📄 中文摘要
预计到2026年，81%的企业计划采用零信任架构，但几乎没有企业将这些原则应用于自主人工智能代理。一个被攻破的代理API密钥或管理不善的服务账户可能会绕过整个零信任边界，成为2026年新兴的攻击向量。虽然81%的企业正在实施零信任，但97%的企业并未将零信任原则应用于AI代理身份。此外，服务账户、API密钥和代理凭证的安全审查力度比人类账户低40%。随着自主系统的被攻破，代理之间的攻击正在逐渐显现，可能会在基础设施中横向移动，带来更大的安全隐患。
人工智能代理的零信任：企业安全中的关键盲点
📄 English Summary
Zero-Trust for AI Agents: The Critical Blind Spot in Enterprise Security
By 2026, 81% of enterprises plan to adopt zero-trust architecture, yet almost none are applying these principles to autonomous AI agents. A single compromised agent API key or mismanaged service account can bypass the entire zero-trust perimeter, marking an emerging attack vector for 2026. While 81% of enterprises are implementing zero-trust, 97% are not applying these principles to AI agent identities. Additionally, non-human identities such as service accounts, API keys, and agent credentials receive 40% less scrutiny compared to human accounts. Agent-to-agent attacks are emerging, as compromised autonomous systems can laterally move through infrastructure, posing significant security risks.