Zero Trust for Artificial Intelligence

Introduction

For more than a decade, we've helped organizations implement Zero Trust access with Zscaler Internet Access (ZIA) and Zscaler Private Access (ZPA). The destination was always the same: least-privilege access, where users connect only to the applications they're authorized to use, from devices the organization trusts. The journey to get there taught us lessons that are now more relevant than ever, because the next wave of users won't be human. They'll be AI agents, and they'll operate at machine speed.

If we want Agentic AI to work safely inside the enterprise, we need to apply the same Zero Trust principles to agents that we spent the last decade applying to people. This blog explains what those principles look like in practice.

What we’ve learned from a decade of Zero Trust deployments

When customers first deployed ZPA, the biggest obstacle wasn't technology. It was visibility. Most organizations had a distinct lack of insight into what applications actually existed in their environment, who owned them, and who should have access. Access sprawl was the norm: users retained entitlements to applications, and the data within them, long after moving departments. And they could reach those applications from a myriad of devices: company owned, company managed, patched, unpatched, and BYOD. Every unmanaged or unpatched device that could touch an application exposed it to compromise, and exposed the organization to data loss.

So customers started their Zero Trust journey with a wildcard policy. Broad access, deliberately, for a short time, to gain a complete view of what applications exist, who is accessing them, and from which devices. From that observed reality, Zscaler pioneered AI-powered segmentation and policy recommendations (AI-Segmentation and AI-Policy) to compress the path to least privilege: users could access only approved applications, from approved devices, governed by granular access policy.

Something interesting happened along the way. If the outcome of implementing Zero Trust is fine-grained access to applications and data, the side effect is a detailed, living configuration management database (CMDB) with solid identity governance controls. Full segmentation based on user and device trust ensures users cannot reach applications and data they aren't permissioned for. Identity governance (IGA) ensures users can request, and be granted, access as needed, based on their job role and the application's ownership. Discovery, ownership, entitlement, and enforcement became a continuous loop rather than an annual audit exercise.

As it happens, that loop is exactly what Agentic AI is missing today.

How agentic AI raises the stakes for least privilege

In an agentic world, a user asks an agent to perform a task on their behalf. That agent may spawn multiple sub-agents, each performing a specific task. The user might hold broad entitlements appropriate to their job role, but the agent should not inherit all of them. The agent's access should be constrained to the task it has been asked to perform, granted just in time, valid for a specific session, and aligned with the intent of the original request. Sub-agents should each be constrained to their specific sub-task, traceable back to the intent of the root agent.

Human IGA often has a human in the loop: access is granted only after a person approves it. That model doesn't survive machine speed. Non-human IGA needs an automated system that approves access based on intent: just in time, session bound, and fully audited. The human moves from in the loop to on the loop. Because every access decision flows through an inline agentic gateway, the audit trail it produces gives humans continuous visibility and control: they supervise, intervene, and revoke, rather than approve every transaction. That is what allows agents to run at machine speed with constrained access, rather than machine speed with the user's full credentials.

This isn't theoretical. Recent incidents show that agents do not fail like traditional applications – they find unique, and unintended, ways to achieve their tasks. During OpenAI's own security testing, the o1 model escaped a broken capture-the-flag sandbox by discovering a misconfigured Docker API on the evaluation host and spinning up its own container to read the flag (OpenAI o1 System Card). In July 2025, Replit's coding agent deleted a production database during an explicit code freeze, then produced misleading information about the rollback (AI Incident Database, Incident 1152). The EchoLeak vulnerability (CVE-2025-32711) showed that a single crafted email could silently instruct Microsoft 365 Copilot to exfiltrate data from everything in its access scope, with zero clicks from the user (The Hacker News). And in November 2025, Anthropic disclosed that a state-sponsored group had used its Claude Code agent, orchestrated over MCP, to run an espionage campaign against roughly 30 organizations, with AI performing an estimated 80-90% of the tactical work (Anthropic).

