TheDPDPAct.com -
Official WhatsApp Channel
Stay updated with the latest DPDP Act news, compliance insights, updates, and resources.
Join Our WhatsApp Channel →When a new employee joins your company, a lot happens before they touch anything sensitive. HR verifies their identity. IT issues an account with permissions matched to their role. A manager is named. There is a probation period, and an exit process for the day they leave. Now consider how most AI agents get onboarded: someone pastes an API key into a config file and writes a prompt. Gartner predicts that up to 40% of enterprise applications will include integrated task-specific AI agents by the end of 2026, up from less than 5% in 2025. That is a very large workforce being hired with no paperwork at all.
An Agent Is an Identity, Not a Feature
The security conversation around AI has focused on what models say. Agentic AI shifts the question to what systems do. An agent reads email, queries databases, calls APIs, and changes records, all using credentials. That makes it an identity with privileges, and it belongs in the same governance process as any other privileged account.
The scale of the existing problem matters here. Veza's 2026 State of Identity & Access report found non-human identities outnumber human identities roughly 17 to 1. Sophos's 2026 State of Identity Security found 71% of organizations suffered at least one identity-related breach in the previous 12 months. Agents arrive on top of an identity estate that is already hard to see and govern.
A Dark Reading readership poll, reported by Kiteworks, found 48% of respondents ranked agentic AI as the top attack vector heading into 2026. That is a self-selected poll, not a representative survey, and the sample size was not published. Treat it as a mood indicator. The structural point stands without it.
What Can Go Wrong: The OWASP Agentic Top 10
In December 2025, OWASP released its Top 10 for Agentic Applications, developed with more than 100 industry experts and researchers. It gives security teams a shared vocabulary. Four items map directly to the "no background check" problem:
* Agent Goal Hijack: attackers redirect an agent's objectives through manipulated inputs, because agents struggle to separate instructions from data.
* Tool Misuse and Exploitation: an agent uses tools it is authorized for in unsafe ways, such as deleting data or chaining tools to leak information.
* Identity and Privilege Abuse: attackers exploit inherited permissions, delegated trust, or cached credentials to reach beyond what was intended.
* Agentic Supply Chain Vulnerabilities: third-party agents, tools, plugins, or registries that are malicious or tampered with inject hidden instructions or unsafe code.
The rest of the list covers unexpected code execution, memory and context poisoning, insecure inter-agent communication, cascading failures, human-agent trust exploitation, and rogue agents. Notice how many risks become smaller when an agent's permissions are small. That is the case for least privilege.
MCP: The Plumbing That Needs Inspection
The Model Context Protocol (MCP) has become a common way to connect AI agents to tools and data sources. Each connection is a path through which an agent can act, which means each MCP server is part of your attack surface.
In May 2026, the NSA's Artificial Intelligence Security Center published a Cybersecurity Information Sheet on MCP security. It describes gaps in MCP design, implementation, and operational posture that have created "significant and evolving security concerns," naming serialization risks, trust boundaries, and agent misuse. It warns that dynamic tool invocation, implicit trust relationships, and context sharing introduce novel and systemic risks, and that established defenses do not adequately address them. Its point about patching is the one to remember: these problems cannot be fixed at the interface alone, because mismatched assumptions at any stage can compound into exploitable conditions.
What Least Privilege Means for an Agent
1. Give every agent its own identity. Never let agents share a service account or borrow a human's login. Without a unique identity, you cannot attribute actions or revoke access cleanly.
2. Scope tools per task, not per agent. An agent that summarizes tickets does not need write access to your billing system. Maintain an explicit allowlist of tools for each job.
3. Prefer short-lived, task-scoped credentials. Standing credentials that live in configuration files are the agent equivalent of a master key left under the mat. One vendor's guidance recommends temporary credentials issued for the task and brokered at execution time, which is a sound pattern.
4. Separate reading from writing. Most agent tasks need to read far more than they need to change. Make write and delete permissions an exception that requires justification.
5. Put humans in front of irreversible actions, carefully. Payments, deletions, and external messages deserve approval. But beware approval fatigue: OWASP lists human-agent trust exploitation as a risk precisely because people rubber-stamp confident-sounding agents.
6. Vet MCP servers like vendors. Review who built them, what they can reach, and how they are updated, before connecting them to anything valuable.
7. Log every tool call, and keep a kill switch. If you cannot reconstruct what an agent did, you cannot investigate it. If you cannot stop it quickly, you cannot contain it.
8. Offboard agents. Retire credentials when an experiment ends.
Why Hyderabad's Enterprises Should Pay Attention
Hyderabad has become one of India's major hubs for global capability centres. A joint FICCI-Anarock report published in September 2026 counted about 515 GCCs in the city as of March 2026, employing more than 3 lakh people and representing around 20% of India's GCCs. The report expects 50-70 more within a year, across technology, engineering, BFSI, life sciences, and analytics, with growth in semiconductors and healthcare.
These centres tend to build and run automation that connects to systems their global parents own. If agents are deployed here, their permissions may span environments and data belonging to several jurisdictions. That is our inference, not a measured finding. It does suggest that an agent's access scope deserves more scrutiny in this setting than in a single-site company.
The Background Check: How to Test Before You Trust
Governance on paper is a start. Testing is the equivalent of the reference check.
- Threat model before you build. Mapping an agent's tools, data access, and trust boundaries at the design stage is cheaper than redesigning after deployment. This is the purpose of secure AI development.
- Attack it before someone else does. AI red teaming tests whether your agent can be hijacked through the content it reads, tricked into misusing a tool, or pushed beyond its intended scope. ILLUME Intelligence offers both, through Secure AI Development and AI Red Teaming, for teams deploying agents that can touch real systems.
The Bottom Line
Agents are joining the workforce faster than the processes built to onboard them. The fix does not require a new discipline, only an old one applied consistently: know who or what is acting, grant the minimum access needed, watch what it does, and verify before you trust it. Treat every agent as a privileged identity from day one, and most of the OWASP list becomes easier to manage.
