---
title: "Abu Dhabi AI firm flags security gaps as agents act with employee credentials"
slug: "abu-dhabi-ai-firm-flags-security-gaps-as-agents-act-with-employee-cred"
date: "2026-10-04"
category: "UAE"
author: "Tariq Al-Mansoor"
correspondent: "Tariq Al-Mansoor"
correspondentRole: "Gulf & Capital Correspondent"
readingTimeMinutes: 2
tags: ["Fintech","News"]
originalSourceUrl: "https://www.khaleejtimes.com/uae/abu-dhabi-firm-security-concerns-ai-agents-users-behalf"
canonicalUrl: "https://aurav.ae/abu-dhabi-ai-firm-flags-security-gaps-as-agents-act-with-employee-cred"
publisher: "Aura-V Intelligence (aurav.ae)"
---

# Abu Dhabi AI firm flags security gaps as agents act with employee credentials

> ANSEN warns that AI agents using employee accounts can blur accountability, prompting calls for dedicated identities and tighter permission controls.

## Key Takeaways (TL;DR)

- AI agents accessing emails and files can mask who authorized actions, raising accountability risks for businesses.
- NIST and Microsoft recommend treating agents as first-class entities with unique identities and audited permission trails.
- UAE government plans to deploy agentic AI in 50% of services, making clear control and audit mechanisms essential.

Abu Dhabi-based AI company ANSEN highlighted the security challenges of AI agents acting on users’ behalf, noting that agents can read emails, search files and trigger multi-step workflows with legitimate credentials [Khaleej Times](https://www.khaleejtimes.com/uae/abu-dhabi-firm-security-concerns-ai-agents-users-behalf). Zheng Li, co-founder and Group Vice President, said a breach could involve an authorised agent making a wrong decision with the right credentials, complicating attribution.

The US National Institute of Standards and Technology warned in August that early deployments often share existing user accounts or long-lived tokens, a practice NIST says should be replaced by dedicated agent identities tied to the authorising party. Microsoft’s security guidance echoes this, urging firms to assign each agent a unique identity, limit its access and log the full activity chain.

Li added that permission scope should match the consequence of an action; agents may summarise alerts but should not disable services without additional checks. The Open Worldwide Application Security Project introduced an Agent Control Standard this month, calling for inspectable, traceable agents with clear access limits.

In the UAE, the federal government aims to move 50 % of sectors to agentic AI within two years, meaning identity, permission and audit frameworks will be critical as AI integrates into public services.

---

*Original Think-Tank Source: [Abu Dhabi AI firm explores security concerns as AI agents act on users’ behalf](https://www.khaleejtimes.com/uae/abu-dhabi-firm-security-concerns-ai-agents-users-behalf)*