Abu Dhabi AI firm flags security gaps as agents act with employee credentials

Abu Dhabi-based AI company ANSEN highlighted the security challenges of AI agents acting on users’ behalf, noting that agents can read emails, search files and trigger multi-step workflows with legitimate credentials Khaleej Times. Zheng Li, co-founder and Group Vice President, said a breach could involve an authorised agent making a wrong decision with the right credentials, complicating attribution.

The US National Institute of Standards and Technology warned in August that early deployments often share existing user accounts or long-lived tokens, a practice NIST says should be replaced by dedicated agent identities tied to the authorising party. Microsoft’s security guidance echoes this, urging firms to assign each agent a unique identity, limit its access and log the full activity chain.

Li added that permission scope should match the consequence of an action; agents may summarise alerts but should not disable services without additional checks. The Open Worldwide Application Security Project introduced an Agent Control Standard this month, calling for inspectable, traceable agents with clear access limits.

In the UAE, the federal government aims to move 50 % of sectors to agentic AI within two years, meaning identity, permission and audit frameworks will be critical as AI integrates into public services.