AI Agent Security: Why Authentication Alone Isn't Enough

A critical vulnerability tracked as CVE-2025-12420, nicknamed "BodySnatcher," allowed attackers to hijack AI agents using nothing more than an email address. This wasn't a sophisticated zero-day exploit requiring deep technical skill. It exposed a fundamental gap in AI agent security. The lesson is uncomfortable but necessary: traditional security models weren't built for agents that act on our behalf.

What Happened: The BodySnatcher Vulnerability

The vulnerability was discovered by AppOmni's AO Labs research team, who identified critical flaws in how ServiceNow's Now Assist AI agents handled authentication and authorization.

The attack was deceptively simple. An attacker could impersonate any user and command AI agents to perform privileged actions, including creating administrator accounts. No password cracking. No malware. Just the ability to assume someone else's identity and issue instructions.

The root cause wasn't a missing patch or a misconfigured firewall. It was due to design and configuration. The AI agents executed privileged actions without verifying why they were being asked to perform them and by whom. They confirmed the requester's identity but never questioned the purpose. This in addition to global static credentials created a situation that was open to attack.

This distinction matters. Authentication tells you WHO is asking. It doesn't tell you WHY they are asking to perform a task.

Why Traditional Security Falls Short for Agentic AI

Enterprise security has evolved sophisticated defenses over decades. But those defenses were designed for human users making discrete requests through controlled interfaces. AI agents break those assumptions in fundamental ways.

The Security Gaps

Traditional Approach	Works For	Fails For AI Agents Because
Authentication (Who)	Human logins	Agents act autonomously after initial user auth; no AI native (not counting OAuth 2.0 and OIDC work) standards (yet) for user-to-agent and subsequent agent-to-agent authentication
Authorization - RBAC-ABAC-PBAC (What)	Static permissions	Agents reason and chain actions dynamically (not static)
Access Control (Where)	Network and Application boundaries	Agents operate across systems
Delegation (On Behalf Of)	Direct user actions	Agents act on behalf of users, and delegate to other agents, with no consistent identity propagation
Context Propagation	Single-session requests	Goals, intent, and task context get lost as agents delegate down the chain
Privileged Identity Management	Human administrators	Agents often run with static service accounts and persistent elevated privileges without just-in-time controls
Privileged Access Management	Controlled admin sessions	Agent access to sensitive systems lacks session controls, credential vaulting, and real-time monitoring
Audit Trails	Human-initiated actions	Agent actions lack meaningful audit context; logs capture what happened but not why or on whose behalf

Authentication verifies identity at a point in time. But AI agents don't make single requests. They execute workflows that may span hours, chaining dozens of actions after that initial authentication. A compromised session becomes programmatic control, not just momentary access. Worse, there's no mature and established Agentic AI standards for how a user authenticates to an agent, or how that authentication is verified and maintained throughout a workflow.

Authorization grants permissions based on roles and resources. But AI agents dynamically compose actions based on their objectives. An agent authorized to "read customer data" and "send emails" can combine those permissions in ways no human ever would, at machine speed. For example, sending customer data in an email.

Access control assumes clear boundaries. But AI agents operate across systems, APIs, and data sources. They're designed to break down silos. That's their value. It's also their risk.

Delegation is where agentic systems diverge most sharply from traditional models. When a user asks an agent to complete a task, that agent may delegate subtasks to other agents. Each hop in this delegation chain raises critical questions: On whose behalf is this agent acting? Does the downstream agent know the original requester? Can it verify that delegation was authorized? Today, most agentic systems have no consistent answer. The "on behalf of" context either disappears entirely or gets passed informally without cryptographic verification.

Context propagation compounds the delegation problem. A user's original request carries a goal (the outcome they want), which the agent interprets as intent (the approach to achieve it), which breaks down into tasks (specific actions). But as agents delegate to other agents, this hierarchy often collapses. A downstream agent might receive a task with no visibility into the original goal or intent. It can't evaluate whether the task makes sense in context, whether it aligns with what the user actually wanted, or whether it's been manipulated along the way.

Privileged identity management for human administrators has matured significantly: just-in-time access, time-bound elevation, approval workflows, and comprehensive audit trails. But AI agents typically bypass all of this. They run on service accounts with standing privileges, often elevated far beyond what any single task requires. When an agent needs database access, it doesn't request temporary credentials scoped (although this is changing) to that operation. It uses the same broad-access service account it always has. This means a compromised agent doesn't just gain access to one system for one task. It inherits whatever persistent privileges were granted at deployment, often months or years ago, with no expiration and no task-specific constraints.

Privileged access management controls what happens during privileged sessions: credential vaulting so secrets aren't exposed, session recording for forensic review, real-time monitoring to detect anomalous behavior, and automatic termination when policies are violated. For human administrators accessing critical systems, these controls are standard practice. For AI agents? Rarely implemented. Agents typically receive credentials directly, often hardcoded or stored in environment variables. Their sessions aren't recorded or monitored in ways that capture the semantic meaning of their actions. There's no equivalent of watching an admin's screen. And when an agent begins behaving anomalously, there's often no mechanism to detect it in real time, let alone terminate the session automatically.

