· MagenTrust Research
NIST says agentic AI is repeating decades-old identity mistakes. Agent identity is necessary. Knowing whether a human was actually present is the other half.
NIST just published a reminder that agentic AI is resurrecting identity problems the security community spent thirty years burying. It is worth reading closely, and it is worth reading to the end.
On August 27, 2026, NIST's Cybersecurity Insights blog published a post by Bill Fisher and Ryan Galluzzo of the National Cybersecurity Center of Excellence. Their argument is unglamorous and correct. Enterprises are racing to deploy AI agents, they are prioritizing features and demonstrable ROI over security, and in the process they are reintroducing identity and access management failures that the community has spent decades trying to eliminate.
The post walks through five of them.
Credential sharing. Users are handing personal and enterprise credentials directly to agents so those agents can reach data and applications. This is the same practice security teams have warned against since passwords existed. It destroys the ability to say who actually did a thing, which is exactly what regulated sectors depend on.
Static and long-lived credentials. Long-lived API keys and bearer tokens are the fastest path to a working proof of concept. They also prove nothing about identity. Anyone holding the key can use the key. These credentials end up sitting in config files, markdown files, and logs, and agents carry them across networks and tools.
Broadly scoped access. Least privilege has always been hard. Agents make it harder. They operate at machine speed, they reason probabilistically, and they will try multiple paths to reach a goal. Given broad access, an agent can take an unexpected route and cause real damage.
Local user accounts. Running an agent under a user's own local account is convenient and it is also impersonation by design. Every action the agent takes looks like an action the user took.
Over-reliance on human-in-the-loop. This is the one worth sitting with.
NIST draws a direct line between agentic approval prompts and MFA bombing. In an MFA fatigue attack, an attacker floods a user with push notifications until the user approves one just to make it stop. A chatty agent produces the same conditioning through entirely legitimate means. Approve, approve, approve, because the workflow will not move otherwise.
The result is that human-in-the-loop stops providing the accountability it was introduced to provide. The click still happens. The meaning behind the click is gone.
An approval that a human gives without attention is not a control. It is a log entry.
There is a second issue in the same section. Agents can request additional input from a user mid-task, including through elicitation in the Model Context Protocol. That mechanism is genuinely useful for keeping an agent aligned with intent. It can also be used to ask for credentials or other sensitive data, which hands the agent the ability to impersonate the person it is meant to serve.
Enterprises can build agent registries, issue scoped credentials, and enforce policy on infrastructure they control. NIST notes that consumer-facing scenarios are considerably harder, because the relying party has little control over the agent's identity and often cannot tell an agent apart from a human at all. That gets worse when the agent is holding the user's credentials.
Standards work is underway. FIDO is exploring agent authenticators bound to user identities. Protocols such as OAuth 2.0, SPIFFE, DPoP, Rich Authorization Requests, and Transaction Tokens already cover a meaningful amount of ground for enterprise deployments. But NIST is candid that the consumer path is early, and it makes a point we would underline twice: the secure path has to also be the easy path, or credential sharing and impersonation will keep spreading.
Everything above answers a single question well: which agent is acting, and under whose authority.
There is a second question that agent identity cannot answer on its own. At the moment something consequential happens, was a human actually present and engaged, or was there only a session that a human once opened?
These are different questions because the answer to the first can be completely valid while the answer to the second is no. A correctly issued, tightly scoped, cryptographically bound credential still tells you nothing about whether the person behind it was paying attention when the approval fired. A user who has been conditioned to click allow is, from the system's perspective, indistinguishable from a user who read the request.
If your control model assumes that an approval implies human judgment, you are holding an assumption that consent fatigue quietly invalidates. The fix is not more prompts. It is knowing, continuously and passively, whether a human is genuinely present.
MagenTrust builds continuous human verification infrastructure. We derive entropy-based behavioral signals from natural interaction, so presence can be established without CAPTCHAs, without biometrics, and without collecting PII.
This is deliberately complementary to what NIST describes, not a substitute for it. Agent identity, delegated authority, scoped tokens, and short credential lifetimes are the foundation. You still need all of it. Continuous human verification sits on top and answers the question the identity layer leaves open.
Three places it changes the picture:
And on NIST's point about the secure path needing to be the easy path: friction is the reason people share credentials in the first place. Verification that runs passively does not create a new incentive to work around it.
This is what MagenMCP does in practice. When an agent reaches a consequential action, it calls MagenTrust over the Model Context Protocol, the current human confidence score is evaluated, and the call returns PASS, CHALLENGE, or INTERRUPT before the action executes. The approval gate stops depending on whether a conditioned user clicked yes.
NIST's closing recommendation is the right starting point. Do a clear-eyed assessment of your current IAM practices against existing standards, because agentic scale will amplify every gap you already have. Concretely:
The NCCoE Software and AI Agent Identity and Authorization project is the working venue for much of this, and NIST SP 800-207 remains the reference point for Zero Trust architecture.
NIST's conclusion is that established IAM standards are the foundation for the agentic protocols we will build next. We agree entirely. Our only addition is that a foundation is a floor, and there is a question that sits above it.
Strong identity tells you which agent acted and whose authority it borrowed. Continuous human verification tells you whether anyone was home.
NIST does not endorse any commercial product, service, or company. This post is an independent commentary on publicly available NIST guidance.
See how entropy-based behavioral signals establish human presence without CAPTCHAs, biometrics, or PII.