CISO Warns Over‑Provisioned AI Agents Amplify Insider Risk at Span
What Happened — Span’s CISO, Hrvoje Englman, highlighted that engineers are deploying AI‑generated code agents that inherit their creators’ privileged identities, creating a new, largely unmanaged attack surface. The rapid adoption of AI‑assisted development is outpacing traditional least‑privilege controls and documentation practices.
Why It Matters for TPRM —
- Over‑provisioned AI agents can become privileged “shadow IT” that third‑party risk programs struggle to inventory.
- Undocumented autonomous agents increase the “bus‑factor” risk, leaving organizations exposed when key personnel depart.
- Existing security controls (e.g., SOC alerting, policy enforcement) are not designed for AI‑driven processes, raising the likelihood of undetected misuse.
Who Is Affected — Enterprises with large engineering or development teams that employ AI coding assistants, autonomous agents, or internal developer platforms (primarily TECH / SaaS, CLOUD INFRA, and FIN SERV sectors).
Recommended Actions —
- Conduct an inventory of AI‑generated agents and map their privilege levels.
- Enforce just‑in‑time (JIT) access and automated de‑provisioning for agents tied to employee identities.
- Integrate AI‑agent activity into existing SIEM/SOAR workflows and require documentation for any autonomous process.
Technical Notes — The risk stems from over‑provisioned identities granted to AI agents, lack of documentation for autonomous processes, and insufficient SOC tooling to interpret AI‑generated alerts. No specific CVE or vulnerability is cited; the issue is a systemic governance gap. Source: Help Net Security