Why multi-agent AI security is broken (and the identity patterns that actually work)

Last Tuesday, a “harmless” coding agent in staging opened a PR, fetched secrets from the wrong environment, and kicked off a deploy it was never supposed to touch. Nothing “hacked” us. The agent did exactly what the system allowed. That’s the part I think a lot of teams miss with multi-agent setups: the problem usually isn’t model quality. It’s identity. Once you have more than one agent — planner, coder, reviewer, deployer, support bot, whatever — you need answers to very boring questions:...