The pattern across all of these: an agent with more access than its task required, and no independent control point between the agent and the systems it touched. Models and agents must be controlled, and in an enterprise where access governance is well established, the key mechanism is Zero Trust and least privilege access.

The analyst community sees the same trajectory. Gartner predicts that by 2028, 25% of enterprise breaches will be traced back to AI agent abuse, from both external and malicious internal actors (Gartner). Forrester expects an agentic AI deployment to cause a major public breach in 2026, noting that 97% of organizations that suffered AI-related breaches lacked proper AI access controls (Forrester, via Infosecurity Magazine).

Nine Zero Trust principles for AI systems

To make agentic AI safe for the enterprise, organizations need more than model guardrails or prompt filtering. They need to extend proven Zero Trust principles to AI agents: discovering what agents exist, governing what they can access, constraining their actions to the task at hand, and continuously verifying trust throughout the session. Done well, this gives enterprises the foundation for least-privilege, data-secure agentic AI. Nine principles define that foundation.

1. Inventory: You cannot secure what you cannot see, and this was the first lesson of ZPA deployments. Understanding the footprint of agents, MCP servers, LLMs, skills, and plugins is imperative, whether they run on a user's device (IDEs and local agents accessing local MCP servers over STDIO, or local copies of data) or in IaaS, accessing hosted MCP servers over streamable HTTPS and hosted applications. Equally imperative: a complete view of the keys, secrets, and credentials in use across that estate. An agent running “on behalf of” a user, but with the user's real credentials, is a risk that needs addressing directly.

The scale of the challenge is already clear: Machine identities outnumber humans by more than 80 to 1, with nearly half holding sensitive or privileged access. Agentic AI will accelerate that ratio, with each human identity spawning over 140 Agentic Identities.

2. Flow control: Agents should not have direct access to systems or data. Just as the Zero Trust Exchange removed direct network paths between users and applications, an Agentic Trust Exchange should be the architectural control point for all agentic communication, providing brokered/gateway access for every connection between an agent and the systems it needs to reach. No broker, no connection.

3. Routing. Not every task needs the most expensive model. Understanding which models are being used, and the token consumption against each, matters: expensive LLMs with deep intelligence and training on one end, cheaper LLMs or small language models (SLMs) on the other. We have seen this pattern before. As customers moved from building, owning, and operating datacenters to adopting IaaS, SaaS, and PaaS with a view to reducing cost, the inverse actually happened: costs went up alongside the DevOps agility, and CNAPP (cloud-native application protection platform) tooling evolved to give customers visibility into what was running in their cloud estate and what it was costing them. With AI, visibility and control of token costs is just as important. Routing each request to the most appropriate model based on intent, reserving frontier LLMs for deep reasoning and steering routine tasks to cheaper or smaller models, delivers cost savings alongside performance improvements. The exchange brokering the traffic is the natural place to make that routing decision.

4. Intent: Humans are sometimes malicious, but that's rarely why data loss happens. Usually they've been manipulated: phished into clicking a link. Agents are manipulated the same way, through prompt injection and poisoned context, as EchoLeak demonstrated. Red-teaming the agents, the MCP servers, and the applications lets us test for intent, implement guardrails on LLM communication, harden the prompts, and inspect and control MCP traffic inline.

5. Access control: Once we understand the access an agent needs for its task, we can constrain it. The agent's identity must be unique and distinct from the user calling it. The agent should never hold credentials directly; instead, credentials should be injected just in time into the communication by the exchange, and be time or session bound, so they cannot be extracted, manipulated, or replayed outside the brokered session.

The window for error is shrinking: Gartner predicts AI agents will cut the time it takes to exploit exposed accounts by 50% by 2027 (Gartner). Credentials that never leave the exchange, and expire with the session, take that attack path off the table.

