The Agent Identity Problem: Non-Human Identities Outnumber Humans 45 to 1 and AI Agents Are Making It Worse

Written by Jacob Krell | Jul 24, 2026 6:14:51 PM

At a Glance

Non-human identities already outnumber humans 45 to 1 in the average enterprise, and agentic AI is compounding that ratio faster than IAM teams can govern it.
Agent framework downloads outpace security tooling 83 to 1 on PyPI, a gap that widened 41% between January and May 2026.
Ninety-two percent of organizations say their current IAM tools cannot manage AI agent identities.
One in three agent framework CVEs involves identity, credential, or access control flaws, based on 77 CVEs analyzed from NVD.
Attackers exploit exposed AWS credentials within an average of 17 minutes, while nearly a quarter of organizations take over 24 hours to rotate them.
Sixty-four percent of secrets confirmed as exposed in 2022 remained valid four years later.
Forty percent of live Model Context Protocol (MCP) servers in a study of nearly 8,000 had zero authentication, and every OAuth-enabled server tested carried at least one flaw.

Why Agents Break the Identity Model

A service account sits in one system, holds one credential, does one job. An AI agent acquires permissions dynamically at runtime, spawns sub-agents, invokes external APIs, writes and executes code, and chains actions across dozens of systems in a single task. The blast radius of a compromised agent credential dwarfs what a static service account could produce, yet only 22% of security teams treat agents as independent identities.

A 2026 survey from the Cloud Security Alliance (CSA) quantified the gap with numbers that should alarm any Identity and Access Management (IAM) team. Ninety-two percent of respondents said their legacy IAM tools cannot manage AI and NHI risks, and half reported no clear ownership or accountability for agent identities. A separate CSA survey found that only 28% of organizations can trace an agent's actions back to a human sponsor across all environments.

These gaps are already being exploited. Nearly half of organizations have reported breaches involving non-human identities, and two-thirds have suffered successful cyberattacks from compromised NHIs. The Salesloft-Drift breach in August 2025 illustrated what this looks like in practice when the threat actor UNC6395 stole OAuth tokens from a single Drift integration and targeted Salesforce instances across over 700 potentially impacted organizations. No malware required, just token abuse at integration speed. Vercel's April 2026 breach ran the same play, with a compromised third-party OAuth integration exposing database secrets, signing keys, and customer credentials.

Over-permissioning is the accelerant. A 2025 report from the Non-Human Identity Management Group (NHIMG) found that 73% of secrets held by NHIs carry excessive permissions, and over 5.5% of AWS machine identities have full administrative privileges. When an AI agent inherits or acquires a credential at that privilege level, the distance between "authorized to do its job" and "authorized to do anything" collapses to zero. OWASP's Agentic Security Initiative classifies this pattern under ASI03 (Identity and Privilege Abuse).

The Adoption-Governance Gap, Measured

We quantified the adoption-governance gap directly using PyPI download data. Agent framework packages, including LangChain, LangGraph, CrewAI, OpenAI Agents SDK, LlamaIndex, and PydanticAI among others, pulled 483 million downloads in May 2026. Agent security and guardrails packages pulled 5.8 million in the same month, an 83-to-1 ratio that reveals just how far deployment is outrunning governance.

That ratio is widening. In January 2026 it was 59 to 1. By May, 83 to 1, a 41% increase in five months. Agent capability adoption is leaving security tooling further behind each month.

The Credential Lifecycle Gap

GitGuardian's 2026 State of Secrets Sprawl report measured 28.65 million new hardcoded secrets in public GitHub commits in 2025, a 34% year-over-year increase. AI-assisted development is driving much of that growth. AI-service secrets surged 81% to 1.275 million exposed credentials, and Claude Code co-authored commits leaked secrets at roughly twice the baseline rate.

MCP introduced a new exposure vector entirely. In the protocol's first year of adoption, 24,008 unique secrets appeared in MCP configuration files on public GitHub, partly because quickstart guides normalized hardcoding API keys directly into configuration files.

