Episode 202: When Identity Isn't Enough: Securing AI Agents at Runtime

AI agents authenticate with valid credentials, pass MFA, and then commit fraud — bulk data exports, cross-tenant queries, unauthorized payments — all with a clean token. The identity layer tells you who the agent is; it doesn't tell you what the agent should be doing. This session covers the emerging runtime enforcement layer for agentic AI: behavioral baselines, real-time fraud scoring, and why the post-2012 identity stack (DPoP, MTLS, device-bound sessions) is necessary but not sufficient when the threat is an authenticated agent acting outside its declared scope.

#Speakers

• Host: Mike Schwartz, Founder/CEO Gluu
• Guest: Roshan Shaik, Founder & CEO RuntimeAI

#Homework

• FBI IC3 PSA on AI-enabled OAuth token attacks (May 2026)
• Identity ≠ AI Security : RuntimeAI post, 4.5K impressions, strong identity community discussion
• RuntimeAI platform overview: https://www.runtimeai.io/

#Takeaways

• OAuth tokens and API keys are now high-value resources. AI agents can't be trusted to use them properly. So one strategy is to just replace their tokens with internal tokens without them knowing. However, it raises some interesting trust model questions in the applications. If the applications don't care about the contents of the JWTs, it's fine. But what if the application does care about the contents of the token, e.g. the issuer and claims?
• Runtime behavior analysis is a good idea. By having a baseline, anomaly detection can stop abuse even when authentication and authorization technically succeed.
• Agent governance needs inventory plus policy. Register the agent, understand its model, version, permissions, destinations, and then enforce policy inline as it acts.
• Expressing the authorization policies is still a challenge. An AI can convert an English language prompt into Rego, but an AI can't then also check if the Rego policy is right.
• OAuth + SPIFFE can work for agent identity.