We spent the year arguing about the wrong thing.
Prompt injection, jailbreaks, model alignment, whether the agent can be tricked into saying something it should not. Real problems, worth solving. But while the industry stares at the model, the breach is walking in somewhere else entirely. It is walking in through identity, and we built the door ourselves.
Here is the claim, plainly. The AI security fight is not on the prompt. It is on the identity layer, and by almost every number that matters, we are losing it before the fight even starts. We have surrounded ourselves with non-human identities we cannot count, handed them privileges we would never give a person, and pointed them at an attacker who is already running most of the attack without human hands. The model is the thing everyone is watching. Identity is the thing getting robbed.
Even the "AI flaw" turns out to be an identity flaw
Take the vulnerability everyone pointed to as proof that AI itself is dangerous: EchoLeak, CVE-2025-32711, the zero-click flaw in Microsoft 365 Copilot found by Aim Security and rated 9.3. It was billed as the first real-world prompt injection weaponized in a production LLM. And it was. An attacker embedded instructions in an ordinary email, Copilot read them while doing its job, and data left the building with no click from the victim.
But look at what actually happened once you strip the novelty away. Instructions crossed a trust boundary they should not have. An identity, Copilot, acting with the user's access, was made to do something the user never authorized, and to move data it was trusted to hold. The "AI vulnerability" was a confused-deputy problem: a trusted identity tricked into acting for someone else. That is not a new class of attack. That is the oldest class of attack, wearing an LLM as a costume. The prompt was the lure. The identity was the exploit.
Once you see that, the whole landscape reorganizes. The interesting question is never "can the model be fooled." Models can always be fooled. The question is "what can this thing do, as whom, and who notices." That is an identity question, and our answers are alarming.
The blast radius we built on purpose
Start with scale. In the average organization there are now 82 machine identities for every human one.
Service accounts, API keys, tokens, workloads, and now a fast-growing population of AI agents. According to CyberArk's 2025 Identity Security Landscape, nearly half of these machine identities hold sensitive or privileged access, and most are effectively invisible to the teams nominally responsible for them. The same report found that 68% of organizations have no identity security controls built for AI at all. We are creating the identities faster than we are learning they exist.
Now add privilege. Microsoft's State of Cloud Permissions Risks found that 99% of cloud identities are over-privileged, and that they use roughly 1% of the permissions they have been granted.
Read those two numbers together and the picture is not a hardening backlog. It is a standing invitation. Every unused permission is a door left open, and we have left 99 of every 100 open. A single compromised identity in that environment is rarely a single compromised identity. It is a pivot point into everything that identity was needlessly allowed to touch.
Into this, we are now dropping autonomous agents. And here is the part that should stop a security leader cold: we give agents access we would never give a new hire. A junior joins, and we scope them tightly, review their permissions, expire their credentials, and watch what they do for months. An agent joins, and we hand it a broad token, a standing key, and a shell, and we call it productivity. I wrote about the sharp end of this in give an AI agent a shell and everything is in scope: the moment an agent can execute, your blast radius is no longer defined by what you intended, it is defined by what the agent can reach. Multiply that by 82-to-1 and 99%, and you are not managing a fleet of helpers. You are running an army of over-privileged identities that nobody is watching and that will do whatever the last instruction told them to.
The attacker already automated. You did not.
The reason this matters now, and not next year, is that the other side stopped waiting.
In November 2025, Anthropic disclosed something that had been theoretical until then: the first documented large-scale cyber-espionage campaign run mostly by AI. A state-sponsored group used an AI system to execute 80 to 90% of the operation autonomously. Reconnaissance, exploit development, credential harvesting, exfiltration. Humans intervened at only four to six decision points across the whole campaign.
At its peak the system was making thousands of requests, several per second, a tempo no human team can match. This is the operational reality behind a point I made in the malware now reasons: the offense is no longer a person at a keyboard you might out-think. It is a process that adapts at machine speed, and it spends most of that speed doing exactly what our over-privileged identity estate makes easy. Credential harvesting and lateral movement are not the hard part of an attack anymore. We pre-built the easy path.
Put the two halves together. On defense, an identity estate that is 82-to-1 non-human, 99% over-privileged, and largely uninventoried. On offense, an adversary that runs most of the intrusion autonomously and never gets tired. The gap between those two is not a fair fight. It is the definition of the modern breach.
