Nebius security products lead: shared credentials and slow revocation remain AI agent risks

Nir Chervoni, head of security products at Nebius, said enterprises need to secure the infrastructure layer before AI agents go into production. In a recent interview, he argued that every agent should receive its own identity, credentials should be short-lived and scoped to specific tasks, secrets should be stored in a dedicated secrets manager, and organizations should maintain a complete audit trail. “Never rely on a guardrail to enforce something an access policy could enforce deterministically,” he said.

The interview cited a VentureBeat Intelligence pulse survey from August 2026 in which half of respondents said their organizations had AI agents in production. Among that group, 61% reported shared credentials among at least some of those agents. Separate September research found that only 14% of respondents said a named owner could revoke an agent’s access within minutes.

Chervoni also discussed confidential computing for GPU-based AI workloads. He said the trust boundary is expanding from CPUs to GPUs: data moving between CPU and GPU can be encrypted, and the GPU itself can be attested, allowing customers to verify the environment before releasing their keys. However, he cautioned that confidential computing does not address application vulnerabilities, prompt injection, or compromised legitimate identities.

On sovereign AI, Chervoni stressed the difference between data residency and data sovereignty. Residency only says where data sits, while sovereignty also covers who can access it, how it is processed, and who controls the protections. For regulated European customers, he said, this can mean dedicated capacity in an EU region, customer-controlled keys, just-in-time approved provider access, and zero-retention inference.