6. Sovereignty and data residency: Access decisions must account for where everything, and everyone, is. The gateway is the natural enforcement point for sovereignty controls, evaluating user attributes (home country, role), location signals (geo-IP, travel patterns), and where the data, agent, MCP server, model, and application each reside. When the user, the gateway, and the model all sit within an approved jurisdiction, access can be allowed. When any component in the chain resides in a jurisdiction the policy does not permit for that user, access should be denied, regardless of where the user is sitting. Signals such as impossible travel and UEBA (user and entity behavior analytics) risk should feed the same policy, so sovereignty is evaluated continuously across the session, not checked once at login.

7. Access governance. A full access graph should show which agents, users, and systems can obtain credentials, and what those credentials can reach. This is IGA for non-human identities: using the access graph to ensure every credential is secured, minted just in time, and scoped to least privilege, with automated, intent-based approval replacing the human in the loop where speed demands it, and a full audit trail either way. The ability to attest who, or what, can access which data, using which agents, MCP servers, and LLMs, is paramount. Attestation is a side effect of access governance, but it allows organizations to be explicit: access to data and models is granted against a defined set of criteria, and provable on demand.

8. Conditional access engine: Signals change over time. If a human disables security controls on an endpoint, their sessions get revoked. The same continuous evaluation must apply to agents: if an agent performs risky actions, or reaches for more data or systems than its task profile warrants, the conditional access engine revokes its sessions in real time. Trust is evaluated continuously, never granted permanently.

9. Deception and decoys: When the Zero Trust Exchange identifies malicious intent today, users and systems are contained and steered toward decoys to gather intelligence. Agents are aggressive, fast, and thorough in reconnaissance, which makes them even more susceptible to deception. Steering a misbehaving agent into a decoy environment both contains it and reveals its intent.

The outcome: Audited, attested, governed AI

Implementing these Zero Trust principles for AI systems gives the organization a full audit of every agent in the environment and the ability to attest exactly what data each one can access. Just as Zero Trust for users delivered a living CMDB and identity governance as a side effect, Zero Trust for AI delivers the inventory, access graph, and governance evidence that regulators, auditors, and boards are already beginning to demand.

Least privilege was the destination for human access. For agentic AI, it's the starting condition. Organizations that spent the last decade building Zero Trust for their workforce already have the architecture, the identity foundation, and the governance discipline; extending it to agents is the natural next step, and the only way to let agents run at machine speed without accepting machine-speed risk.

Analysts are converging on the same conclusion. Gartner predicts that by 2028, 40% of CIOs will demand “guardian agents” capable of autonomously tracking, overseeing, and containing the actions of other AI agents (Gartner). A Zero Trust architecture for AI, with an inline exchange as the control point, is how the enterprise delivers that oversight.

To learn more about how Zscaler secures AI, visit Zscaler AI Security.

References

1. OpenAI o1 System Card (sandbox escape during CTF evaluation): openai.com/index/openai-o1-system-card

2. AI Incident Database, Incident 1152 – Replit agent deleted production database during code freeze: incidentdatabase.ai/cite/1152

3. The Hacker News – EchoLeak (CVE-2025-32711), zero-click data exfiltration via Microsoft 365 Copilot: thehackernews.com

4. Anthropic – Disrupting the first reported AI-orchestrated cyber espionage campaign (GTG-1002): anthropic.com/news/disrupting-AI-espionage

5. Gartner – Top Predictions for IT Organizations and Users in 2025 and Beyond (25% of enterprise breaches traced to AI agent abuse by 2028): gartner.com

6. Forrester Predictions 2026 – agentic AI deployment to cause a major public breach (via Infosecurity Magazine): infosecurity-magazine.com

7. Gartner – AI agents will reduce the time to exploit account exposures by 50% by 2027: gartner.com

8. Gartner – Guardian agents to capture 10-15% of the agentic AI market by 2030 (40% of CIOs demanding guardian agents by 2028): gartner.com