Identity is not just the way in. It is the product.
There is a second reason identity is the battleground: it is increasingly the thing being stolen and the thing being faked, on both ends of the human/machine spectrum.
On the fraud side, the money has already moved. The FBI's IC3 2025 report attributed $893 million in losses to AI-enabled fraud, the first time in the report's 25-year history it carried a dedicated AI section. And the FBI is explicit that this is a floor, not a ceiling, because it only counts what victims recognized as AI.
Notice what sits inside that number: $13 million lost to deepfake job interviews, candidates who were not real people. That is the human identity being synthesized wholesale, and it is about to get worse. Gartner projects that by 2028, one in four candidate profiles worldwide will be fake. Think about what that does to every downstream identity assumption. The onboarding that mints a new human identity, the access it is granted, the machine identities it then creates, all of it can now start from a person who does not exist.
So identity fails in both directions at once. The machine identities we already have are over-privileged and unwatched. The human identities we are about to create can be fabricated. The attacker does not need to break the model. They need to be, or to borrow, an identity your systems already trust.
What we actually see on the identity plane
This is the part I care about most, because it is where the abstract argument becomes concrete, and where our team spends its days.
At Sekoia, the threat our researchers keep pulling on is not a clever prompt. It is identity and session abuse, industrialized. Our Threat Detection and Research team documented EvilTokens, the first phishing-as-a-service kit built around Microsoft device-code phishing. It does not steal a password so much as steal a session: the victim authenticates on the real Microsoft page, and the attacker walks away with access and refresh tokens good for up to 90 days. The login looks legitimate because it is legitimate. The identity was not broken, it was borrowed, and standard authentication never fires an alarm.
The same pattern shows up further upstream. TDR's work on the IClickFix framework traces how a fake CAPTCHA lure pushes a victim to run a command that drops an infostealer, and how those stolen credentials then feed real-world fraud, including the Booking.com campaigns that hit the hospitality industry through compromised professional accounts. Credential to session to fraud. At no point in that chain does anyone need to defeat a model. They need one identity, and the standing access behind it.
That is why detection has to live on the identity plane, not the prompt. The signal that matters is not "did the model say something odd." It is "is this identity, human or machine, behaving like itself." A token used from a new place. A service account reaching for a resource it never touched. A session that keeps working long after the human went home. An agent doing something outside the narrow job it was created for. As I argued in you cannot name what you cannot see, the advantage is not owning the biggest model, it is the accumulated ability to recognize a real identity from a borrowed one. That recognition is built, case by case, by teams that hunt this behavior and turn it into detection. It is the one asset an attacker cannot download.
What to do while everyone else audits the prompt
None of this is a counsel of despair. It is a redirection of effort, from the layer that is loud to the layer that is load-bearing.
Inventory the non-human identities first. You cannot govern 82-to-1 if you can only see the one. Every service account, key, token, and agent needs an owner, a purpose, and an expiry, the same way a person does.
Give agents identities, not blank checks. An AI agent is a new identity with real power. Scope it to the task, use short-lived credentials, and make standing access the rare exception it should be. If you would not hand a contractor a permanent domain-admin key, do not hand it to a bot because the bot is convenient.
Attack the 99%. Least privilege stopped being hygiene and became the primary control. Every permission an identity does not need is one an attacker inherits for free. The gap between granted and used is your real attack surface, and it is measurable today.
Detect on behavior, not just authentication. MFA and a clean login are exactly what a stolen session looks like. Watch for identities acting unlike themselves, and treat token, session, and agent anomalies as first-class alerts, not afterthoughts.
Verify the humans too. If one in four candidates will soon be fabricated, identity verification belongs in hiring, not just in the SOC. The synthetic identity created at onboarding is the one that will look perfectly trusted later.
The industry will keep debating whether the model is safe. It is the wrong debate, or at least an incomplete one. Attackers are not queuing up to outwit your language model. They are logging in as your identities, human and machine, because we made those identities numerous, over-powered, and unwatched, and because the offense is now automated enough to use every one of them.
The model was never the attack surface. Identity always was. Stop auditing the prompt, and start auditing who, and what, is allowed to act as you.