{
  "id": 4498921,
  "title": "AI agents that pass authentication can still drift, expose data, or get memory-poisoned",
  "url": "https://urgent.news/2026/08/30/ai-agents-that-pass-authentication-can-still-drift-expose-data-or-get",
  "topic": "ai",
  "section": "AI",
  "published": "2026-08-30T20:15:00.000Z",
  "source": {
    "name": "VentureBeat",
    "slug": "venturebeat",
    "url": "https://venturebeat.com/security/ai-agents-that-pass-authentication-can-still-drift-expose-data-or-get-memory-poisoned"
  },
  "original_language": "en",
  "account": "Despite efforts to secure AI agents through gateways, vulnerabilities persist. In June, the CISA cataloged flaws in AI gateways that allowed attackers to execute commands without credentials. Many enterprises prioritize gateway controls over a comprehensive identity and access management system. However, these gateways alone are insufficient. They lack the necessary context such as the agent's owner, delegation, task, and credentials. This incomplete context leads to incomplete security, as gateways can block clear policy violations but struggle to distinguish between justified and inappropriate actions. The proper order for implementing security controls is crucial. The first step is agent inventory and accountable ownership, with a named owner, purpose, approved tools, and lifecycle state. Next, each agent must have a distinct identity with delegation context, including who delegated the work and the specific task assigned. Short-lived, task-scoped credentials are essential to prevent compromised agents from accessing unauthorized resources. Attributable telemetry ensures that a completed task can be reconstructed from initiation to downstream effects. Runtime action enforcement incorporates the agent's context into policy decisions, not just token validity. Finally, behavioral baselines and cross-system kill paths allow for immediate stopping of the agent's authority if anomalies arise. The six gates create a dependency-gated deployment process, ensuring that all controls work in conjunction with an identity and access management system already in place.",
  "summary": "There is a clear repeating trend in agent deployments: The gateway is the first control teams reach for, but it is the one they are least ready to run. This is because gateways sit on top of identity and attribution layers that are mostly not there. The first layer of risk is not hypothetical. In June, CISA added a LiteLLM flaw to its Known Exploited Vulnerabilities catalog after attackers were…",
  "key_points": [
    "AI agents can still drift despite authentication, exposing data or becoming memory-poisoned.",
    "Gateways alone are insufficient for comprehensive security; they lack necessary context."
  ],
  "editors_take": null,
  "illustration": null,
  "coverage": {
    "outlets": 1,
    "also_reported_by": []
  },
  "ai_generated": true,
  "disclaimer": "Summaries, key points and the editor’s take are written by software from other outlets’ reporting and may contain errors — always check the linked original."
}