Zero trust AI agents demand a different kind of security

In this interview, Chris Webber, VP, Product Marketing at Teleport, explains why zero trust principles need to change for AI agents. He covers how agents act fast, unpredictably, and continuously, and why old ideas like least privilege and point-in-time verification fall short.

Webber also discusses Teleport’s approach: trusted runtimes with zero starting privileges, and identity security that watches agent behavior in real time. He argues that security teams must move from spotting anomalies after the fact to enforcing rules at every step an agent takes.

Why is zero trust insufficient for agents?

Zero trust principles have been core to good identity hygiene and cybersecurity practice for well over a decade – and they remain as important for the human and machine identities they were designed around. Agents act in ways that were never considered as part of zero trust principles – fast like software, unpredictable like people, and able to operate continuously (some might say relentlessly!) to achieve a goal.

Zero trust starts with a critical concept: “Verify explicitly.” This verification has generally taken the form of discrete points of authentication. But these points are not enough when an agent can act anonymously, or impersonate a human, for example. This concept needs to evolve beyond point-in-time authentication, and beyond static permissions – instead extended into runtimes that architecturally enforce access, execution and communication boundaries for the agents, all based on unique identity.