A new analysis of enterprise AI agent deployments warns that security gateways, the control most companies adopt first, are being implemented before the identity and attribution systems they depend on are in place, leaving organizations exposed to data drift and memory poisoning. The report, based on production agent deployments, argues that gateway controls should be the fifth layer of defense rather than the first, because they rely on context that is rarely developed upstream. In June, the Cybersecurity and Infrastructure Security Agency added a flaw in LiteLLM to its Known Exploited Vulnerabilities catalog after attackers exploited it in the wild, with the bug allowing command execution on the host without credentials. That vulnerability was one of seven disclosed in the gateway in a single month, illustrating the fragility of the layer many enterprises reach for first.
The core problem, according to the analysis, is that gateways authenticate user tokens and check API calls but cannot observe whether a request is agent-initiated, part of a tool chain from an untrusted artifact, or contradicts the purpose of the delegation. A finance-reconciliation agent attempting to alter a production record would pass the gateway鈥檚 checks because the credential is valid and the API call is permissible, even though the action is operationally inappropriate. The author of the analysis calls this a dependency-gated deployment, where each security control depends on context generated by the controls above it, and enforcement is often taken too early in the sequence.
The six dependency gates begin with a complete inventory of production agents, recording each agent鈥檚 owner, responsibility, lifecycle state, approved tools, data domains, and credential sources. Skipping this step, the analysis states, costs an organization the first hour of incident response while it determines what should have been obvious. The second gate requires that the system can identify the agent, its owner, and the principal it is acting for, since an agent buried in a developer token or shared service account leaves downstream logs attributing its actions to the human whose token it borrowed.
Limited privileges form the third gate, with access restricted by time and scope to the tools and resources required for the specific task, using identity access management features like workload identity, token exchange, and conditional access. The analysis cites a 2026 Teleport study of 205 security leaders, which found that organizations with over-privileged AI reported a 76 percent incident rate, while those under least privilege saw incidents in 17 percent of organizations. The fourth gate applies the principle of monotonic delegation, where every transfer of responsibility must preserve or diminish authority, never increase it.
The fifth gate requires comprehensive audit logs that link tool invocations to agent identity, initiating principal, task ID, parent action, and outcome, a step the analysis identifies as the most commonly missed in reviewed agent deployments. The sixth and final gate uses that telemetry to inform adaptive runtime policy, so decisions incorporate agent, principal, task, and action context rather than token validity alone. Without attributed oversight, the analysis concludes, regulated environments cannot justify their control decisions, and the gateway remains a costly control applied to only a small part of the security picture.
More cybersecurity news from TechManNews.
