AI Agent Identity: Security Risks, Governance & Best Practices
Learn what AI agent identity is, how it differs from traditional non-human identities, key security risks, governance best practices, and how to secure AI agents.
Rushali
All companies now employ two workforces. One uses a password and a photograph of his/her badge. The other authenticates using tokens, API keys, certificates, and already outnumbers the first by a lot. The number of non-human identities, credentials used by service accounts, bots, and more recently AI agents, is between 25 to 1 and 100 to 1, depending on the environment. The exposure is on pace: In 2025, researchers discovered nearly 24 million leaked non-human identity credentials on public GitHub, and 70 percent of the leaked credentials in 2022 were still active years later. The latest, fastest-growing component of that challenge is AI agent identity, and most security teams haven't begun to rein it in.
What is AI Agent Identity? Core Concepts
An autonomous AI system's credential and permissions for authenticating to other systems, calling tools, and performing actions without human approval is called an AI agent identity. On paper, it is a service account – an account ID, a secret/token, a specified scope. The difference between that older category and it is what happens once it is issued.
AI Agent Identity vs. Traditional Non-Human Identity (Service Accounts, API Keys)
A service account is used for one purpose, typically one purpose, and does it for only one user (it). A backup script is a script that will sign, move, and disconnect. Security teams have been developing a system of controls over that predictability: rotate the key, scope the role, log the call, for ten years. The pattern is traditionally known as workload identity, which is based on a static and single-purpose non-human identity (NHI).
An AI agent makes a breakthrough that shapes. The same agent may request data from a database at 9 a.m., send an email at 9:05, and update a customer record at 9:10, with all of this happening without a script – everything is dictated by the model, not the script. The only difference between service account and AI agent identity is that a service account's behavior is set at deploy time; an agent's behavior is determined at run time.
Why Agents Are Structurally Different: Intent, Decomposition, and Autonomous Tool Calls
No single instruction is executed by agents. They interpret a goal, decompose it into steps, and indicate which tools they require to do each step, sometimes creating sub-goals that require their own credentials. A research agent could be tasked to create a competitor report, and might choose to search the web, request a CRM, and then write a report to a shared drive, earning three sets of permissions in the process. Agent credential sprawl is the proliferation of these across the entire agent-oriented workforce, and confused deputy attacks are quite different from a cron job.
Why AI Agent Identity Has Become an Urgent Risk in 2026
An object is being hit by two forces. Agents are growing at a rate higher than any other form of automation, and the governance frameworks to control them don't yet exist in the majority of cases.
The Scale Problem: Machine Identities Outnumbering Humans
The number of identities per machine rose to 109, from 82 in 2015, according to Palo Alto Networks' 2016 Identity Security Landscape report. Other numbers are lower; in the average enterprise, it's 45 to 1, while in cloud-native environments with much microservice adoption it's higher than 140 to 1. The field of machine identity management was designed for static service accounts and certificates, and it is now expanding to a population that increases with each tool call.
The Governance Vacuum: 78% of Orgs Have No Identity Policy for AI Agents
In January 2026, the Cloud Security Alliance (CSA) and Oasis Security polled 383 IT and security professionals and discovered that 78 percent of organizations do not have an officially adopted policy for generating or destroying AI agent identities. The same survey revealed that 92 percent were not at all sure that their legacy IAM systems could handle AI and non-human identity risks. When there is a lack of policy, provisioning tends to go to the fastest agent, and non-human identity governance remains a project teams hope to see some day.
Core Risks Created by Ungoverned AI Agent Identities
When agents begin to receive their own identities, four patterns emerge time and time again, and each pattern has a common underlying cause: identities issued in a flash without ever being revisited.
Persistent Credentials and the "Persistent Blast Radius" Problem
Agent credentials earned in a pilot project usually don't get cleared up when the pilot project concludes. The agent is removed, but the token in a config file or Secrets Manager is not. This phenomenon was coined persistent blast radius by the Cloud Security Alliance's 2026 token sprawl study, about long-term active exposure from credentials that are outside their context, yet still usable quietly for a long time after they have been forgotten. Add to that incomplete inventories, and token sprawl becomes a liability – regardless of whether anyone is using the agent – and that liability keeps piling up quarter after quarter.
Overprivileged Agents and Confused Deputy Attacks
The agents usually receive wide access initially, as restricting access further down the track means that the workflows will need to be prototyped with each agent, which is unlikely to occur under a launch deadline. The outcome is that there are many overprivileged NHI accounts with an excessive amount of privileges. That excess access is the key to a confused deputy attack: The attacker tricks the agent into taking an action with its own legitimate credentials that the attacker would never directly be able to take. This is not the old-fashioned agent that we understand. It is obeying a direction from the wrong source.
