VentureBeat’s September 2026 Agentic Security and Identity survey asked 102 enterprises how they secure and revoke AI agent access. Forty described a program that enforces scoped identities and runtime permission checks, and 17 of those 40 then said some or most of their agents still share credentials. Only 14 of the overall 102 said they could revoke access within minutes.
Earlier this month, agentic security company Zenity Labs revealed what one compromised credential can reach when the execution role covers every agent in an account. A single prompt to one public-facing agent with a URL-fetching tool on Amazon Bedrock AgentCore returned its temporary AWS credentials. Because the default identity and access management (IAM) role covered every AgentCore resource in the same account and region, those credentials could launch other agents, read their sessions, and pull secrets.
The next day, Fireworks AI posted a security bulletin disclosing that an unauthorized third party had used compromised internal credentials to reach environment variables in customer evaluation jobs. Fireworks says it believes the attacker captured API keys and tokens stored as secrets in some affected accounts. Four days after detection, Fireworks completed one credential review, adding that more rotation was still underway.
AWS initially marked the error as "informative," and said it would require developer error to exploit. However, the excessive permissions remained in place until at least June 22, 2026, based on Zenity's last check, and the behavior appeared to be fully mitigated by September 29.
What the survey found on revocation speed
Among the 102 VentureBeat respondents who answered questions about revocation, 14 identified a named owner who could revoke access within minutes and 45 pointed to a security or platform team that could do it within hours.
Seventeen estimated they would need more than a day or a credential trace first, 10 were not certain they could revoke every agent at all, and 14 did not know.
The 17 who cited delays and the 10 who were unsure add up to 27 with a slow or uncertain answer. Thirteen of those 27 came from the 44 sharing credentials, three from the 34 giving each agent its own identity, and 11 from the 22 who could not say how their agents authenticate. That last group had the highest rate of any segment.
Andrew Obadiaru, CISO at Cobalt, told VentureBeat that agents break the service-account model at exactly that point. For a conventional service account, revoking the credential stops further requests, "but when it comes to agents and tokens associated with them, it’s slightly different. Even when you revoke those tokens, sometimes they move so fast for you to be able to claw them back.” The agents move faster than rotation cadence.
Shared credentials complicate independent revocation
A shared credential can authenticate a request without identifying which agent sent it. Revoking that credential can also break other workloads that use it. Scheduled rotation and secrets managers handle the lifecycle, but they do not answer the revocation question, which is whether one agent’s access can be withdrawn without disrupting the others.
Mike Sentonas, president of CrowdStrike, put the scoping problem in concrete terms from the Fal.Con stage on September 2, the same day CrowdStrike announced a new agentic identity provider. “Who is it shared with? What third-party systems can it access?”
Nineteen of the 102 September respondents run agents mostly on human or service-account credentials.
Enforcement without identity is theater
Seventeen of the 40 who described their program as enforcement then acknowledged that some or most of their agents use the same keys. They checked the box for scoped identities, then answered that some of those agents run on a credential someone else owns.
Jaya Baloo, co-founder of AISLE — which said Thursday it has signed a letter of intent to be acquired by Cohere, where Baloo will become global CISO — traced the tension to a layer below the agents. “In an average company, you have tens of thousands of service accounts. We have no clue what they’re doing. And now you’re adding AI to the mix with API keys, and you have no idea what they’re doing.”
Chris Goettl, Ivanti’s vice president of product management, told VentureBeat at RSAC that identity and data are “two additional threat landscapes that are evolving here and becoming more and more critical.” Attackers pre-buy credentials before they even start the intrusion. “I’ve got three identities for different parts of ACME Corp as well. Why don’t you go ahead and buy those.”
Shared keys are the fast path. An agent works on day one with whatever credential the developer already has, and nobody files a ticket for a new identity. Across the full sample of VentureBeat respondents, 35 of 102 give each agent its own identity, 45 share to some degree, and 22 could not say.
Credentials expire on schedule while permissions reach everything
NIST and CISA finalized Interagency Report 8587 on September 15, and it recommends that access and identity tokens should live no more than an hour. The report covers signed tokens and assertions, and a static API key is neither. Three weeks later, the credentials Fireworks believes were captured included the credential class the report set aside. AgentCore’s credentials were temporary and still reached every agent because the execution role’s permissions extended to every AgentCore resource in the same account and region. The credentials expired on schedule, but the permissions they carried while alive reached every agent in the account.
Goettl told Cyber Magazine in May that AI “is compressing the entire exposure lifecycle” and that “the result is a rapid compression of attack timelines, with the window between discovery and exploitation shrinking from weeks to hours.” Goettl added that security teams “cannot manually triage thousands of new vulnerabilities at machine speed every day or even every week.” A static API key with no expiry sits on the wrong side of that window.
Egiziago Cioffi, enterprise architect and CEO of SynSphere Italia, caught a production Azure OpenAI assistant answering every user with the indexing job’s permissions, not the person’s, and told VentureBeat in written responses that he moved the entitlement check into the retrieval path so the assistant checks who is asking on every request. The fix was a permissions change, not a revocation control, but 60% of requests still auto-resolve with it live, Cioffi wrote.
Okta, Microsoft, and CrowdStrike have each introduced agent-identity products. Only one of the 99 September VentureBeat survey respondents who listed tools named Microsoft's Entra Agent ID. The enterprises on shared keys listed none of these products.
The test you can run this week
Pick one agent you can safely take offline and time how long it takes to revoke that agent’s access without touching any other agent. If the answer starts with tracing which key it uses, your inventory is part of your containment problem. Not knowing how their agents authenticate put 22 respondents in that position, and 11 of them gave a slow-or-uncertain answer.
Forty of the 102 respondents reported a confirmed agent security incident or near-miss in the past year, and 12 do not track agent incidents at all. Twenty could not say how many agent identities their organization runs.
Goettl framed that blind spot at RSAC in asset-management terms. “If I’m just looking at the known known, I’m losing perspective, because I don’t know what those known unknowns and unknown unknowns are exposing my environment to.” Seventy-two plan to adopt a new or replacement agent security solution within the next 12 months. Adoption alone will not help if the credentials those tools govern are still shared.
Obadiaru’s inventory questions for service accounts are the ones to ask of agents. “Who owns it? What was it created for? What levels of access? When was it last used? If you don’t know what you have, you can’t protect against it.”