Google Declares Zero Trust Insufficient for the AI Agent Era — Publishes Beyond Zero Framework
Google invented zero trust. On July 27, 2026, Google’s security team said it is not enough.
Heather Adkins, VP of Security Engineering, and Archana Ramamoorthy, Senior Director of Cybersecurity and Data Protection, published “Going Beyond Zero: A New Paradigm For Enterprise Security” — a follow-on to the 2014 BeyondCorp whitepaper that set the template for enterprise network security for a decade.
The paper’s premise: AI agents change the assumptions that zero trust depends on.
What Zero Trust Was Built For
BeyondCorp (2014) proposed that enterprise networks should not have a trusted interior. Every access request — regardless of whether it originated from inside the office or outside — should be verified against user identity, device health, and application context. No implicit trust from network position. No castle-and-moat perimeter that, once breached, grants lateral freedom.
The model worked. Google adopted it internally. Enterprise adoption followed slowly, then all at once after major breach disclosures demonstrated the cost of perimeter-centric architectures. By 2024, zero trust had become the compliance floor for financial institutions, healthcare systems, and government networks.
Why Agents Break It
The problem is that zero trust was designed to verify humans and their devices. AI agents are neither.
An agent provisioned with access to email, internal APIs, and a file system is, from zero trust’s perspective, a legitimately authenticated actor. It authenticated. Its permissions were granted. Every access it makes passes the control checks it was designed to make.
If that agent is compromised — through prompt injection, a malicious tool response, or model manipulation — it continues to pass the same checks. It is not changing its identity or device posture. It is still the same agent, with the same credentials, operating with the same authorised scope. The attack surface is the model’s reasoning, not the network boundary.
Google frames this as AI “changing the assumptions around how enterprise security works.” AI agents are deployed globally to increase operational velocity and productivity — and each deployment extends the enterprise attack surface into a domain that zero trust’s verification logic was not designed to cover.
The Context
This paper lands in a specific moment. The past six months have produced a catalogue of documented agent attacks: ANSI escape injection in MCP servers hiding malicious instructions from human reviewers, a €0.02 bank transfer turning a banking AI agent into a phishing machine, DeepMind mapping six attack types that turn ordinary websites into agent traps at an 86% success rate, and the formal demonstration that memory files persist injected instructions across agent sessions after refusal.
Google is also the enterprise AI vendor of record for a growing share of Fortune 500 deployments through Gemini for Workspace. The “Beyond Zero” framework is not purely academic — it describes the security posture Google expects its own enterprise customers to operate in while running Gemini agents on their internal data.
Whether the framework becomes an industry standard the way BeyondCorp did depends on specificity and tooling. BeyondCorp succeeded because Google published not just the principles but the implementation architecture, and the broader industry had a decade to build products around it. “Beyond Zero” is an argument for a new paradigm; the standards work and product implementations will follow. The pace of agent deployment means that delay has a cost.