Ghost Identities, Poisoned Accounts, & AI Agent Havoc

BeyondTrust’s annual cybersecurity predictions point to a year where old defenses will fail quietly, and new attack vectors will surge.

Introduction

The next major breach won’t be a phished password. It will be the result of a massive, unmanaged identity debt. This debt takes many forms: it’s the “ghost” identity from a 2015 breach lurking in your IAM, the privilege sprawl from thousands of new AI agents bloating your attack surface, or the automated account poisoning that exploits weak identity verification in financial systems. All of these vectors—physical, digital, new, and old—are converging on one single point of failure: identity.

Based on analysis from BeyondTrust’s cybersecurity experts, here are three critical identity-based threats that will define the coming year:

1. Agentic AI Emerges as the Ultimate Attack Vector

By 2026, agentic AI will be connected to nearly every technology we operate, effectively becoming the new middleware for most organizations. The problem is that this integration is driven by a speed-to-market push that leaves cybersecurity as an afterthought.

This rush is creating a massive new attack surface built on a classic vulnerability: the confused deputy problem.

A “deputy” is any program with legitimate privileges. The “confused deputy problem” occurs when a low-privilege entity—like a user, account, or another application—tricks that deputy into misusing its power to gain high privileges. The deputy, lacking the context to see the malicious intent, executes the command or shares results beyond its original design or intentions.

Now, apply this to AI. An agentic AI tool may be granted least privilege access to read a user’s email, access a CI/CD pipeline, or query a production database. If that AI, acting as a trusted deputy, is “confused” by a cleverly crafted prompt from another resource, it can be manipulated into exfiltrating sensitive data, deploying malicious code, or escalating higher privileges on the user’s behalf. The AI is executing tasks it has permission for, but on behalf of an attacker who does not, and can elevate privileges based on the attack vector.

Defender Tip:

This threat requires treating AI agents as potentially privileged machine identities. Security teams must enforce strict least privilege, ensuring AI tools only have the absolute minimum permissions necessary for specific tasks. This includes implementing context-aware access controls, command filtering, and real-time auditing to prevent these trusted agents from becoming malicious actors by proxy.

2. Account Poisoning: The Next Evolution of Financial Fraud

In the coming year, expect a significant rise in “account poisoning”, where threat actors find new ways to insert fraudulent billers and payees into consumer and business financial accounts at scale.

This “poison” is driven by automation that allows for the creation of payees and billers, the requesting of funds, and linking to other online payment processing sources. This attack vector is particularly dangerous because it exploits weaknesses in online financial systems, leverages poor secrets management to attack in bulk, and uses automation to obfuscate the transactions.

Defender Tip:

Security teams must move beyond flagging individual account takeovers and focus on high-velocity, automated changes to payee and biller information. The key is implementing tighter diligence and identity confidence checks for any automated process that requests to modify these financial fields.

3. Ghosts in Your IAM: Historic Identity Compromises Catch Up

Many organizations are finally modernizing their identity and access management (IAM) programs, adopting new tools, like graph-based analytics, to map their complex identity landscapes. In 2026, these efforts will uncover skeletons in the closet: “ghost” identities from long-past solutions and breaches that were never detected.

These “backdated breaches” will reveal rogue accounts—some years old—that remain in active use. Because these compromises are older than most security logs, it may be impossible for teams to determine the full extent of the original breach.

Defender Tip:

This prediction underscores the long-standing failure of basic joiner-mover-leaver (JML) processes. The immediate takeaway is to prioritize identity governance and use modern identity graphing tools to find and eliminate these dormant, high-risk accounts before they are rediscovered by attackers.

Other Trends on the Radar

The Death of the VPN

For years, the VPN was the workhorse of remote access, but in modern remote access, VPN is a critical vulnerability waiting to be exploited. Threat actors have mastered VPN exploitation techniques, using credential harvesting and compromised appliances for persistent access. Using traditional VPNs for privileged access presents a risk that organizations can no longer afford.

The Rise of AI Veganism

As a cultural counterforce, 2026 will witness the rise of “AI veganism”, where employees or customers abstain from using artificial intelligence on principle. This movement, driven by ethical concerns over data sourcing, algorithmic bias, and environmental costs, will challenge the assumption that AI adoption is inevitable. Companies will have to navigate this resistance by offering transparent governance, human-first alternatives, and clear opt-outs. However, when it comes to cybersecurity, opting out of AI-driven defenses may be less of an option and could even shift liability back to the user.

An Identity-First Security Posture is Non-Negotiable

The common thread through these 2026 predictions is identity. The new AI attack surface is an identity-privilege problem, account poisoning is an identity verification problem, while backdated breaches are an identity lifecycle problem. As the perimeter widens, organizations must adopt an identity-first security posture by applying principles of least privilege and zero trust to every human and non-human identity.

Want to get a deeper look at all of BeyondTrust’s 2026 cybersecurity predictions? Read the full report here.

Note: This article was written and contributed by Morey J. Haber, Chief Security Advisor; Christopher Hills, Chief Security Strategist; and James Maude, Field Chief Technology Officer at BeyondTrust.

Found this article interesting? This article is a contributed piece from one of our valued partners. Follow us on Google News, Twitter and LinkedIn to read more exclusive content we post.