A recent incident involving an agentic artificial intelligence tool called Einstein has sparked concerns in higher education. Einstein was able to log into the learning management system Canvas, watch lectures, write papers, and submit homework on behalf of students without their professors’ knowledge.
Josh Callahan, CISO for California State University, says that Einstein was a big wake-up call that highlights the challenge of assessing student learning in a way that captures their knowledge and ability to apply it. The issue is not limited to course management, but also extends to student portals, registration systems, financial aid platforms, and advising tools.
Sandeep Kumbhat, vice president and global field CTO for Okta, notes that AI is outpacing security, and higher ed IT teams are struggling without proper visibility into the tools being used. Higher ed leaders are realizing that the agentic AI problem is an identity security problem.
Related: SUNY outlines AI policy for public university IT
Isaac Galvan, community program director of cybersecurity and privacy for EDUCAUSE, says that agentic AI creates an identity and access management challenge because it can blur the line between a human user and a technology acting on that user’s behalf. They must address this challenge to ensure the integrity of the educational process.
One way to address the issue is to require in-person essay writing and test taking, or video calls where students can verify their identity. Callahan suggests that educators can also use a three-finger test to reveal any facial overlay, helping to prevent AI impersonation.
Higher ed IT leaders can also help by treating agentic AI as an identity and access management challenge. Viewing agentic AI through an identity lens is critical for long-term success.
To mitigate AI impersonation, institutions should implement more stringent controls and verification processes to validate users and their activities. Galvan recommends investing in identity and access management solutions that help verify genuine human presence.
Related: The Great School Ranking Mirage: Why Your Obsession with the “Top 10” Might Be Hurting Your Kids
Behavioral analytics can also detect agentic AI by tracking deviations from students’ typical behavior patterns on educational platforms. Network-level signals can help reveal AI impersonation by tracking technical metadata and connection behavior, providing valuable insights for IT teams.
Galvan advises that institutions can fight fire with fire by leveraging AI to bolster security. AI can support predictive pattern analysis of networks and improve monitoring and detection capabilities, allowing institutions to identify anomalies more quickly and accurately, and ultimately promoting a more secure learning environment.
Higher ed institutions can also discourage student use of agentic AI by making their tools simpler to use. Callahan says that student-facing tools should be easy enough that students don’t want or need to use agents, reducing the likelihood of AI impersonation.
Related: Shining Bright Without the Bite: Lab-Grown Diamonds Take Over Birmingham’s Jewelry Scene
Understanding agentic AI as an identity security problem is key to addressing the issue. By implementing more stringent controls and verification processes, institutions can help mitigate AI impersonation and ensure that students are held accountable for their own work, promoting academic integrity.
As higher ed institutions handle the challenges of agentic AI, they must prioritize identity security and governance. By doing so, they can help prevent AI impersonation and promote a more secure and authentic learning environment, ultimately supporting the well-being and success of their students.
The importance of identity security cannot be overstated.
