This is the fifth blog in a seven-part series on identity security as AI security.

TL;DR:

In mid-September 2025 Chinese state actors weaponized Claude Code to conduct the first documented large-scale autonomous cyberattack. The operation targeted large tech companies, financial institutions, chemical manufacturing companies, and government agencies. Separately, in late August, a credential compromise shut down JLR's factories for five weeks at a cost of £1.9 billion. Now imagine that same attack pattern executed by an AI agent that doesn't sleep and can try a thousand credential combinations while you're reading this sentence. It's here. These attacks don't just breach perimeters. They abuse legitimate access.

The defense isn't better firewalls. It's authorization: controlling what agents can do at each step, with human oversight when it matters. For cyber-physical systems, IAM isn't IT infrastructure. It's a safety system.

The stakes are no longer theoretical

The OpenID Foundation calls this the "ultimate challenge" for identity: governing agents whose actions have direct and potentially irreversible consequences in the physical world. Authorization, the access management half of IAM, becomes a fundamental component of the system's safety case.

Three incidents in late 2025 proved we're already there.

First, AI agents proved they can attack critical infrastructure autonomously. In September, Anthropic disclosed that a Chinese state-sponsored group had weaponized Claude Code for what security researchers called the first large-scale cyberattack run primarily by an AI. The agent did most of the work: scanning for vulnerabilities, writing exploits, harvesting credentials, moving laterally through networks. Among the targets: chemical manufacturing companies. Some were successfully breached. These are facilities where compromised credentials could manipulate process controls with catastrophic consequences.

Then, researchers proved the attack surface extends to any agent with physical access. In August 2025, researchers demonstrated that a poisoned Google Calendar invite could hijack Gemini to control smart home devices like lights, shutters, and boilers. The attack, which researchers call "Promptwareopens in a new tab," exploited a fundamental authorization gap: calendar-reading permissions shouldn't grant actuator-control permissions. The mechanism is identical. Only the consequences scale.

And credential compromise proved it shuts down factories. Fast. Jaguar Land Rover suffered what is widely regarded as the most economically damaging cyberattack in UK history. Attackers gained access through a JLR supplier and kept going until they hit production systems. Robots froze. Workers went home for five weeks. More than 5,000 businesses in the JLR supply chain were impacted. Now imagine that same lateral movement executed by an AI agent that doesn't sleep, doesn't make typos, and can try a thousand credential combinations while you're reading this sentence. That's the threat model.

The credential crisis is accelerating this

IBM's X-Force 2025 confirms the shift: abusing valid accounts is now the preferred way in, accounting for 30% of all incidents. The first half of 2025 saw an 800% spike in credentials stolen by infostealer malware. Non-human identity compromise (API keys, service accounts, OAuth tokens) is now a top initial attack vector.

It's already hitting AI systems. A supply chain attack on the OpenAI plugin ecosystem harvested agent credentials from 47 enterprise deployments; attackers had access for six months before anyone noticed. Manufacturing attacks surged 61% year-over-year. Same pattern every time: stolen credentials, lateral movement, real-world damage.

The perimeter won't save you

Traditional security focuses on keeping bad actors out. Firewalls. Network segmentation. Endpoint protection. All necessary. But AI agents aren't breaking in. They're already inside, operating with legitimate credentials.

The Promptware attack didn't breach a firewall. It hijacked an authorized agent. The Claude Code operation didn't exploit a network vulnerability. It harvested valid credentials and used them. These attacks succeeded because the agents had permission to be there. They just didn't have permission to do what they did.

The question isn't where agents can go. It's what they're authorized to do at each step once they get there.

Consider a water treatment plant. An AI agent monitors chlorine levels, regulates pressure, and responds to demand fluctuations. What's its authorization envelope? It should be explicit: maintain reservoir levels between X and Y, never exceed pressure Z, escalate to a human for anything outside those bounds. But if the agent inherited broad "manage water systems" permissions from whoever deployed it, a compromised agent could push chlorine to toxic levels or trigger pressure failures. Here's the test: does your authorization architecture even let you express these constraints?

Authorization as safety infrastructure

For cyber-physical systems, IAM transcends its traditional role. It becomes a safety and policy enforcement layer.

Identity tells you who's acting. Authorization tells you what they're allowed to do, action by action, with human oversight where stakes demand it. For agents controlling physical systems, that's the architecture that prevents explosions.

Aviation doesn't rely on pilots to remember altitude limits. Nuclear facilities don't trust operators to avoid unsafe configurations. These industries learned decades ago that human attention isn't a safety system. Engineered constraints are. NIST's Zero Trust Architecture (SP 800-207) codifies this: never trust, always verify, enforce least privilege at every decision point.

For AI agents controlling physical systems, authorization is that engineered constraint. Done right, it works like this: credentials get issued just-in-time, scoped to the immediate operation, and revoked the moment context changes. Tokens that don't exist can't be stolen. A compromised agent still can't exceed its authorization envelope. High-stakes actions trigger human approval. And every action traces back to a specific user, agent, and moment.

Here's what that looks like technically. RFC 8693 (OAuth 2.0 Token Exchange) enables delegation tokens that preserve context:

{

  "sub": "[email protected]",

  "act": {

    "sub": "maintenance-agent-7"

  },

  "aud": "manufacturing-api.example.com",

  "scope": "actuator:write",

  "exp": 1737043200

}

The sub identifies the human. The act claim identifies the agent. The scope defines exactly what's permitted. Not "manage systems" but "actuator:write" for one specific resource. The exp sets expiration: 5-60 minutes for cyber-physical operations, not months. When the maintenance window closes, the token dies.

The EU AI Act classifies AI systems used as safety components in critical infrastructure (including water, gas, and electricity) as high-risk under Annex III, triggering human oversight requirements under Article 14. For systems making thousands of decisions per minute, that can't mean humans reviewing each one. It means authorization systems that enforce boundaries programmatically and escalate only genuinely exceptional conditions.

The window is shrinking

Gartner predicts AI agents will reduce the time to exploit account exposures by 50% by 2027. Attacks that took weeks will take days. The Claude Code operation already showed what machine-speed attacks look like.

Organizations that build proper authorization architecture now will be the model when regulations tighten.

The path forward

With 21 billion IoT devices and millions of industrial robots now connected, AI agents have an expanding universe of physical systems they can access and control.

The governance question is simple: for every agent with access to critical systems, can your team articulate its authorization envelope? What credentials it holds, what those credentials permit, and whether those permissions exceed operational need? If the answer is "we don't know," that gap is your attack surface.

But the gap is closable. The same authorization patterns that secure financial transactions can secure water treatment plants, chemical reactors, and robotic arms. Identity tells you who. Authorization controls what they can do at each step, with humans in the loop when it matters. For cyber-physical systems, that's not access management. It's safety infrastructure.

The architecture exists. The question is whether you'll implement it before or after you become a case study.

Next: Blog 6 explores what happens when one agent serves multiple stakeholders with different permissions. When the CFO's agent answers questions in a shared Slack channel, whose access rights govern the response?