Shadow Agents and Undiscovered Identities
Agents are now spun up by business teams, either through low-code platforms, browser extensions, or internal scripts, faster than security teams can keep up. Each one will normally have its own API key or OAuth token that is associated with a specific SaaS tool that the builder required. These shadow AI agents often aren't part of the official list, and their access to data and credentials is not subject to the same controls as authorized systems. An organization cannot revoke, rotate or audit an identity it doesn't know exists.
Long-Lived Secrets and Static API Keys: The 24M Leaked Credential Problem
A vast majority of agent-to-system connections use long-lived secrets as the default authentication mechanism, largely because they are easy to generate and hardcoded. There's a price to that convenience. The 2025 GitGuardian State of Secrets Sprawl report revealed that there were almost 24 million new leaked credentials posted to public GitHub in a year, with 70 percent of the leaked secrets still active when researchers checked years later. But the majority of those exposures were not sophisticated attacks. One did rotate a key into a public repository, but no one rotated it since then.
Frameworks and Standards Shaping AI Agent Identity
Standards organizations are generally behind the curve by 2 or 3 years. That gap, however, is narrowing at a clip that's even faster than usual, for AI agent identity moves beyond categories traditionally assigned to different teams: application security, cloud identity, and now agent behavior. Even analyst coverage has caught up with it, with KuppingerCole's Leadership Compass for Non-Human Identity Management also being released in late 2025, which classifies vendors on the basis of their ability to manage the machine and agent identity lifecycle, a move that indicates that NHI management is no longer a mere footnote in IAM.
OWASP Non-Human Identities (NHI) Top 10
The OWASP NHI Top 10 is a list created in the same manner as the original OWASP Top 10, and is designed to provide a ranked list of the most prevalent ways that non-human identities are exploited. The most recent of its entries is NHI1:2025, which is improper offboarding: identities that are not turned off properly and stay on far longer than they should. If you're just beginning to implement an identity security program with an AI agent, this list is a good starting point.
OWASP Top 10 for Agentic Applications (ASI01–ASI10)
OWASP Top 10 for Agentic Applications focuses on risks that are associated with the autonomous nature of the application, not on static application flaws. ASI01 is an attack that exploits the agent's inputs to alter the agent's goal. ASI02 is about misuse of tools; an agent does not go beyond what is allowed and does a destructive action. ASI03, Identity and Privilege Abuse, is closely related to identity and sees abuse of agent sessions, tokens, and roles via the same long-lived and overprivileged credential patterns mentioned above.
NIST's AI Agent Standards Initiative (Launched Feb 2026)
NIST's Center for AI Standards and Innovation announced the AI Agent Standards Initiative, the first U.S. government program specific to interoperability and security standards for autonomous agents, on February 17, 2026. It focuses on industry-driven technical standards, open-source protocols, and research on agent security and identity. Instead of creating a brand new authentication model for AI agents, a companion NIST concept paper suggests the use of existing standards, such as OAuth 2.0, OpenID Connect, and SPIFFE.
Gartner's 2026 Trends: Agentic Oversight (Trend 1) and IAM Adaptation (Trend 4)
Gartner's Top Cybersecurity Trends for 2026 are divided into two separate trends. Trend 1, Agentic AI Demands Cybersecurity Oversight, urges security leaders to recognize authorized and unauthorized AI agents and create playbooks on those agents that will be relied upon during incidents. Traditional IAM was never designed to register identities, automate credentials, or authenticate based on policies in an agent-centric fashion, according to Trend 4, Identity and Access Management Adapts to AI Agents. Gartner's suggestion: Pick the agents with the most privileges and least supervision first and start there.
Building an AI Agent Identity Governance Program
A framework communicates to a team what good is. It is not used to build the program. This work is divided into four practical levels, each one relying on the previous.
Discovery and Inventory: You Cannot Govern What You Cannot See
All governance initiatives begin with a complete inventory of what is there – all the agents, all the MCP servers, all the tools, all the connections, all the credentials associated with all of them – on infrastructure devices and employee devices alike. This is where programs typically get stuck, as agents are created outside of the channels that security teams typically watch. To address this, Akto continually identifies and records AI agents, MCP servers, and connected tools throughout an organization's infrastructure and endpoints to provide teams with a true organization inventory rather than an educated guess.
Lifecycle Management: Provisioning, Rotation, and Decommissioning
The three steps of human identity management must also be followed for agents: provisioning – defined ownership, periodic rotation, and decommissioning – retirement of an agent. The difference is how fast. A new agent can become active in minutes, requiring an 'approval step' to be built into the provisioning process, not added on, and the decommissioning process should be automatic, not rely on a person remembering a ticket.
