The Agent Smith Dilemma: Governing Agentic Identities
For the past few years, North Korean operatives, posing as remote IT workers, systematically infiltrated hundreds of Western enterprise networks. They passed technical interviews, cleared background checks using stolen identities, and sat comfortably inside corporate trust boundaries with legitimate credentials. They drew salaries, funneled funds back to Pyongyang, and routinely exfiltrated sensitive data on their way out. Major firms, including prominent cybersecurity vendors, have publicly admitted to falling for the scheme. (As an aside, listen to Nicole Perlroth’s Podcast “To Catch a Thief” for a fascinating deep dive)
The scheme worked because enterprises grant trust once. HR verifies a person at hiring, IT creates an account, a laptop is provisioned. The user is then authorized. Nothing in the security stack was built to answer the one question that mattered: Is the entity driving this session who we think it is?
Now enter the AI agent era.
Inside the...
Copyright of this story solely belongs to www.securityweek.com. To see the full text click HERE
