> ## Content Index
> Fetch the complete content index at: https://f4n6.co.uk/llms.txt
> Use this file to discover other available public pages before exploring further.

# AI agents keep access to company data after their work is done
- URL: https://f4n6.co.uk/security-feed/ai-agents-keep-access-to-company-data-after-their-work-is-done/
- Published: 2026-10-02T08:27:32.000Z
- Updated: 2026-10-02T08:27:32.000Z
- Author: Jeff Davies
- Tags: #security-feed

## 1\. Executive summary

A Delinea survey of IT and security leaders reports that organisations grant AI agents standing permissions that remain active after the agent's task ends, and that most cannot see or report on what those agents do while connected. Delinea's 2026 Identity Security Report: The AI Enforcement Gap found that 99.7% of respondents had a formal policy on AI data access, yet 42% had no automatic way to remove an agent's access when a session ended and fewer than one in five detected the most recent out-of-scope access as it happened. The exposure is not a software flaw: it is an identity and entitlement problem, where agents inherit the accumulated privileges of the user who launches them and reach customer records, employee data, financial data, security logs and source code. For EMEA financial services this is a control gap over privileged access to regulated data, and it sits directly on the DORA ICT third-party and incident-management obligations and the NIS2 supply chain security measures. No CVE, exploitation activity or named threat actor is associated with this item; the verified reference data resolved no CVEs for it.

## 2\. Regulatory framing

| Article                                                | Trigger (the fact in this item)                                                                                                                                             | Practical impact                                                                                                                                                                                                |
| ------------------------------------------------------ | --------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | --------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
| DORA Art. 28: ICT third-party risk, general principles | AI tools and agents connect to company systems through a user's work account or through connections employees set up themselves, sometimes without IT or security approval. | These connections are ICT third-party arrangements. Firms need them inside the third-party register and risk assessment, not treated as shadow tooling outside it.                                              |
| DORA Art. 17: ICT-related incident management process  | 42% of organisations have no automatic way to remove AI access when a session ends, and detection of out-of-scope access often takes a day or longer.                       | An agent acting beyond its approved scope is an ICT-related incident the firm must be able to detect, manage and evidence. The absence of session-termination and monitoring controls is a gap in that process. |
| NIS2 Art. 21(2)(d): supply chain security measures     | Agents inherit the permissions of the launching user, including privileges accumulated over years, and business teams grant access without security approval.               | The firm's supply chain security measures must cover the security of the AI tool and agent relationships it depends on, including who can grant an agent access and what that access reaches.                   |

## 3\. Technical analysis & attack chain

This item is a survey report, not an incident report. There is no exploited component, no malware and no attacker. What follows is the access and enforcement model the report describes, which is the mechanism a defender has to close.

1. A business team or employee connects an AI tool or agent to company systems. The connection is made through the user's own work account, or the employee sets it up directly. IT or security approval is not always obtained.
2. The agent inherits the permissions of the user who launches it. Where IT leaders use a user's existing permissions to bound an agent, those permissions can include privileges the employee accumulated over years, so the agent holds access unrelated to its assignment.
3. The agent selects tools and takes a sequence of actions to reach its goal. Broad permissions let it take steps that were not anticipated when the access was approved.
4. The agent's permissions remain active after its task ends. The tool keeps reaching company systems and data until the permissions expire or someone revokes them.
5. Detection is slow or absent. Monitoring may cover only some tools, leaving individual actions unchecked. Respondents often reported taking a day or longer to detect the most recent instance of an agent accessing data outside its intended scope, and during that period the agent can keep selecting tools and acting without human input.
6. Revocation is incomplete. Some organisations can revoke credentials immediately but need additional time to end an agent's session, and an active session can let the tool continue.

The data the report says these tools reach includes customer records, employee information, financial data, security logs and source code.

Enforcement is weakest at the point of action. Software build and deployment pipelines and Kubernetes environments had the lowest reported levels of enforcement at the moment of action across the systems surveyed, and coding agents operating there may be able to change applications and infrastructure.

The report gives three ways organisations handle the end of an agent's work: revoke permissions on a schedule, leave credentials active until an audit, or rely on employees to disconnect the tools themselves. Forty-two percent of IT and security leaders said their organisations had no automatic way to remove AI access when a session ended.

On the human side, 76% of employees said they had bypassed approval at some point to use these tools on work systems, and 60% said they had felt pressured at work to use AI tools with sensitive or confidential information without knowing whether it was permitted. Fifty-seven percent of leaders said policies were documented and enforced well enough for them to understand what data AI tools were permitted to access, and about 51% check AI access against policy in real time.

Confidence caveat: every figure and finding above comes from a single source, Delinea's 2026 Identity Security Report: The AI Enforcement Gap as reported by Help Net Security. It is a vendor survey of self-reported attitudes and practices, not telemetry from observed incidents. Treat the percentages as directional. No independent corroboration is available in the material provided, and no named actor, campaign or CVE is associated with this item, so no attribution is made.

