name: daily.dev og:title: AI Agents Security: Risks and Protection Strategies | daily.dev og:description: A comprehensive framework for securing AI agents treats each agent as a distinct security object defined by four properties: identity, credentials, tool... og:url: https://daily.dev/posts/ai-agents-security-risks-and-protection-strategies-cyzimgapb og:image: https://api.daily.dev/og/posts/cyZiMgapB.png og:image:alt: AI Agents Security: Risks and Protection Strategies og:image:width: 1200 og:image:height: 630 og:locale: en --- > ## Documentation Index > Fetch the complete documentation index at: https://daily.dev/llms.txt > Use this file to discover all available pages before exploring further. # AI Agents Security: Risks and Protection Strategies **[Orca Security Blog](https://daily.dev/sources/orca-security-blog)** · 14 min read · 1 upvotes · 0 comments ## Summary A comprehensive framework for securing AI agents treats each agent as a distinct security object defined by four properties: identity, credentials, tool access, and offboarding. Because agents choose tools at runtime rather than following fixed code paths, their permission sets cannot be derived from static code review, requiring least-privilege scoping, attribution logging that names the agent, human, and tool, and lifecycle discipline around issuance, rotation, and decommissioning. Provider-native identity systems from Microsoft (Entra agent identities), Google (SPIFFE-based Agent Identity with 24-hour X.509 certs), and AWS (Bedrock AgentCore) now issue short-lived, per-agent credentials that replace shared service account keys and support delegated authority via token exchange (RFC 8693). Practical guidance covers tool scoping, memory isolation, approval steps on high-impact actions, monitoring tool calls, data classification, adversarial testing, and governance records including deployment approval, audit evidence, ownership, and change review, with EU AI Act Article 12 making logging a legal requirement for high-risk systems. ## Full article daily.dev links to this article rather than hosting it. Read it at the original source: ## Questions this post answers ### Why is an AI agent not the same thing as a service account from a security standpoint? A service account performs a fixed set of operations, so its permission set follows from its code, while an agent decides which tool to call at runtime, so its permission set follows from what it might decide rather than what code review can enumerate. Both use the same credential type, but the bounding problem differs: agent permissions cannot be fully derived from source code inspection alone. _Teams weighing agent versus service-account permission models can track identity practices like this on daily.dev._ ### How do Microsoft Entra ID and Google Agent Identity issue credentials for AI agents differently from traditional service accounts? Microsoft Entra ID treats an agent identity as a special service principal with no credentials of its own, holding credentials instead on a separate blueprint object that acquires tokens on the agent's behalf. Google's Agent Identity assigns each agent a SPIFFE identifier and an X.509 certificate valid for 24 hours, stating that agent identities cannot be impersonated and don't allow developers to generate long-lived service account keys. _Developers choosing between cloud identity models for agents can follow these provider changes on daily.dev._ ### What is the correct order of steps to safely decommission an AI agent? Revoke before deleting: disable the agent's identity first and confirm its tokens now fail, then remove tool registrations, the memory store, and any object that could reissue a credential, and keep the audit records since the agent's history outlives the agent. Deleting the deployment first leaves a working credential with nobody watching it, which is where most offboarding failures occur. _Engineers planning agent retirement workflows can keep this decommissioning sequence handy via daily.dev._ ## Similar posts on daily.dev - [AI Agent Identity: How to Authenticate and Govern AI Agents](https://daily.dev/posts/ai-agent-identity-how-to-authenticate-and-govern-ai-agents-pii52p4wl) · Security Boulevard · 0 upvotes · 0 comments - [AI Agents Authentication: How Autonomous Systems Prove Identity](https://daily.dev/posts/ai-agents-authentication-how-autonomous-systems-prove-identity-ynnf7lwlb) · GitGuardian · 0 upvotes · 0 comments - [AI Agents Are Privileged Users; Who Is Auditing Their Access?](https://daily.dev/posts/ai-agents-are-privileged-users-who-is-auditing-their-access--gprca2dhv) · Dark Reading · 0 upvotes · 0 comments - [Securing AI agents: Key controls and best practices](https://daily.dev/posts/securing-ai-agents-key-controls-and-best-practices-0ktgagkrp) · CSO Online · 0 upvotes · 0 comments --- Tags: [#security](https://daily.dev/tags/security), [#cloud](https://daily.dev/tags/cloud), [#ai-agents](https://daily.dev/tags/ai-agents) [View this post on daily.dev](https://daily.dev/posts/ai-agents-security-risks-and-protection-strategies-cyzimgapb) ```json {"@context":"https://schema.org","@graph":[{"@type":"Organization","@id":"https://daily.dev/#organization","name":"daily.dev","url":"https://daily.dev","logo":{"@type":"ImageObject","url":"https://daily.dev/apple-touch-icon.png","width":180,"height":180},"sameAs":["https://twitter.com/dailydotdev","https://github.com/dailydotdev","https://www.linkedin.com/company/daily-dev-ltd"]},{"@type":"WebSite","@id":"https://daily.dev/#website","url":"https://daily.dev","name":"daily.dev","publisher":{"@id":"https://daily.dev/#organization"},"potentialAction":{"@type":"SearchAction","target":{"@type":"EntryPoint","urlTemplate":"https://daily.dev/search?q={search_term_string}"},"query-input":"required name=search_term_string"}}]} {"@context":"https://schema.org","@type":"TechArticle","headline":"AI Agents Security: Risks and Protection Strategies","url":"https://daily.dev/posts/ai-agents-security-risks-and-protection-strategies-cyzimgapb","mainEntityOfPage":{"@type":"WebPage","@id":"https://daily.dev/posts/ai-agents-security-risks-and-protection-strategies-cyzimgapb"},"datePublished":"2026-08-14T17:55:14.403Z","dateModified":"2026-09-13T19:57:19.961Z","description":"A comprehensive framework for securing AI agents treats each agent as a distinct security object defined by four properties: identity, credentials, tool...","image":"https://media.daily.dev/image/upload/f_auto,q_auto/v1/posts/9754b69c5ebf8b16e6a373cc8e7d772c?_a=AQAEuop","thumbnailUrl":"https://media.daily.dev/image/upload/f_auto,q_auto/v1/posts/9754b69c5ebf8b16e6a373cc8e7d772c?_a=AQAEuop","isAccessibleForFree":true,"articleSection":"Orca Security Blog","inLanguage":"en","publisher":{"@type":"Organization","name":"daily.dev","url":"https://daily.dev","logo":{"@type":"ImageObject","url":"https://daily.dev/apple-touch-icon.png","width":180,"height":180}},"author":{"@type":"Organization","name":"Orca Security Blog","logo":"https://media.daily.dev/image/upload/s--kkQFNboJ--/f_auto,q_auto/v1780213281/logos/orca-security-blog?_a=BAMAMiWQ0","url":"https://daily.dev/sources/orca-security-blog"},"commentCount":0,"discussionUrl":"https://daily.dev/posts/ai-agents-security-risks-and-protection-strategies-cyzimgapb","interactionStatistic":[{"@type":"InteractionCounter","interactionType":{"@type":"LikeAction"},"userInteractionCount":1},{"@type":"InteractionCounter","interactionType":{"@type":"CommentAction"},"userInteractionCount":0}],"keywords":"security,cloud,ai-agents","timeRequired":"PT14M"} {"@context":"https://schema.org","@type":"BreadcrumbList","itemListElement":[{"@type":"ListItem","position":1,"name":"Home","item":"https://daily.dev"},{"@type":"ListItem","position":2,"name":"Orca Security Blog","item":"https://daily.dev/sources/orca-security-blog"},{"@type":"ListItem","position":3,"name":"AI Agents Security: Risks and Protection Strategies"}]} {"@context":"https://schema.org","@type":"FAQPage","@id":"https://daily.dev/posts/ai-agents-security-risks-and-protection-strategies-cyzimgapb#faq","mainEntity":[{"@type":"Question","name":"Why is an AI agent not the same thing as a service account from a security standpoint?","acceptedAnswer":{"@type":"Answer","text":"A service account performs a fixed set of operations, so its permission set follows from its code, while an agent decides which tool to call at runtime, so its permission set follows from what it might decide rather than what code review can enumerate. Both use the same credential type, but the bounding problem differs: agent permissions cannot be fully derived from source code inspection alone. Teams weighing agent versus service-account permission models can track identity practices like this on daily.dev."}},{"@type":"Question","name":"How do Microsoft Entra ID and Google Agent Identity issue credentials for AI agents differently from traditional service accounts?","acceptedAnswer":{"@type":"Answer","text":"Microsoft Entra ID treats an agent identity as a special service principal with no credentials of its own, holding credentials instead on a separate blueprint object that acquires tokens on the agent's behalf. Google's Agent Identity assigns each agent a SPIFFE identifier and an X.509 certificate valid for 24 hours, stating that agent identities cannot be impersonated and don't allow developers to generate long-lived service account keys. Developers choosing between cloud identity models for agents can follow these provider changes on daily.dev."}},{"@type":"Question","name":"What is the correct order of steps to safely decommission an AI agent?","acceptedAnswer":{"@type":"Answer","text":"Revoke before deleting: disable the agent's identity first and confirm its tokens now fail, then remove tool registrations, the memory store, and any object that could reissue a credential, and keep the audit records since the agent's history outlives the agent. Deleting the deployment first leaves a working credential with nobody watching it, which is where most offboarding failures occur. Engineers planning agent retirement workflows can keep this decommissioning sequence handy via daily.dev."}}]} ```