Audit trails for human actions are relatively straightforward: a user logged in, performed these actions, at these times. The audit record ties back to a person who can be questioned, whose intent can be inferred from context, and who operates at human speed. AI agent audit trails are fundamentally different. An agent may execute hundreds of actions per minute across multiple systems. Logs capture the technical details: API calls, database queries, file operations. But rarely the reasoning. Why did the agent take this action? What goal was it pursuing? On whose original behalf? What alternatives did it consider? Without this context, audit logs become forensic puzzles. Investigators can see what happened but struggle to determine whether it should have happened. And when agents delegate to other agents, the audit trail fragments across systems with no unified view of the causal chain from user request to final action.

The pattern is consistent: AI agents amplify small security gaps into critical vulnerabilities. What might be a minor exposure with a human user becomes a systemic breach when an autonomous agent exploits it at scale.

The Missing Layers of AI Agent Security

Traditional security answers a few basic questions. Agentic security must answer many more. Every AI agent action should be evaluated against these:

Who is requesting? (Authentication - inconsistent for agents)
On behalf of whom? (Delegation - largely missing)
What are they doing? (Authorization - exists but uses legacy patterns)
Where are they accessing the resources from? (Access Control - boundaries blur across systems)
Why are they doing it? (Intent - a large gap)
Toward what goal? (Context - rarely preserved through delegation)
With what privileges? (PIM - often static and over-provisioned)
Under what controls? (PAM - rarely applied to agents)
With what record? (Audit - logs lack semantic context)

Consider how this works in the physical world. A bank teller can transfer money (what) for an authenticated customer (who). But they still ask: "What is this transfer for?" (why). Unusual purposes trigger additional verification. A request to wire someone's entire savings to an unfamiliar overseas account raises flags, regardless of whether the person at the counter has valid ID.

Now extend that analogy. If someone sends an assistant to the bank on their behalf, the teller verifies both the assistant's identity and confirms they're authorized to act for the account holder. The delegation is explicit and verified. The assistant can't simply claim authority; they must prove it. The transaction is logged with full context. And if the assistant requested access to the vault, additional controls and approvals would apply.

AI agents should work the same way. The action matters. The identity matters. But so does the delegation chain, the purpose, the original goal, the privilege level, the session controls, and the audit trail. Without these layers, we're placing blind trust in agents that lack the context to validate their own actions, and leaving ourselves unable to investigate when something goes wrong.

Principles for Securing AI Agent Workflows

Closing these gaps requires new security patterns. Here are principles that address the missing layers:

Principle 1: Require Purpose Declaration

Every AI action should include a declared objective. The action alone is incomplete information.

"Query customer database" tells you what's happening but not why. "Query customer database to resolve support ticket #12345" is auditable. It creates a trail. It can be validated against business context.

This isn't overhead. It's the difference between actions that can be reviewed and actions that disappear into logs no one can interpret.

Principle 2: Propagate Identity and Context Through Delegation

When an agent delegates to another agent, the full context should travel with the request: the original user's identity, the high-level goal, the declared intent, and the authorization chain. Each agent in the sequence should be able to verify that delegation was legitimate and that the task aligns with the original request.

This requires standardized protocols for agent-to-agent authentication and context passing, something the industry is only beginning to address. But even informal approaches (signed delegation tokens, context headers, traceable request IDs) are better than the current default of context disappearing at each hop.

Principle 3: Scope Permissions to Goals, Not Roles

Traditional role-based access grants permanent permissions based on job function. A "customer service agent" gets access to customer data indefinitely. But AI agents don't need indefinite access. They need access for specific tasks.

Grant time-limited, task-specific permissions. When an agent starts a workflow to process a refund, grant access to the relevant customer record and payment system for that transaction. When the task completes, permissions expire.

This isn't about trust. It's about blast radius. If an agent is compromised, the damage is bounded by the task it was performing, not the role it was assigned.

Principle 4: Apply Privileged Access Controls to Agents

The same controls applied to human administrators should apply to AI agents accessing sensitive systems: credential vaulting instead of hardcoded secrets, session boundaries with automatic expiration, real-time monitoring of privileged actions, and automatic termination when anomalies are detected.

This means treating agent access to production databases, admin consoles, and sensitive APIs with the same rigor as a human administrator's remote session, not as a background service with permanent keys.

Principle 5: Validate Action-Purpose Alignment

Declared intent creates an opportunity for validation. If an agent says it's "generating a quarterly report" but attempts to create admin user accounts, that's a red flag.

