Zero Trust for AI Agents

Anthropic released a zero trust for AI agents framework around May 27, 2026, structured as an ebook covering threat categories, tiered architecture, and defensive operations for enterprise AI agent deployment. Anthropic has a direct commercial interest in the framework because its own products, including Claude Code and Claude Co-Worker, are autonomous agents operating in enterprise environments. Zero trust is not a concept Anthropic invented. NIST published foundational guidance in 2020, and Anthropic is applying that existing principle specifically to agentic AI rather than claiming to have originated it.

Agents differ from traditional software in ways that make standard security controls insufficient. They use distributed tools, interpret instructions, execute operations without human initiation, preserve context across sessions, and communicate with other agents in multi-agent setups. They often operate with elevated privileges, and traditional identity systems designed for humans struggle to accommodate them. Critically, agents can compose tools, load external packages, or change infrastructure at runtime, meaning the supply chain can update dynamically during task execution rather than being fixed at deployment.

Prompt injection and instruction manipulation rank first on both the OWASP list and Anthropic's own threat list. Indirect prompt injection, such as hidden instructions embedded in an email attachment processed by an agent, is considered more dangerous than direct prompt injection. Tool and resource misuse is the second major category, involving agents exploiting undisclosed API routes or manipulated tool descriptor schemas. Malicious MCP servers have already been documented, and MCP servers carry their own integrations, dependencies, and vulnerabilities as distinct software components. A broader class of malicious software targeting tool and resource vulnerabilities is expected to emerge.

Unscoped privilege inheritance allows one agent to spin off a subordinate agent with more privilege than it needs, which can then be exploited. The OWASP principle of least agency extends least privilege to agentic applications, meaning agents should receive no more agency than required for their specific function. Telling an agent only about certain API endpoints does not prevent access to others unless those endpoints are physically shut off at the network level. Without controls over what is committed to agent memory or vector databases, injected data can cause agents to return information that should not be accessible, a threat category covering both memory poisoning and RAG poisoning.

Anthropic organizes agentic security into three tiers: foundation as the minimum viable level, enterprise for robust organizations, and advanced for high-risk or stringent regulatory environments. Agent identity and authentication is framed as the foundation for every other security capability because without identity, no other controls can be enforced. Foundation level requires unique cryptographic identifiers for each agent instance backed by cryptographic material, not just labels. Enterprise level requires certificate-based authentication with full lifecycle management. Advanced level requires hardware-backed identity stored in hardware security modules or trusted platform modules with remote attestation. API keys that are not hardware bound should be considered already compromised under a zero trust model.

Observability captures what agents do through logging and audit trails, while behavioral monitoring determines whether those actions are appropriate or suspicious. A complete audit trail should trace from the human user and API key through the agent identity, goal, prompts, tool calls, inputs, and governance policy outcomes. Input and output point checks are described as table stakes that are often over-emphasized relative to the broader security picture, analogous to taking a temperature rather than assessing overall system health. Integrity and recovery addresses what to do when agents operate incorrectly despite prevention and detection. Rolling back agents in critical functions is particularly challenging because those critical functions still need to be addressed even when the agent is compromised.

Approximately 90 percent of enterprises with AI deployments are described as not operating according to this framework and would be considered completely exposed. Anthropic's Mithos program is working with roughly 150 organizations on security audits, and that work may be driving some of the concerns reflected in the framework. Mid-sized and smaller organizations are expected to struggle to level up fast enough, making the near-term security landscape effectively a wild west. Attackers have equal access to agent coding and development capabilities, causing the pace of infrastructure threats to expand exponentially. The core argument in the guidance is that traditional zero trust frameworks are too static for dynamic agentic systems, and that practitioners must anticipate emergent and unpredictable capabilities rather than mapping controls to a fixed set of known behaviors.