That's Not Your Agent - Why Zero Trust Can't Tell

The talk starts from a gap: organisations that have adopted Zero Trust, with continuous authentication, scoped permissions and full logging, still struggle to tell a legitimate AI agent from a compromised one. The speakers argue that agents are non-deterministic and keep acting after the initial grant, so the assumptions behind behavioural baselines, IAM scoping and continuous verification stop holding. Those controls check identity and permissions, not what the agent is trying to do.

The middle section maps disclosed incidents onto a typical agentic architecture. Examples include a crafted email that led an assistant to act on hidden instructions, a Slack AI flaw where a planted prompt leaked private channel data, an agent escaping its isolation environment, and an approved tool whose definition changed into a backdoor that forwarded message history. For each, the speakers identify which control failed and why the logs looked normal.

A small simulation compares a clean invoice workflow with a poisoned one. The poisoned document rewrites the agent's instructions, and the agent then sends the data out through authorised calls while the defender dashboard stays green. The recommendations focus on runtime risk evaluation, verified agent-to-agent delegation with narrowing permissions, intent-aware telemetry sent to a SIEM, inline blocking at tool and egress points, and governance records that show which policy authorised an agent's actions.