By: Larry Kovalsky, Director, Federal Solutions Engineering, Netskope
In May 2026, the Cybersecurity and Infrastructure Security Agency (CISA) and the National Security Agency (NSA), together with Five Eyes partners, published the first guidance written specifically for agentic artificial intelligence (AI): Careful Adoption of Agentic AI Services. Its core instruction: before granting an AI agent access to data or systems, know exactly what that agent can reach, and revisit that inventory as its footprint changes. Agent permissions had mostly been governed by general zero trust principles applied after the fact. This guidance makes it explicit: knowing what an agent can reach is now a named federal security requirement, not an implied one.
Few agencies can currently produce that inventory on demand.
The stakes showed up months before the guidance did. In August 2025, attackers stole OAuth tokens belonging to Drift, an AI sales chat agent built by Salesloft and connected into customer Salesforce instances. Those tokens carried the same broad, rarely revisited access Drift used for its own workflows. The attackers used that access to exfiltrate data from more than 700 organizations, then mined it for further credentials. The Federal Bureau of Investigation (FBI) and CISA issued a joint advisory in September 2025. Nobody had to breach Drift itself. They only needed the access that already reached further than any single workflow required.
That kind of overreach has a name: authority drift. It is what happens when an AI agent’s permission footprint expands past what was originally approved, until no one can account for everything it can reach. It grows through inheritance, when an agent picks up the access of whatever system it connects to; through integration, when a developer connects it to a new tool that solves an immediate problem; and through convenience, since broad access is faster to configure than scoped access and nobody revisits it once the agent is working. No process evaluates the aggregate, which is why an agent’s footprint six months in can bear little resemblance to what was approved on day one.
The Blind Spot Behind Authority Drift
Part of why authority drift goes unnoticed is architectural. Continuous verification in zero trust deployments is tuned to reassess human signals: behavior, location, device posture, not what an autonomous agent does with access it already holds. An AI agent authenticates once, then acts on its own for the rest of the session, calling Application Programming Interfaces (APIs) and invoking tools with credentials that stay valid throughout, without generating a signal built to trigger a re-check. The risk shows up mid-session, in agent actions those checks were never built to interpret. Prompt injection is the clearest version: an attacker embeds instructions in a document or email that an agent reads and treats as legitimate.
Model Context Protocol (MCP) compounds the blind spot: MCP traffic doesn’t resemble the traffic most inspection tools were built to see, so a malicious connection can move through unnoticed, and an agency that can’t see that traffic can’t map what an agent is actually reaching.
Why CISA and NSA Felt the Need to Say This Now
The new guidance did not emerge in a vacuum. In November 2025, Anthropic disclosed that a Chinese state-sponsored group it designated GTG-1002 had used an AI coding agent to run a largely autonomous cyberespionage campaign against roughly 30 government and industry targets. The agent executed most of the operation on its own, with humans stepping in only at a handful of decision points, and lateral movement that would normally take a skilled attacker days happened in a fraction of that time, because the agent was already authorized to reach most of what it needed: an agent with more reach than its task required, the exact condition the new guidance is aimed at closing.
The Data Shows Agencies Aren’t There Yet
A May 2026 survey of 275 federal civilian and defense IT and security leaders, conducted by Market Connections and sponsored by Netskope, found that only 11 percent of agencies report AI fully integrated into their zero trust architecture, and just 24 percent report high or complete visibility into API-driven AI interactions, the channel through which agents act autonomously. Yet 78 percent agree that AI agents and tools should be treated as managed entities within a zero trust environment, not exceptions to it. That disconnect between near-consensus and 24 percent visibility is what the CISA/NSA guidance is now asking agencies to close, and what EO 14028 and OMB M-22-09 already require in principle: continuous verification before granting access, not a one-time approval that persists indefinitely.
Closing the Gap Takes More Than a Better Spreadsheet
A static inventory taken at deployment tells an agency almost nothing about an agent’s risk three months later. Meeting the new guidance takes three things working together:
- A current, continuously updated map of what each agent can actually reach, not what it was provisioned to reach at launch.
- Agents restricted to a fixed, defined set of tools and data sources rather than broad standing access, what OWASP calls least agency.
- An enforcement point that can scope access down without waiting for the next scheduled review cycle.
Skip enforcement and the first two just produce a report nobody can act on in time. Skip mapping and the rest is guesswork. Mapping also has to stay selective, or alert fatigue will undo it within a quarter.
Overexposed access like this usually surfaces because an attacker finds it first, not because a process was built to catch it in advance. Agencies now have federal guidance telling them to ask what their agents can reach before the next incident forces the question. Whether they can currently answer it is another matter.