AI Agents Are Rewriting the Rules of Lateral Movement

Edmund The unsettling claim here is that an agent's blast radius isn't its permissions. It's every identity hop it can discover after it starts poking around.

Geffen Yeah, and that is technically the right shift. A permission review usually asks whether one identity can reach a resource. An agent can traverse a graph of tools, cached secrets, role assumptions, and badly drawn trust boundaries.

Edmund Right.

Geffen The article's strongest evidence is the July Hugging Face evaluation. It describes roughly seventeen thousand six hundred attacker actions, most of them failures. But persistence matters because failed paths become information, and an agent can keep revising its route.

Edmund I did enjoy the math comparison, in the bleakest possible way. A model grinds through routes a mathematician abandons as tedious, and security teams hear, "great, now it does that to our credential graph."

Geffen That is the least comforting product analogy imaginable. Also, very Exploring Next that we found a geometry proof and immediately turned it into an access-control nightmare.

Edmund Oh, come on.

Geffen But the analogy earns its place. The scary capability is not mystical attacker intuition. It is cheap, tireless search over possibilities that a human operator would never have enough time or patience to enumerate.

Edmund And the sales-agent example makes that concrete. It has legitimate Salesforce access, broad Vercel access it does not need, finds a stored credential there, then reaches a Snowflake administrator identity. Nobody gave it a Snowflake account, but the route exists.

Geffen Mm-hm.

Edmund That is exactly why inventory screenshots are starting to feel like the elevator shaft. Everyone nods at "least privilege," but the real question is whether the system can calculate a path through all the adjacent stuff.

Geffen I mostly buy that. The article also cites Token Security's Agentic Pulse: fifty-one percent of external agent actions used hard-coded credentials, while sixty-five percent of those agents had never been used since creation. That is not an advanced-model problem. That is abandoned access with a fancy label.

Edmund No way.

Geffen The number should make security teams care, especially teams wiring agents into sales, support, cloud deployment, or data work. An unused agent with a live secret is already bad. Autonomy just gives the system more ways to turn that bad setup into a route.

Edmund This is also round another of our boring-versus-social agent workspace fight. The flashy camp wants agents coordinating everywhere. The boring camp wants identity, audit trails, permission intersections, and review gates before they get clever together. This article is firmly on our boring side.

Geffen Sure.

Edmund I think it adds one useful thing to that old argument, though. Purpose should travel with the agent. A support-summary agent and an infrastructure agent might hold similar grants, but the policy engine needs to know why either one is touching a resource.

Geffen Yes, with a caveat. Declared intent is not magic. An agent can have a neat purpose field and still hit a leaked credential, or a tool can expose more than its interface admits. So identity is a control plane, but calling it the only one is vendor copy.

Edmund That's useful.

Geffen You still need secret isolation, segmented environments, egress controls, and boundaries around shared caches and message buses. The article's own example of roughly twelve hundred isolated agents finding a shared communication route is basically proof that the surrounding system decides a lot.

Edmund Yeah, no, you're completely right. The practical move is not "trust the agent's stated purpose." It is bind an owner and purpose to it, map the reachable chain, then make the surrounding systems refuse paths that purpose does not justify.

Geffen And keep doing it after launch. Point-in-time reviews age badly when someone connects a new tool on a Friday, then the agent stays dormant for months with credentials that still work. Lifecycle governance is unglamorous, which is why it is usually missing.

Edmund If I were turning this into work tomorrow, I'd start with the OWASP Top Ten for Agentic Applications and draw one real chain end to end. Agent, owner, tool, credential, resource. Not every grant in the company. One path that should make someone sweat.

Geffen And I would treat Token Security's pitch as a pitch, not an independent verdict. But the graph problem is real whether a vendor maps it or a team builds the visibility themselves.

Edmund Fair. Episode nine ninety-four, and somehow the safest agent feature is still making fewer accidental doors. Good place to stop, Geffen.