## 4\. Mitigation & containment

P1 within 24h

- Inventory every AI tool and agent currently connected to company systems, and for each one record the account it authenticates as, the permissions it holds, and whether IT or security approved it. The report's finding that connections are set up through user work accounts and by employees directly means the inventory will not come from a single IdP report; check OAuth grants, service accounts and personal access tokens.
- For any agent holding permissions beyond its current task, revoke the excess now. The report's specific failure is permissions that stay active after the work ends, so the first action is to cut standing access rather than to write policy.
- Identify agents running in build and deployment pipelines and Kubernetes environments and confirm what they can change. The report flags these as the lowest-enforcement environments and notes coding agents there may alter applications and infrastructure.

P2 within 72h

- Set a maximum session lifetime for agent credentials and enforce termination at task end, so access does not depend on an employee remembering to disconnect. The report records 42% of organisations with no automatic removal at session end; that is the control to build.
- Require that agents run under a dedicated identity scoped to the task, not under the launching user's accumulated permissions. This removes the inheritance path the report describes.
- Turn on logging for agent actions across all connected tools, not a subset, and alert on actions outside the approved scope. The report's detection gap is that monitoring covers only some tools.

P3 within 7 days

- Put agent access grants behind the same approval path as other privileged access, and remove the ability for business teams to grant access without security review. The report ties the problem to approvals being bypassed and to connections being self-service.
- Add AI agent access to the periodic access review and to the third-party register, so each agent relationship is assessed and re-approved rather than left until an audit.
- Where an agent's out-of-scope access is detected, run it through the ICT incident process rather than treating it as a tooling anomaly, given the data classes involved.

## 5\. Indicators of compromise

No indicators of compromise available in the source material. This item reports survey findings, not an intrusion, and contains no hashes, domains, IP addresses, file paths or command lines.

The source does describe observable behaviours. These are not atomic indicators and are not machine-pivotable, but they are what a firm can look for in its own environment.

| Behaviour                                                                              | Where to observe                                        | Confidence                      |
| -------------------------------------------------------------------------------------- | ------------------------------------------------------- | ------------------------------- |
| AI agent authenticates as a user work account rather than a dedicated service identity | Identity provider sign-in and OAuth grant logs          | Single-sourced (Delinea survey) |
| Agent permissions remain active after the task completes                               | IdP and application entitlement records, session logs   | Single-sourced (Delinea survey) |
| Agent session continues after credentials are revoked                                  | Session management and application access logs          | Single-sourced (Delinea survey) |
| Agent actions outside the approved scope, detected a day or later                      | Tool-level audit logs, agent action logs                | Single-sourced (Delinea survey) |
| Coding agent changes to applications or infrastructure in CI/CD and Kubernetes         | Pipeline audit logs, Kubernetes audit logs, Git history | Single-sourced (Delinea survey) |

## 6\. Detection

Insufficient indicators to author detection rules.

The source contains no threat artefacts: no strings, command-line flags, mutex names, scheduled-task or service names, file names or paths, registry keys, or hard-coded values. The behaviours in §5 are environment-specific and depend on each firm's own identity and logging stack, so a rule written from them would encode this advisory's prose rather than anything observable in a log. Detection here is a control-design task, not a signature task: build the session-lifetime and scope alerts described in §4 against your own IdP and agent logs.

## 7\. Sources

- Help Net Security, "AI agents keep access to company data after their work is done", https://www.helpnetsecurity.com/2026/10/02/delinea-ai-policy-adoption-enforcement-report/, 2026-10-02\. Reports on Delinea's 2026 Identity Security Report: The AI Enforcement Gap.

## 8\. Adverse Trace position

Adverse Trace assesses this as a control gap rather than an active threat. There is no CVE, no exploitation in the wild and no named actor in the material, and the verified reference data resolved nothing for this item, so we are not raising a severity rating on the basis of it. The client impact is real but indirect: standing agent permissions over customer records, financial data, security logs and source code are exactly the entitlements that turn a later compromise or an agent error into a reportable incident, and the report's own numbers (42% with no automatic removal at session end, fewer than one in five detecting out-of-scope access as it happened) suggest most firms cannot currently evidence what their agents did. We will track whether follow-on reporting names specific agent platforms or observed misuse, and in the meantime we recommend clients treat the P1 inventory in §4 as the starting point, because you cannot scope or revoke agent access you have not enumerated.

---

[Read the original source →](https://www.helpnetsecurity.com/2026/10/02/delinea-ai-policy-adoption-enforcement-report/?ref=f4n6.co.uk)

*Published via PulseTrace — Adverse Trace threat intelligence.*