Zero Standing Privilege and Just-in-Time Access
Zero standing privilege: an agent does not have any permissions except during a given task. When the just-in-time access is combined with this, it reduces the time that an attacker has to exploit an agent credential that has been compromised. This has to be done more engineering than broad and ever-on access, but it gets rid of the recurring exposure of blast radius.
Ephemeral, Context-Aware Tokens vs. Static Secrets
Secrets embedded in a static configuration file, such as an API key, are good until they're discovered. In contrast, ephemeral tokens are short-lived tokens issued temporarily for a single session, limited to the context of the agent, and automatically revoked after the session. A leaked ephemeral token is actually a much easier problem than a leaked static key, because, often, the token has passed its validity date before it is used by an attacker.
A Maturity Model for AI Agent Identity Management
Most organizations are on a journey, not at a fixed destination, and it is useful to describe the stages of the journey.
From Ad Hoc Provisioning to Continuous Behavioral Verification
The first one sounds like what an agent wants: shared credentials, general permissions, no documentation. The next phase is to add an inventory and a policy, followed by scoped, individually-owned identities. Further along, organizations move to zero standing privilege and ephemeral tokens. On the other side, opposite from one-time behavioral verification, is continuous verification, which verifies the identity of the agent during the call on a regular basis, rather than only when logging on, according to whether their actions match what they are supposed to do.
Where Most Organizations Actually Stand Today (Only 8% Report High Confidence)
There are very few organizations that are very close to that far end. The same CSA and Oasis Security survey revealed that just 8 percent of respondents were highly confident in their legacy IAM systems' ability to handle AI and non-human identity risks. The remainder are somewhere in between the extremes of ad hoc and inventoried, and a formal program of AI agent identity management is yet to be developed.
Runtime Enforcement: Identity as a Control Plane, Not a Report
A quarterly access review does not report on what a team did between quarterly access reviews; rather, it reports on what an agent was authorized to do between the reviews. That's where the damage occurs for autonomous systems that must decide in real-time.
Moving from Retrospective Attestation to Live Policy Enforcement
The concept of retrospective attestation arose when most decisions were made by humans and the machines were programmed to follow predetermined instructions. That's the opposite of runtime policy enforcement: policy is checked and applied at the time of action, not weeks later in a report no one reads till there is an incident that raises the question.
Cryptographic Workload Attestation for Agents
Cryptographic workload attestation is based on the idea that the agent is authenticated with a proof that is specific to the workload, rather than with a shared secret that can be copied or leaked, as SPIFFE and SPIRE provide verifiable identities to services. For agents in AI, this means that a valid token was presented and that it was the exact same token sent to the unmodified agent it was issued to.
"Identity Proved by Behavior, Not a Static Badge"
A badge is a record of what someone is doing at the time of issue, not what he is doing an hour later. It is becoming more common to continually challenge agents rather than relying on a one-time credential, as in banking fraud detection. In an approach that ties back to runtime enforcement, Akto uses continuous red teaming and guardrails against each agent's identity that flag and block unusual behavior as it occurs, before it can be discovered in a log a few weeks later.
How Akto Secures AI Agent Identity
The above sections outline the characteristics of a mature identity security program for AI: discovery, lifecycle management, least privilege, and runtime enforcement. Akto doesn't cover that entire slice; it's the entire set.
Agentic AI Discovery Across Infrastructure and Employee Devices
Akto automatically identifies and catalogs AI agents, MCP servers, LLMs, and the tools and resources that they interact with, both on the cloud and within internal systems and employee devices. That inventory is the basis for all the rest, after all, and if you don't know that there is an agent, you don't know who owns it, how you can grant permission to it, etc., and how long it will remain in existence.
Continuous Red Teaming and Runtime Guardrails Tied to Agent Identity
In addition to discovery, Akto continuously red-teams AI agents and MCP servers to identify risks such as prompt injection, tool misuse, privilege escalation, and other agentic attack techniques before attackers can exploit them. Runtime guardrails help prevent unsafe agent behavior in real time by enforcing security policies across AI agents, MCP servers, tools, and LLM interactions. Akto is available as a self-hosted or cloud-managed platform, helping enterprises secure their agentic AI environments from development through runtime.
Best Practices Checklist for AI Agent Identity Security
The majority of the controls in this piece can be boiled down to a few controls that an organization can take action on this quarter:
Know all the AI agents, MCP servers, and tools connected, including outside of security's awareness.
Every agent identity should have a named owner, like a human account would have a manager of record.
