AI Agents Break Traditional Zero Trust Security Models

The zero trust security framework that has anchored enterprise identity management for more than a decade wasn't designed for AI agents—and the gap is starting to show. According to Chris Webber, VP of Product Marketing at Teleport, agents operate in ways that break core zero trust assumptions: they move at software speed, behave unpredictably like humans, and run continuously without the discrete authentication checkpoints traditional systems rely on.

Why it matters

As organizations deploy AI agents with access to production systems, customer data, and business logic, security teams face a new class of risk. Agents can impersonate users, spawn copies of themselves, and drift from their original objectives—whether through attack, error, or simple context shift. Traditional identity threat detection tools watch for anomalies after the fact, but can't distinguish between an agent acting under legitimate human credentials and one that's been hijacked or misaligned.

Where Zero Trust Falls Short

Webber outlined three areas where established zero trust principles need fundamental extension. The first is "verify explicitly," which has historically meant point-in-time authentication. That model breaks when an agent can act anonymously or impersonate a human between authentication events. Verification must extend into continuous runtime monitoring tied to unique agent identity.

The second principle, "use least privileged access," remains valid for individual actors but fails to account for collective behavior. A swarm of agents, each with individually authorized permissions, can produce collectively destructive outcomes. Security boundaries must govern what groups of agents can accomplish together, not just what each can do in isolation.

The third principle, "assume breach," needs to expand beyond malicious compromise to include agent drift. Agents can diverge from stated objectives through goal hijacking, reward hacking, benign misgeneralization, or simple context shift over time. The security impact is identical regardless of cause.

Teleport's Architectural Approach

Teleport's solution centers on two components: trusted runtimes that architecturally contain agents, and identity security that monitors and responds in real time.

Every agent receives a unique identity explicitly attestable to a human or platform. Agents operate only within trusted runtimes—environments that enforce boundaries for operational access, execution, and external communication. These runtimes start with zero privileges, requiring explicit authorization for every connection and action.

Trusted runtimes also terminate immediately when work completes or risk emerges. This prevents runaway agents, eliminates standing privilege, and destroys stored data.

Continuous monitoring captures every interactive action agents take, assessing individual and collective risk against declared objectives. When sessions produce actual risk, the system can terminate and destroy both the runtime and the agent operating within it.

From Detection to Enforcement

Webber argued that identity threat detection and response (ITDR) tools were never designed for an agentic landscape. When an agent operates under the credentials of the human who invoked it, or spawns 25 clones to complete a task, anomaly detection alone can't provide adequate control.

Security systems must shift from watching for anomalies to continuous enforcement. Governance and execution need to be linked, with the ability to capture objectives, verify that actions align with those objectives, and intervene at machine speed rather than routing decisions to humans.

These details were first reported by Help Net Security in an interview with Webber published September 7, 2026.