The remediation side is where the gap becomes structural. GitGuardian retested secrets confirmed as valid in 2022 and found that 64% were still not revoked by January 2026, representing four years of exposure for credentials that should have been rotated within hours. The attacker-defender timing asymmetry makes this negligence lethal. When AWS credentials appear publicly, attackers attempt access within an average of 17 minutes, while nearly a quarter of organizations take more than 24 hours to rotate exposed credentials. That is an 85x speed gap working in the attacker's favor.

Every AI agent deployed with a long-lived credential inherits that asymmetry.

The Agent Identity Blast Radius Model

Cross-referencing CSA, NHIMG, and ManageEngine data, we modeled what agent identity sprawl looks like for a 1,000-employee organization. The numbers compound fast. Only 12% of organizations have automated lifecycle management. The other 88% run on spreadsheets and hope.

Step	Calculation	Result
Total Employees	Baseline	1,000
NHI's at 45:1 ratio (CSA)	1,000 X 45	45,000
NHI's with over-priveleged secrets (73%, NHIMG)	45,000 X 0.73	~32,850
Full admin access (5.5%,NHMIG)	45,000 X 0.055	~2,475
NHI's after 2 years at 44% YoY (Entro)	45,000 x 1.44²	~93,312
Governed by automation (12%)	93,312 X 0.12	~11,197
Manually managed (88%)	93,312 X 0.88	~82,115

AI agents compound the sprawl because each agent deployed with enterprise credentials creates new OAuth grants, API tokens, and service accounts. Spawned sub-agents inherit or escalate those credentials, and every MCP server connection introduces an authentication surface that most organizations have not evaluated.

A measurement study of 7,973 live remote MCP servers found that 40% had no authentication at all. The servers that did implement OAuth fared little better, with every single one of the 119 OAuth-enabled servers tested carrying at least one authentication flaw. Dynamic client registration vulnerabilities affected 96.6%, and the researchers obtained 9 CVEs from the study.

Agent frameworks themselves carry identity vulnerabilities baked into the code that organizations are deploying at scale. Analysis of 77 CVEs across LangChain, CrewAI, AutoGen, and LlamaIndex shows that 32% involve identity, credential, or access control flaws, and 73% of all agent framework CVEs are rated CRITICAL or HIGH. Q1 2026 set a record with 14 agent framework CVEs in a single quarter.

A single MCP server connecting an AI agent to a production database with hardcoded credentials, no authentication, and no scoping is the default configuration.

The Regulatory Response vs. Reality

NIST's National Cybersecurity Center of Excellence and the Coalition for Secure AI both published agent identity guidance in early 2026, and the direction is consistent. Agents need first-class identities with zero-standing privilege, short-lived credentials, and code-bound attestation. Ninety-two percent of organizations told the CSA their IAM tools cannot deliver it. Agent deployment is not waiting for IAM teams to catch up.

What Organizations Should Do Now

Kill long-lived agent credentials. Every AI agent should receive short-lived, task-scoped tokens through a credential broker or gateway. The credential expires when the task completes. Sub-agent credentials should be scoped more narrowly than the parent's, never equal.

Treat MCP servers as a first-class attack surface. Forty percent have no authentication. OAuth 2.1 is the minimum, with per-tool authorization and human-in-the-loop approval for destructive actions.

Measure credential lifecycle speed. If revoking a compromised agent credential takes days, the organization operates 85x slower than the attacker who exploited it within minutes. Automated revocation triggered by exposure detection is the target state.

Identity governance spent decades solving for humans. Humans are now the minority of the identity population. AI agents will push the ratio from 45 to 1 to numbers the current IAM architecture was never designed to hold. Organizations that extend governance to agents will contain the blast radius. Those still running on legacy IAM will find out what an unmanaged agent credential can do at machine speed.

Sources

View full post