Most people understand what it means to protect a human identity because the dangers of someone impersonating you online or stealing and cloning your credit card are immediately obvious. Organisations rely on thousands of nonhuman identities that belong to software applications, cloud workloads, APIs, bots, and artificial intelligence (AI) agents, which can affect almost everyone if compromised. What happens when a cyber attacker hijacks the identity of an autonomous agent?
Meet the invisible workforce
A machine identity is a digital ID in the form of a certificate, a key, a token or another credential that allows one system to prove to another it is trusted and allowed to act and retrieve information on a user’s behalf. In the same way a person needs credentials to enter a building or approve a payment, a machine needs credentials to access systems and perform tasks. The biggest difference is scale as machine identities are growing far faster than human ones thanks to cloud adoption, automation and AI.
This growing “invisible workforce” is trusted to move data, run integrations, trigger workflows, deploy code and make decisions at speed, and because of this it holds extensive privileges yet operates with limited or no human oversight. If a criminal steals a person’s credentials, the consequences are serious but relatively easy to picture. You freeze the account, reset the password and investigate what was accessed. It is less self-evident what happens when a machine identity is stolen, but often more worrying.
The hijacking of digital trust
The risk stopped being merely theoretical a while ago. Imagine an AI legal assistant integrated into a firm’s workflow to review contracts and draft correspondence. If an attacker manages to hijack the agent’s identity — perhaps through a stolen API key or a sophisticated prompt injection — they don’t only get access to files; they get the “trusted voice” of that agent.
In such a scenario the hijacked agent could be instructed to quietly redirect confidential client data to an external server or insert malicious clauses into a contract draft, all while appearing to be the same trusted “digital employee” the firm uses every day. Because the system recognises the agent’s machine identity, no red flags are raised until the damage is done.
The risks to resilience
The rise of hybrid work and the proliferation of “shadow AI” — where employees use unmanaged personal AI tools for work tasks — means thousands of unsecured machine identities are interacting with corporate networks.
If a compromised machine identity contributes to a security incident involving personal information the regulatory implications are real, as organisations are expected to respond to breaches in a structured, traceable way. In that context, unmanaged machine identities are a cyber weakness and a risk and compliance concern.
Securing the autonomous era
The answer is not to slow innovation or ban every new tool, but to recognise digital trust extends far beyond people and requires a strong identity security foundation. This type of foundation gives more control and transparency about which machine identities exist, what they have access to, how long credentials live, who owns them and how they are monitored. The organisations that manage this well will be those that treat every identity, human or machine as something to be continuously verified and governed.
The invisible workforce is booking, syncing, analysing, routing and authorising behind the scenes every day. The real question is whether organisations know which digital workers they have employed, what powers they have been given, and what happens if one of them is impersonated.
In the same way identity theft changed how we think about personal security, machine identity hijacking should change how we think about modern cyber resilience. In the human-AI era protecting trust will mean securing the people who work in organisations and the autonomous agents working quietly alongside them.
• Ford is group CTO at Integrity360.
Would you like to comment on this article?
Sign up (it's quick and free) or sign in now.
Please read our Comment Policy before commenting.