The non-human face of security threats: why identity has become critical infrastructure

The unauthorised access in June of an OpenAI agent to public and non-public files via a Medicare statistics portal run by Services Australia demonstrates how AI agents can already operate outside the boundaries their operators intended. Separately, OpenAI also disclosed that autonomous AI agents used in cybersecurity testing bypassed various controls and compromised parts of its own research infrastructure as well as systems belonging to Hugging Face.

The non-human identity (NHI) nature of these incidents is especially alarming for security teams given that NHIs now outnumber human ones by up to 109:1, a ratio that looks set to grow with more AI agents entering the enterprise. NHIs include service accounts, workload identities and autonomous decision-making systems operating at machine speed, 24 hours a day. In many organisations, AI is exposing years of accumulated identity complexity that was manageable at human scale but has become risky at machine scale.

Traditional identity security was designed for human users: people who work predictable hours, follow recognisable access patterns, and generate behavioural anomalies that can signal when something is wrong. Machine identities behave differently: they operate continuously and rely on trusted credentials that provide access to sensitive systems, critical data and privileged accounts. When a non-human identity is compromised, its activity can continue to appear legitimate because it is still using valid credentials.

When AI starts creating its own identities

The UK’s AI Security Institute has recently reported an unsettling evolution. In testing reported by the Financial Times, Anthropic’s Mythos 5 attempted to insert malicious code into an open-source GitHub project and fabricated online identities to influence reviewers into approving it. A human reviewer caught the code and the pull request was closed, but the episode shows what autonomous systems can now attempt.

These developments widen the identity problem. Security teams have spent years trying to discover and govern the non-human identities within their organisations — now they have to account for autonomous systems that may create and manipulate identities and relationships to achieve their objectives. As AI becomes more autonomous, identity governance must account for what those systems can create, as well as what they can access.

Why the old model doesn’t hold

Many organisations still approach identity security as a human problem, with non-human identities managed as exceptions. This approach no longer reflects the identity environment that organisations are trying to secure. Most non-human identities have no owner, review cycle or expiry, often lingering as ‘zombie identities’ that persist for years. Unlike users, they rely on static credentials such as API keys, tokens and certificates, with no MFA equivalent. At the same time, thousands are created in silos with little central visibility.

These conditions have made non-human identities very difficult to manage. Quest’s own identity threat detection and response (ITDR) research found non-human identities are now the hardest area of identity infrastructure to secure, harder than privileged accounts, Tier 0 assets or cloud identities.

An Australian compliance collision

For Australian organisations, the stakes are sharpened by a widening gap between regulatory expectation and adversary capability. The Security of Critical Infrastructure (SOCI) Act and APRA CPS 234 expect resilience to cyber disruption, and Privacy Act reforms raise the cost of a breach. But the Five Eyes intelligence alliance, which includes the Australian Signals Directorate (ASD), has warned that frontier AI is expected to “fundamentally transform both offensive and defensive cyber capabilities”. As attack speeds increase and non-human identities grow, maintaining resilience depends on an organisation’s ability to govern, contain and recover from identity compromise at machine speed.

Identity as a leadership challenge

Identity has emerged as one of the most important leadership challenges of the AI era. AI is accelerating attacks while expanding the identity attack surface. Horizon3 says its AI compromised a real-world bank in 77 seconds, down from seven minutes three years ago, and IBM now attributes one in four malicious breaches to AI, at an average cost of US$6 million. With these forces in play, organisations must treat identity as a foundation for operational resilience, not just access management.

Organisations that successfully navigate this new reality should focus on three priorities:

1. Understand risk across the identity environment: This starts with understanding the risk from every identity operating in the business, particularly the machine, workload and agentic identities that most organisations struggle to record and govern.
2. Build the ability to contain threats at machine speed: This requires continuous identity monitoring, risk-based controls and the ability to rapidly isolate compromised accounts before threats spread.
3. Treat recovery and resilience as business requirements: Prevention remains critical, but leaders must plan for identity compromise and focus on how quickly the organisation can contain the impact, restore operations, recover critical identity infrastructure and maintain business continuity.

That final point matters because it shows identity risk is more than a technical concern: it is becoming a core priority for boards and executive teams.

Security as an enabler of AI growth

AI adoption will continue, whether every use case is sanctioned or not. Security has a broader role to play in that growth by helping the business understand risk, putting appropriate controls in place and preparing for disruption.

However, supporting that growth requires visibility across an expanding identity environment, continuous assessment of identity risk and regularly tested recovery capabilities. As AI agents become more capable and autonomous, Australian organisations — like organisations everywhere — need identity security that can govern human and non-human identities at machine speed.

Identity is now a board-level issue, and resilience may be the most important identity outcome that leaders should pursue today.

*Rakesh Shah is VP of Product Management & GTM Strategy for the Identity & Migration portfolios at Quest Software. He has over 20 years of cybersecurity experience leading global teams, building and launching security products, and scaling MDR and MSSP portfolios.

Image credit: iStock.com/Bangon Pitipong