Your AI agents are employees now. Nobody onboarded them
Every agent you deploy gets credentials, data access and the ability to act — but almost no organisation manages them the way it manages people. That gap is the identity story of 2026.
When a person joins your company, they get an account, a defined role, a permission set and an offboarding date. When an AI agent joins, it usually gets an API key someone pasted into an environment variable.
That asymmetry is now measurable. CyberArk found 68% of organisations say they lack identity security controls for AI — at the same time as Gartner projects 40% of enterprise applications will carry task-specific agents by the end of 2026, up from under 5% the year before. CyntexaApp Verticals
Why agents are a different kind of identity
A human account is used by one person, at predictable hours, from a small set of devices. An agent account is used continuously, at machine speed, across every system it was wired into — and the whole point of an agent is that it acts without someone watching.
IBM's Dave McGinnis summarised it neatly on a recent security podcast: "Are agents the most helpful insider threat? Of course they are." The joke lands because agents need broad data access to be useful at all, which is exactly what makes them valuable to steal. IBM
And they are being stolen. X-Force found more than 300,000 ChatGPT credentials for sale on dark web markets in 2025, with chatbot and agent platforms becoming a target for infostealer malware as they get embedded deeper into workflows. Locally-run agent platforms such as OpenClaw have drawn particular scrutiny. IBMIBM
The failure mode
The problem is not that an agent turns hostile. It is that an agent's credential, once taken, behaves like an insider who never sleeps and never triggers a login anomaly, because it was never anomalous to begin with.
Security leaders describe this as a perimeter problem: non-human identities plus AI-accelerated attacks, compounded by real uncertainty over who is accountable when an agent gets something wrong. Cybersecuritytribe
Four things to do this quarter
-
Give every agent its own identity. Shared service accounts make attribution impossible after an incident.
-
Scope permissions to the single task. An agent that summarises tickets does not need write access to the ticket system.
-
Set an expiry. Credentials without a rotation date outlive the project that created them.
-
Log every action the agent takes, separately from application logs, so agent behaviour can be reviewed as behaviour.
None of this is new security thinking. It is standard identity hygiene, applied to a category of user that most organisations have not yet admitted is a user.