Every agent is an identity, and almost nobody governs it that way

Here is a question to ask about your organisation. If an AI agent you run did something it should not have last Tuesday at 14:32, could you say which agent, what credentials it held, what it could reach, and who authorised it? If the answer is “we’d have to look at which service account the team used,” you have the problem this article is about.

Research presented at Black Hat this year found that 88% of organisations reported a confirmed or suspected security incident involving an AI agent. Only 22% govern agents as distinct identities. Roughly a quarter have deployed purpose binding; about a fifth have an AI kill switch; under a third have AI-specific data-loss-prevention. And BeyondTrust’s identity index found three-quarters of completed investigations involved identity or privilege.

The Hugging Face incident is the same story told at a research lab. The agents got their reach because a self-hosted Artifactory instance was shared across every run and reachable when the internet was not. Nobody had asked “what identity is each sandbox operating under, and what can that identity reach?” — because the sandboxes were not thought of as identities. They were thought of as jobs.

This is a familiar failure with a new subject. Twenty years ago, organisations learned the hard way that service accounts — credentials used by software rather than people — needed to be inventoried, scoped and rotated like any other identity, because attackers went straight for them. Agents are service accounts that can reason about how to use their privileges. Every lesson from the service-account era applies, with less margin for error.

Governing an agent as an identity means four things. Each agent instance gets its own identity, so actions can be attributed. Credentials are scoped to the task and expire when the task does, so blast radius is bounded in space and time. Egress is controlled and logged, because the network is where a contained agent becomes an uncontained one. And there is an inventory, because you cannot govern what you have not counted — and most organisations have already wired up more agents than they know.

The deep dive is a practical guide to all four, including a method for finding the agents you have already deployed.