AI agents that pass authentication can still drift, expose data, or get memory-poisoned

CISA added a LiteLLM vulnerability to its Known Exploited Vulnerabilities catalog after attackers abused it in the wild, including a gateway-mediated RCE that chained with a second flaw and required no credentials. The article argues enterprise AI agent security is failing when gateways (token/API checks) are deployed before identity, delegation, attribution, and telemetry context, recommending a “six-gate” dependency sequence for agent controls. It also cites Okta and Teleport survey results showing low parity in agent vs. human security rigor (only 34% always match human rigor) and higher incident rates in over-privileged AI environments (76% vs. 17%).

Analysis

The spend implication is less about “AI security” and more about a new identity surface being pulled into existing IAM budgets. That favors platforms that already sit in the control plane for workload identity, delegated access, and lifecycle revocation; standalone gateway-style enforcement looks like a late-stage add-on, not the budget origin. For OKTA, the opportunity is real only if it becomes the system of record for non-human identities rather than a policy overlay on top of someone else’s directory.

This is not an immediate revenue inflection story. In the next 1-3 months, the catalyst is mostly procurement: enterprises will inventory agents, tighten scoped credentials, and ask for auditability before buying more runtime controls. The structural effect is 6-18 months out, when agent sprawl makes short-lived entitlements and kill paths unavoidable; if that happens, identity and PAM attach rates rise, but much of the revenue may flow to bundled cloud suites rather than pure-play security vendors.

The contrarian miss is that the market may be overbidding gateway/security point solutions while underweighting the boring plumbing of delegation and attribution. But the same logic also tempers enthusiasm for OKTA: if existing Entra-style estates can satisfy the control chain with configuration, the incremental wallet share is small. Falsifiers are straightforward: if large customers report material new agentic identity ARR or if Microsoft bakes native non-human identity features into its stack faster than expected, OKTA’s upside thesis fades.

Key Decisions for Investors

• Long MSFT / short OKTA as a 1-3 month relative-value pair: thesis is that agent identity monetization is more likely to be bundled into Entra/M365 than won by a standalone IAM vendor. Target 8-12% relative outperformance; stop if OKTA shows clear agentic-identity attach in next print or MSFT commentary is silent while OKTA re-accelerates.
• Do not add to OKTA purely on this theme. Treat it as a watch item until management proves native support for agent registries, delegation context, and short-lived credentials is converting into bookings, not just product messaging.
• Fade any near-term rally in AI-gateway/security names on this narrative alone; if you want exposure to the spending theme, prefer identity/control-plane winners over runtime-enforcement proxies. Reassess if a major enterprise customer announces production-scale agent deployment with attributed telemetry requirements.