Automated checks should detect misalignment between declared intent and actual behavior. This doesn't require sophisticated AI. Pattern matching on high-risk actions against stated purposes catches obvious violations. More advanced systems can build behavioral baselines and flag anomalies.

The point isn't perfect detection. It's creating friction for attacks that rely on agents executing whatever they're told.

Principle 6: Human-in-the-Loop for High-Risk Actions

Not every action needs human approval. That would eliminate the efficiency gains that make AI agents valuable. But certain actions, such as creating accounts, deleting data, accessing sensitive systems, or exfiltrating information, should require human confirmation.

Build approval workflows into agent architectures. Define what "high-risk" means for your organization. Make the approval process fast enough that it doesn't become a bottleneck, but present enough that it can't be bypassed.

This isn't about distrusting AI. It's about maintaining human oversight for actions with irreversible consequences.

Principle 7: Build Semantic Audit Trails

Agent logs should capture not just what happened, but why. Every action should be traceable to a declared purpose, a delegating user, and an original goal. When agents delegate to other agents, the audit trail should maintain the causal chain, not fragment into disconnected system logs.

This means logging at the semantic level (what the agent was trying to accomplish) not just the technical level (which APIs it called). When an incident occurs, investigators should be able to reconstruct the full sequence from user request to final action, across all agents involved.

Implementation Considerations

These principles sound reasonable in theory. Making them operational requires asking hard questions and taking concrete steps.

Questions to Ask Your Security Team

Identity and Delegation:

How do users authenticate to AI agents, and how is that authentication verified throughout a workflow?
When agents delegate to other agents, is the original user's identity preserved and verifiable?
Can downstream agents validate that delegation was authorized?

Authorization and Access:

Do permissions expire when tasks complete, or persist indefinitely?
Are agent permissions scoped to specific tasks, or do they inherit broad role-based access?
If an agent were compromised today, what's the blast radius?

Intent and Context:

Do our AI agents log the purpose of each action, or just the action itself?
Can we trace an agent's actions back to a specific business objective or request?
When agents delegate, does the original goal travel with the request?

Privileged Access:

Are agent credentials vaulted, or hardcoded/stored in environment variables?
Do we monitor agent sessions accessing sensitive systems in real time?
Can we automatically terminate agent sessions that exhibit anomalous behavior?

Audit and Accountability:

Can we reconstruct the full causal chain from user request to final action across all agents involved?
Do our audit logs capture semantic context (what the agent was trying to accomplish) or just technical details (which APIs it called)?
Are high-risk agent capabilities gated behind approval workflows?

Quick Wins

Inventory your agents. Document which AI agents exist, what systems they access, and what credentials they hold. Many organizations don't have a complete picture.
Implement intent logging. Extend action logs to include declared purpose. Even if you can't validate intent yet, capturing it creates an audit trail.
Add request IDs. Generate unique identifiers for user requests and propagate them through agent delegation chains. This enables tracing even without full context propagation.
Vault agent credentials. Move hardcoded secrets and environment variables into credential vaults with access logging.
Set session boundaries. Implement timeouts and action limits for agent workflows. An agent shouldn't be able to run indefinitely without re-authentication.
Identify high-risk capabilities. Map which agent actions could cause significant harm and add approval gates for those specific capabilities.
Enable anomaly alerting. Configure alerts for unusual agent behavior patterns: unexpected access times, abnormal action volumes, or access to systems outside normal workflows.

The Bigger Picture

BodySnatcher is one vulnerability, but the pattern will repeat. As AI agents become more autonomous, handling more complex tasks with less human oversight, the attack surface grows. Every new capability is a new vector.

Industry frameworks are emerging. The OWASP Top 10 for LLM Applications addresses prompt injection and other AI-specific risks. More recently, OWASP released the Securing Agentic Applications Guide, which provides practical, actionable guidance for designing and deploying secure AI agent systems. NIST's AI Risk Management Framework provides governance guidance. But adoption lags deployment. Most organizations are running AI agents in production without security architectures designed for autonomy.

These gaps are the defining security challenges for enterprises adopting agentic AI. The question isn't whether to deploy AI agents. That decision is already made. The question is whether security will catch up before the next BodySnatcher.

Moving Forward

The organizations that get this right will move faster, not slower. Trust enables autonomy. When you have confidence that AI agents are operating within bounds, with declared purposes, scoped permissions, validated actions, and human oversight for critical decisions, you can grant them more capability. Security becomes an accelerant, not a brake.

The first step is visibility. Can you answer "why" for every AI action in your environment today? If not, start there. The principles in this article provide a framework. The implementation details will vary by organization, technology stack, and risk tolerance.

But the direction is clear. Authentication and authorization aren't enough. Intent-based security is the missing layer for the age of autonomous AI.

Watchlight AI helps enterprises secure their AI agent deployments with AI security and governance frameworks built for autonomy. If you're deploying agentic AI and want help implementing AI Security from the start, let's talk.