Security teams have long focused on whether a given identity holds too much access. According to The Hacker News, AI agents are now pushing the field toward a different concern: how can defenders determine which paths an autonomous system can discover, given the access it already has?
The distinction matters because an AI agent is not a human user following a predictable workflow. A person might attempt a few approaches to finish a task, but an agent can systematically explore options and chain actions in ways that are harder to anticipate. That makes lateral movement less about static permissions and more about the reachable set of actions from a starting point.
The source notes that this is a harder question than the decades-old access review. It suggests that security teams need new methods for reasoning about what an agent can do with existing credentials, rather than only checking whether those credentials should exist at all.