Where possible, use ephemeral, scoped API keys instead of static, long-lived ones.
Do not give standing privileges by default, only for a specific task.
Rotate and revoke agent credentials when it's time, not when someone thinks of it.
Assign agents to OWASP NHI Top 10 and OWASP Top 10 for Agentic Applications to prioritize gaps.
Shift from periodic access reviews to runtime policy enforcement, intercepting bad behavior at the time.
Don't acknowledge a leak of an agent credential as an alert; treat it as a rotation event.
Final Thoughts on AI Agent Identity
All of the controls discussed herein are needed because AI agent identities are unlike the service accounts that security teams are familiar with today. In the past twelve months, there has been guidance from OWASP, NIST, and Gartner, but there still remains a lack of formal policy in most organizations, as indicated in the CSA and Oasis Security data. It's not possible to wait for a standard to be established because the number of agents keeps growing.
Akto identifies all the AI agents, MCP servers, and connected tools that you have deployed in your infrastructure, as well as on devices used by your employees, and actively red-teams them while enforcing runtime guardrails based on each agent's identity, bridging the divide between what a program must cover and what it actually monitors. If you aren't sure about what an AI agent is, or if you are unsure whether AI agent identity still exists within your organization, book an AI Agent security demo and experience what Akto discovers in your environment.
Frequently Asked Questions: AI Agent Identity
How is an AI agent's identity different from a traditional service account?
A service account is a particular account that is used to run a particular service throughout its lifetime. It is very difficult to infer from the description what it actually will do, as it is performed at runtime and the agent gets permissions in the middle of the task.
How many non-human identities exist compared to human identities in a typical enterprise?
This varies based on the environment, and can be estimated at 25 to 1 or 100 to 1. Palo Alto Networks' 2026 Identity Security Landscape report states that the average is 109 to 1.
What is a "confused deputy" attack in the context of AI agent identity?
An attack in which an adversary leads another agent (usually through a poisoned document or through an adversary-generated input) to take certain action on behalf of the adversary, which the adversary could not have taken directly on his own with the credentials of the other agent.
What is "persistent blast radius," and why does it matter for AI agent credentials?
A term used by the Cloud Security Alliance that refers to credentials that are so pervasive that when they are forgotten, they remain valid for a considerable amount of time.
What is the OWASP Non-Human Identities (NHI) Top 10?
An expanded list of the most common risks to non-human identities, similar to the original OWASP Top 10, with the top risk being improper offboarding.
How many organizations actually have a policy for creating or removing AI agent identities?
Per a January 2026 Cloud Security Alliance and Oasis Security survey, 78 percent have no documented, formally adopted policy for creating or removing AI agent identities.
What is zero standing privilege, and how does it apply to AI agents?
No permissions are granted on an identity until a task is running on it, and then only for the duration of the task and no longer, minimizing the potential harm that a compromised credential could cause.
Why can't traditional IAM and PAM tools govern AI agent identities effectively?
They are designed for “static” and “predictable” non-human identities such as service accounts. Actions are dynamically determined by the agents and permissions are gained during execution, which was not the use case of legacy IAM/PAM platforms.
What is cryptographic workload attestation?
A mechanism that allows for proving identity by a cryptographic proof that is based on the work itself and therefore proves that the credential has been issued to the same and original agent and not just a shared secret.
How should organizations start building an AI agent identity governance program?
Discovery and inventory are the first steps: without knowing what agents exist, nothing downstream will work. Then introduce lifecycle management, zero standing privilege, zero ephemeral tokens, and, on top of all of that, runtime enforcement.
What frameworks and standards currently govern AI agent identity?
The OWASP Top 10, the OWASP Top 10 for Agentic Applications, NIST's AI Agent Standards Initiative and Gartner's 2026 cybersecurity trends, to name just a few, and analyst coverage such as KuppingerCole's Leadership Compass for Non-Human Identity Management.
What does a maturity model for AI agent identity management look like?
It starts with ad hoc provisioning with shared credentials, continues with inventoried, individually owned identities, and reaches its endpoint with zero standing credentials and ephemeral tokens, and progresses to continuous behavioral verification along the way.
How is Gartner's 2026 guidance addressing AI agent identity?
In the two trends: Trend 1 is to identify sanctioned and unsanctioned agents; Trend 4 is to adapt IAM to agent-scale credential automation.
How does Akto help discover and secure AI agent identities?
Akto is able to discover and catalog AI agents, MCP servers, and associated tools running on infrastructure and employee devices, and continuously red-team the assets and enforce runtime guardrails for both the inventory and enforcement layer AI agent identity requires.
Important Links
Experience enterprise-grade Agentic Security solution