What the Guidance Actually Covers
The report, titled Protecting Tokens and Assertions from Forgery, Theft, and Misuse (NIST IR 8587), details how organizations should strengthen key management, token verification, and lifecycle controls. It also sets design principles for identity providers and authorization servers handling single sign-on, identity federation, API access, and workload access.
Tokens confirm identity and manage permissions across almost every cloud system in use today. When they’re compromised, the damage compounds quickly. NIST cited an incident where foreign actors used forged tokens from a stolen commercial signing key to access government email accounts, resulting in over 60,000 stolen emails from a single agency.
A Credential Leak of Its Own
The timing carries some irony. In May, a public GitHub repository linked to a CISA contractor was found to contain sensitive government credentials, including AWS tokens and GitHub access tokens. CISA stated at the time that no sensitive data appeared compromised, but the incident exposed weaknesses in credential management that fall outside traditional identity and access management systems entirely.
Where the Framework Breaks Down
NIST extends its token protection principles to AI agents, which also rely on signed tokens for system access. But the agency openly admits that AI introduces “additional IAM challenges” that this guidance doesn’t fully address, with new standards still under development.
Yih Khai Wong, a senior research manager at IDC Asia/Pacific, put it plainly: token hardening assumes a “known, bounded actor.” An agentic system “breaks that assumption” entirely. Enterprises need direct visibility into how agent credentials get provisioned and what permissions they actually carry, something the current framework doesn’t clearly account for.
Delegation Chains Make Authority Hard to Trace
The complexity compounds once agents start delegating tasks to each other. Amit Kumar Jena, head of AI development at Kanerika, explains that an agent acting on a user’s behalf can invoke tools and reach other services, creating chains of authority that become increasingly difficult to trace back to their origin.
Jena also flags prompt injection as a distinct risk. An agent holding a completely valid token could still be manipulated into taking an unintended action, and standard token verification has no way to catch that kind of misuse. Jonathan Ong, a senior analyst at Omdia, adds that a valid token never guarantees legitimate activity. Organizations need to watch for unusual access patterns, like unexpected locations or timing, regardless of whether the token itself checks out.
What Security Teams Should Do Now
Several recommendations emerged for treating AI agents as a distinct security category:
- Treat AI agents as low-trust, non-human identities rather than extensions of a user’s own permissions
- Grant only task-specific access, with higher-risk actions requiring human approval
- Maintain a dedicated agent inventory, kept separate from human account records
- Adopt shared-signal mechanisms like CAEP and RISC to respond quickly to token security changes
- Replace static, long-lived tokens with short-lived credentials wherever technically possible
Neil Shah, vice president at Counterpoint Research, points to these shared-signal frameworks as one of the more practical near-term fixes, since they let systems react to compromised tokens in real time rather than after the fact.
Hashlytics Take
NIST built this framework for a world where the thing holding a token is a person or a predictable service account. Agentic AI doesn’t fit that model, and the agency says as much in its own report. The gap here isn’t a minor oversight, it’s a structural mismatch between how token security has always been designed and how autonomous systems actually behave. Organizations rolling out AI agents now shouldn’t wait for the next NIST revision to treat agent identity as its own category. The framework will catch up eventually. The agents are already deployed.
Follow Hashlytics on Bluesky, Facebook, LinkedIn , Telegram and X to Get Instant Updates
