Machine identities vastly outnumber human ones in a modern enterprise. According to Palo Alto Networks, roughly seven in ten of them are now AI agents.[1] Identity governance was built to manage people, but there is a real security gap in how it manages AI agents. This post argues that the control has to live in the file itself, not only in the identity reaching for it.
In 2025, researchers at Aim Labs found a flaw in Microsoft 365 Copilot that needed no click and no mistake from the user. An attacker simply sent an email with hidden text disguised as normal formatting. When Copilot processed that email as part of a routine task, the hidden text told it to search the user’s other emails and files, then send what it found back out.
Copilot had every right to read that data. It was doing its job, just following the wrong instruction from the wrong source. Researchers called this EchoLeak (CVE-2025-32711): an agent tricked into misusing access it was always allowed to have.[2] This post is about that problem. Not an agent that got hacked, but one that worked exactly as designed.
Meet Your Newest Insider
Insider threat programs have always assumed the insider is a person: someone with a badge, a manager, a login pattern that security tools can baseline. That assumption no longer fits most identities inside the enterprise. Palo Alto Networks’ 2026 Identity Security Landscape report puts the machine-to-human identity ratio at 109 to 1. Of those 109, 79 are AI agents. Palo Alto Networks projects agent identities to grow 85% over the next year, faster than growth in human identities.[3] This means the main threat to enterprises are no longer human.
Governance has not kept up. Kiteworks found that only 37% of organizations enforce purpose binding, and only 40% have a working kill switch. Among those already running agents in production, 23% have never tested the kill switch.[4] Agents are entering production far faster than the controls meant to govern them.
How an Agent Goes Rogue Without Anyone Stealing a Credential
The obvious agent risk is credential theft. GitGuardian counted 28.65 million new hardcoded secrets exposed on GitHub in 2025 alone.[5] But EchoLeak shows a harder problem: an agent’s own legitimate access becomes the attack surface, with no credential ever changing hands. Researcher Simon Willison named this the lethal trifecta: an agent that can read private data, is exposed to content it cannot fully vet, and has any way to send information back out is exploitable, no matter how carefully it is prompted.
A red-team study called Agents of Chaos spent two weeks testing agents with persistent memory, email, file systems, and shell access. Across eleven case studies, the failures kept returning to the same gap: agents have no reliable model of who they serve and no reliable model of their own limits.[6]6]
Why Purpose Binding and Kill Switches Aren’t Enough on Their Own
Purpose binding, credential rotation, scoped permissions, and kill switches are the right controls, and skipping them leaves an organization exposed well beyond agents. But each one assumes you can predict, in advance, the path an agent will take to reach a file. Purpose binding limits an agent to its intended task, but EchoLeak’s Copilot agent was doing its intended task when it leaked data. The injected instruction hijacked the goal, not the job description. A kill switch stops an agent once its behavior looks wrong, but it must do so within a tight time frame. CrowdStrike puts the average breakout time at 29 minutes, with the fastest case at a mere 27 seconds, and the 2026 CISO AI Risk Report found only 5% of security leaders are confident they could contain a compromised agent in time.[7] A kill switch that fires after the data is gone is an incident report, not a control.
Even analysts who name this gap tend to stop short of naming the fix. Forrester predicts an AI agent will cause a major enterprise breach in 2026 because legacy identity and access management cannot meet what agents demand. But the fixes that follow, better access graphs, real-time authorization, immutable lineage, are still identity layer fixes. Identity controls lower the odds an agent is compromised or misdirected. They do nothing to limit the damage once one is, because once an agent passes the access check, the file has no say in what happens next.
The File That Can Defend Itself
Fasoo Enterprise DRM is built to close this missing layer. Under FED, the document itself is encrypted. If an agent does not have access rights to that file, it cannot open it. Not partially, not by accident, not through a clever prompt. It simply cannot open it.
Access is only the first gate. Even an agent that is allowed to open a file still needs separate permission to decrypt it into plaintext, or to copy and export its content. Fasoo Enterprise DRM keeps these as separate rights. An agent can be allowed to view a document under policy control and still be blocked from decrypting it, copying it, or pasting it somewhere else. Without decrypt permission and secure copy permission, there is nothing for the agent to extract, even if it tries.
This matters most for the documents that matter most. In a well-managed enterprise, sensitive and confidential files are already locked down under strong policy, often limited to a short list of named users. Most AI agents, whether a Copilot style assistant, a RAG chatbot, or a coding agent, are not on that list. So the exact failure pattern behind EchoLeak, where an agent used access it was never supposed to misuse, simply does not apply here. The agent cannot misuse what it was never granted in the first place.
This protection also does not depend on guessing how the agent was manipulated. It does not matter whether a poisoned email, a malicious webpage, or a compromised integration hijacked the agent’s reasoning. The file was never part of that conversation. It only checks one thing: does this identity, human, service account, or AI agent, hold the access, decrypt, and copy rights the policy requires, right now. If not, the document stays locked, no matter what instruction convinced the agent to try.
We made a version of this point before in our post on JADEPUFFER, the first fully autonomous AI ransomware attack: an attacker who behaves like an authorized user defeats identity checks, because identity checks only ask whether someone belongs, not what they are allowed to do once inside. AI agents raise the same question in a much more common setting. An agent does not need to be malicious to become a risk. It only needs broad access and one bad instruction.
Where AI Agent Security Actually Starts
Most organizations treat AI agent risk as an identity problem: which agent, which permission, which prompt got misused. That is a reasonable place to start asking questions, but it is the wrong place to start building protection.
The real starting point is data security. Before any agent goes into production, an organization needs to know what data it holds and how sensitive each document is. Once documents are classified, the important and confidential ones can be locked down with data centric protection, meaning the policy travels with the file itself instead of living in a system an agent might find a way around.
Do that, and the hardest questions about agent behavior get much easier to answer. It stops mattering whether an agent was manipulated, whether its reasoning was hijacked, or whether it simply followed a bad instruction, because none of that gives the agent decrypt rights it was never granted. A well-classified, well-protected document set means AI agents can be rolled out broadly without becoming a new path to your most sensitive data.
That is the real promise of data centric protection for the AI era. Not a smarter way to watch what agents do, but a guarantee that even when something goes wrong, sensitive content simply cannot leave the file.
───────────────────────────────────────────
Sources & References
- [1] Palo Alto Networks: 2026 Identity Security Landscape, p.7.
- [2] Cato Networks: Breaking Down ‘EchoLeak’ ,the First Zero-Click AI Vulnerability Enabling Data Exfiltration from Microsoft 365 Copilot
- [3] Palo Alto Networks: 2026 Identity Security Landscape, p.8.
- [4] Key Takeaways from Kiteworks’ Data Security and Compliance Risk: 2026 Forecast Report, p.2.
- [5] Anna Nabiullina, Carole Winqwist: “The State of Secrets Sprawl 2026: AI-Service Leaks Surge 81% and 29M Secrets Hit Public GitHub”
- [6] Agent of Chaos study (arXiv 2602.20021)
- [7] Saviynt: “2026 CISO AI Risk Report”