AI agents risk scaling North Korean identity attacks

North Korean operatives have for years infiltrated Western enterprise networks by posing as remote IT workers, using stolen identities to pass interviews, secure legitimate credentials, and operate inside corporate trust boundaries. The piece notes that firms, including cybersecurity vendors, publicly admitted being compromised in this way, with exfiltration of sensitive data routine and financial routes directed back to Pyongyang.

The author argues the root cause is trust granted at hiring and provisioning—questions like “Is the entity driving this session who we think it is?” were not addressed by traditional security stacks. With the rise of autonomous AI agents in enterprises, the threat landscape now threatens to scale these proxy identities dramatically, as AI agents carry credentials, access sensitive data, and orchestrate tasks at machine speed, typically inheriting human permission sets.

The article contends that the real problem is not malicious agents by default, but the hijacking of agent instructions after trust is granted, for example through prompt injection, hidden prompts, or poisoned tools.

Security researchers are already observing agentic attacks, including a Google Threat Intelligence Group (GTIG) finding a financially motivated intrusion that deployed a multi-agent framework inside a victim’s cloud, enabling credential harvesting in under six hours and generating traffic from inside the victim’s own network.

The piece emphasises governance questions such as responsibility for agent actions and accountability, noting that traditional Identity and Access Management (IAM) tools are ill-suited for agents that operate in milliseconds and may spawn sub-agents.

It proposes four measures: an AI Bill of Materials (AIBOM) to verify code lineage and runtime provenance; workload identity with short-lived tokens bound to named human sponsors; the “Rule of Two” to limit agent actions unless a human broker approves; and machine-speed revocation and kill switches to sever an agent mid-session. The article frames governing non-human, agentic identity as an essential, evolving attack surface, demanding continuous monitoring akin to human identities.