Introduction

Artificial intelligence is moving beyond chatbots and into autonomous agents that can make decisions, execute tasks, and coordinate with one another without constant human oversight. As these agentic systems spread across enterprises, they are colliding with one of cybersecurity’s foundational models: zero-trust architecture. The core idea of zero trust is simple—never trust, always verify—but applying it to AI agents that operate independently raises a difficult question. If every interaction must be verified, who or what verifies the verifier?

What Happened

Vishal Sharma, a researcher at Queen’s University Belfast, outlines how agentic AI is straining traditional security boundaries. In one experiment, his team demonstrated that AI-driven de-authentication attacks against aerial vehicles can unfold in as little as two to three seconds, leaving almost no window for human intervention. The article also describes context recovery attacks, where agents are tricked into resurfacing information that was supposed to be deleted, undermining the assumption that instructions have been fully followed.

Another concern involves “vibe coding,” where developers hand over entire codebases to AI models for assistance. If that model is untrusted or operates outside organizational controls, vulnerabilities can sweep across multiple attack surfaces. Sharma notes that zero-trust frameworks rely on a policy enforcement point (PEP), yet that PEP itself must be trusted, creating a paradox at the heart of the architecture.

Why This Matters

When agentic systems fail, the consequences are rarely contained. A single rogue agent in a supply chain can force remediation across every system it touched, rather than a simple, isolated fix. Stateless agent workflows—where agents do not retain stable context—make it harder to establish trust provenance and verify that actions align with original intent.

The research highlights several emerging risks: horizontal anomalies, where agents behave correctly in one scenario but not across related components; replay attacks that exploit weak token revocation; and the absence of formal verification methods for AI model robustness. Without guardrails such as an AI bill of materials or distributed ledger technology for traceability, organizations may struggle to prove who did what, when, and why.

Key Takeaways

  • Zero trust assumes continuous verification, but agentic AI introduces autonomous actors that are difficult to monitor in real time.
  • De-authentication attacks can occur in two to three seconds, drastically reducing response time.
  • Context recovery attacks can cause agents to reveal data that was meant to be erased.
  • The policy enforcement point in zero-trust architecture is itself a single point of required trust.
  • Proposed mitigations include AI bills of materials, distributed ledgers for immutable logs, and formal verification of model robustness.

Conclusion

True zero trust may be an ideal rather than a fully realized state, especially when autonomous agents are involved. The question is no longer whether agents can operate efficiently, but whether organizations can verify their behavior, enforce policies consistently, and recover quickly when something goes wrong. As agentic AI moves into commercial deployment, security teams will need to balance short-term utility with long-term accountability—and decide how much risk they are willing to accept.