AI agents don't need to break in. They drift.

On 9 September 2026, Orchid Security announced identity drift detection and application-level kill switches for AI agents, alongside new integrations with Palo Alto Networks' Idira and Splunk Enterprise Security (Help Net Security, 9 September 2026). The pitch is specific: agents can reach authorised objectives from beyond their original privilege level within seconds, and they do it without breaking any security control or workflow guardrail. They use identity debt that is already there: hard-coded credentials, orphaned accounts, service accounts cloned from something that once worked.

Roy Katmor, Orchid's chief executive, frames the problem as a board-level one rather than a technical one: "Boards are no longer asking whether AI will be adopted, they are asking why it is not moving faster, and security cannot answer with a blanket 'no'. Enterprises need to observe how agents act, understand when they drift, and govern them immediately, including terminating the authority through which they operate" (Help Net Security, 9 September 2026).

Shannon Wilkinson, CIO and CISO at Findlay Automotive Group, put the same tension in plainer terms in the same coverage: "The challenge is how to enable the business to move faster and realise the productivity that AI agents bring, but it honestly terrifies a lot of us... we must define guidelines, put guardrails in place and, above all, know what the identities are doing" (Help Net Security, 9 September 2026).

Why it is not an isolated incident

Orchid's own research gives the launch its baseline: its Identity Gap 2026 report found that 57% of enterprise identity is unseen and unmanaged (Orchid Security, Identity Gap 2026; coverage: Help Net Security, 9 September 2026). That is the raw material for drift. If more than half of identity is already outside anyone's view, an agent that inherits or clones one of those identities inherits whatever it was never audited to hold.

The agent-specific picture is no better. Reco's State of Agent Security 2026 (2026) analysed 500 published MCP servers and telemetry from over 260 AI agents and applications, and found four in five AI tools operating with no IT oversight at all, and 414 unsanctioned AI tools per 1,000 employees at small and mid-size firms despite 79% of SaaS use being formally authorised (Reco, State of Agent Security 2026). The same research found that 50% of the 500 agent tools it examined can execute shell commands on the host machine, and 40% combine command execution, file access and network egress in a single tool, the full set a working exploit needs (Reco, State of Agent Security 2026).

None of these figures describe an attack. They describe standing capability sitting unreviewed inside ordinary deployments, which is precisely the condition Katmor is describing when he says agents do not need to break anything.

What it means for a regulated enterprise

For a regulated organisation, an unreviewed identity with drifted authority is an open item against obligations that already exist. Under the EU AI Act, record-keeping requirements assume an organisation can state what a system did and on whose authority; that assumption fails the moment the identity behind an action was never catalogued. NIS2 puts cybersecurity risk management on management as a personal responsibility, and a cloned service account with authority nobody signed off is exactly the kind of risk that obligation is written to catch. Access reviews under ISO 27001 and SOC 2 control mappings work by enumerating accounts, and an agent's service account is still an account, whether or not anyone remembers creating it.

The practical exposure is that a regulator, an auditor or a board asking "what could this agent reach, and did it reach further than intended" gets answered from memory rather than from a record. That is the gap Orchid is naming, and it is not specific to Orchid's customers.

What actually addresses it

The mechanism Orchid is shipping has three separate parts, and they are worth naming separately because each does a different job. Identity hygiene and risk findings establish a baseline: what does this agent actually hold, right now. Continuous drift detection compares that baseline against observed behaviour over time, so a widened scope or an inherited permission shows up as a deviation rather than staying invisible inside "it's working." Application-level kill switches then let a team act on that deviation at the scope of the one agent and the one credential, rather than shutting down the system it was talking to.

That third part matters more than it sounds. A blunt shutdown is expensive enough that teams hesitate to use it, which means drift often gets tolerated rather than corrected. A scoped kill switch removes that hesitation, because the blast radius of pulling it is the agent, not the business process behind it.

What to check on Monday

Before evaluating any vendor, an organisation can run a version of this exercise on its own agent estate for free:

• Pick one production agent and list every credential behind it, not the ones it was issued, the ones it can currently reach, including anything inherited from a cloned service account.
• Compare that list against the agent's original approved purpose. Where the two diverge, that is drift, whether or not anyone calls it that.
• Ask who would notice if that agent's permissions widened again next week, and how, and how long it would take.
• Confirm that revoking one agent's access does not require taking down the system on the other end of the connection.

An organisation that cannot complete the first bullet in under a day has already found its answer.