SailPoint Warns of AI Agent Permission Risks

Shūya Matsumoto of SailPoint’s Japanese subsidiary explained how to manage risks when using AI agents safely at Impress AI Days 2026, held September 15–16, 2026. He said a major risk is the lack of visibility into which person an agent is linked to, what permissions it holds, and what actions it can take as it independently accesses systems and data.

SailPoint Japan’s Identity Security Survey 2025–2026 found that 40% of companies had established governance policies, while 42% felt security risks were increasing. IT executives cited inappropriate data sharing (58%) and inappropriate data access (50%) as concerns. Matsumoto said the central issue is not AI technology itself, but what it can access. He added that executives outside IT have struggled to anticipate the risks, and that expectations for what AI should do can differ from understanding of the resources it actually accesses.

OWASP’s Agentic Applications Top 10 lists “identity and privilege abuse” as a risk. Misuse of permissions inherited by an AI agent can lead to privilege escalation or impersonation. Matsumoto said the damage could be more severe than in human-perpetrated misuse because agents operate autonomously at greater speed and scale. In Japan, “Cyber Risks Related to the Use of AI” ranked third in the IPA’s 2026 Top 10 Information Security Threats. Matsumoto said AI technology can become not only a target of attacks but also an attack tool or a route for information leaks.

Matsumoto cited three incidents. McDonald’s US hiring chatbot Olivia, made by US company Paradox.ai, had an exposed route to applicant data through an unattended test account. At US reservation-management software provider PocketOS, an AI agent found a token connected to the production API and used legitimate permissions to delete the production database and backups in 9 seconds. The autonomous ransomware JadePuffer examined its environment, inferred attack routes, and repaired itself quickly after a failure.

The three incidents shared a problem: who can reach which systems and data, and with what permissions. Matsumoto said AI technology, like people, needs governance that considers identity.

Shūya Matsumoto of SailPoint’s Japanese subsidiary explained how to manage risks when using AI agents safely at Impress AI Days 2026, held September 15–16, 2026. He said a major risk is the lack of visibility into which person an agent is linked to, what permissions it holds, and what actions it can take as it independently accesses systems and data.

SailPoint Japan’s Identity Security Survey 2025–2026 found that 40% of companies had established governance policies, while 42% felt security risks were increasing. IT executives cited inappropriate data sharing (58%) and inappropriate data access (50%) as concerns. Matsumoto said the central issue is not AI technology itself, but what it can access. He added that executives outside IT have struggled to anticipate the risks, and that expectations for what AI should do can differ from understanding of the resources it actually accesses.

OWASP’s Agentic Applications Top 10 lists “identity and privilege abuse” as a risk. Misuse of permissions inherited by an AI agent can lead to privilege escalation or impersonation. Matsumoto said the damage could be more severe than in human-perpetrated misuse because agents operate autonomously at greater speed and scale. In Japan, “Cyber Risks Related to the Use of AI” ranked third in the IPA’s 2026 Top 10 Information Security Threats. Matsumoto said AI technology can become not only a target of attacks but also an attack tool or a route for information leaks.

Matsumoto cited three incidents. McDonald’s US hiring chatbot Olivia, made by US company Paradox.ai, had an exposed route to applicant data through an unattended test account. At US reservation-management software provider PocketOS, an AI agent found a token connected to the production API and used legitimate permissions to delete the production database and backups in 9 seconds. The autonomous ransomware JadePuffer examined its environment, inferred attack routes, and repaired itself quickly after a failure.

The three incidents shared a problem: who can reach which systems and data, and with what permissions. Matsumoto said AI technology, like people, needs governance that considers identity.