Presented by 1Password
Enterprises have wired AI agents into the systems that run their businesses, and they have done it faster than they can govern them. The gap between what an agent is able to do and what anyone in the organization can see, approve or revoke is substantial. Identity security is where that gap lives, and overprivileged agents are already exposing how little control organizations have over their access.
That mismatch is clear in new research from 1Password that found that 65% of developers are expected or encouraged to use AI agents, while only 33% say they have a highly secure way to do so. That divide reflects a broader governance gap organizations are facing because they’re deploying AI agents before they've established the controls to govern them, says Jason Meller, VP of Product at 1Password.
“The problem is that we’re almost at the endgame, in terms of operationalizing agentic AI, but we’re still in the beginning stages of talking about a solution for the governance gap,” Meller says. “It’s caused organizations to be completely on their back foot. The pace of change is so extreme that unless organizations are learning and adapting on an almost daily basis, there's no way they can stay ahead of agents, or emerging AI-powered attackers.”
AI agents are inheriting a broken access model
The security habits that agents inherit were already on shaky ground. 1Password found that 71% of respondents were handling secrets through at least one unsafe method. Among developers, this included 24% who hardcode credentials, 20% who pass them through Slack or email, and 43% who work without a dedicated vault.
These practices predate agents by years, and organizations tolerated them because the way software used credentials was predictable. AI agents change that assumption. They’ll use the access granted to them to complete a task, making it difficult for security teams to govern what they’re accessing in real time.
“We’re used to having computer programs that act deterministically, but we still can't entirely predict agents,” Meller says. “Thus we need to create a whole new set of systems and understanding to be able to use them safely.”
A credential hardcoded into a script used to sit there as a latent risk that somebody had to find. On a machine running an agent, that same credential is now available to anything that agent decides it needs. Agents can cause harm without having malicious intent by using the access they’ve been granted in ways security teams don’t anticipate.
“If an AI agent on your computer sees a credential that might be useful to do something you asked them to do, they're going to go ahead and use it, whether you told them to or not,” Meller says. “Step one is getting that standing, hard-coded access off the machine and into a vault, so you can see what is actually doing the work.”
With 40% of developers granting persistent access to systems or credentials, many agents today have access to sensitive systems and credentials beyond what the task requires. This raises the stakes of every action an agent takes, since it could expose or misuse sensitive information before anyone knows. Overprivileged non-human identities are already causing damage with 27% reporting they’ve suffered a security incident or a breach from an overprivileged non-human identity.
AI agents are accessing more data than they are approved to touch
Access is where an agent's value and risk converge. At 41% of organizations, agents are touching data they were never approved to use. That pattern extends across every category measured, with actual access roughly twice the authorized rate.
Part of the reason is that agents are being governed with tooling that was designed for people. Thirty-five percent of organizations manage AI agents under their existing identity and access management processes, and 21% have not formalized an approach at all. Because an agent occupies the space between a user and a service account, it can sign into one system through a human login flow and reach the next through a backend integration. This means a single task can draw on two different kinds of credentials.
Seventy-one percent of respondents report gaps in visibility into which agents are using which credentials. Even among organizations that describe their own approach as highly secure, half still report visibility gaps into credential use. Underneath all of it sits a plain identification problem, which is that many organizations struggle to separate an agent’s activity from a person’s.
That leaves security teams unable to tell when an agent has crossed an access boundary or reconstruct what happened afterward. By the time its activity draws attention, the organization may be trying to determine what the agent did, which credentials it used and who should answer for it.
The attribution problem no one has solved
When something breaks, no one agrees on who should answer for it. Asked who is accountable in practice, responses were scattered across team leads, individual users, and executives, with 65% saying someone other than the current owner should carry the responsibility.
Agents can’t carry the responsibility themselves. “Agents are not people. They have no legal agency, so accountability has to be shared across the user and the security team that sets the guardrails,” Meller says.
Shared responsibility is both the right answer and the hardest one to operationalize, because apportioning it means reconstructing what actually happened. An agent often authenticates with a person’s credential, which means the audit log records the name of a person who may have had no idea what the agent was doing.
Attribution depends on an audit trail that distinguishes the agent from the person and connects each action to the authority behind it. Without that evidence, organizations are left assigning responsibility without a reliable account of what happened.
What leaders should be doing now
When asked what would make organizations confident enough to deploy agents more broadly, only 5% said they needed nothing. The rest pointed to specific controls, including a centralized view of access across humans and agents (52%), just-in-time credentials that expire after each task (47%), complete audit trails (51%), and clear accountability for each agent’s actions (53%). There are a few ways to get there:
1. Discover every identity already touching your systems
You cannot govern an inventory you do not have, and no amount of policy will close that gap on its own. That means looking past IT-sanctioned applications to the service accounts, API keys and agents operating outside traditional identity systems, including in browsers and on local devices.
2. Extend governance to the developer machine and the endpoint
Much of the exposure starts locally, with credentials hardcoded into scripts, stored in plaintext files, or left in a repo on the same machine an agent is running on. Governance that stops at the perimeter will miss the place where developers and agents actually do their work.
3. Replace standing access with just-in-time, scoped grants
Granting access only when a request is approved, then removing it when the work is done, prevents permissions from lingering.
4. Work toward keeping credentials out of the agent’s context entirely
The stronger approach brokers authentication outside the model, so a trusted authority holds the secret and issues short-lived access at request time. Credentials never entering the agent’s context window means the agent can’t leak what it never sees or leave access behind.
5. Build an audit trail that captures who or what authorized every agent
Every action should be traceable to the human or system responsible for it. Attribution is the foundation for the controls above because organizations can’t reliably enforce policy or investigate activity without knowing what authorized the action.
“The AI transformation is now being decided by frontline employees on an individual basis, which is untenable and will result in a number of really bad outcomes,” says Meller. “The companies that succeed will be the ones that give those employees a secure way to do the thing they are already doing.”
Learn more about 1Password Unified Access, the identity security platform for governing access across humans, AI agents, and machine workloads. For organizations looking to secure AI agent access, Unified Access offers 1Password Privileged Access to grant agents just-in-time access without standing privileges, and 1Password Credential Broker (now in public preview) delivers machines and agents' scoped credentials at runtime.
Methodology: 1Password conducted this study using an online survey of 1,000 full-time employees in the United States at firms with at least 250 employees. The sample was evenly split between IT/security and developer/engineering roles and represented a range of firm sizes, seniority levels, and industries. Data was collected from May 26 to June 3, 2026.
Sponsored articles are content produced by a company that is either paying for the post or has a business relationship with VentureBeat, and they’re always clearly marked. For more information, contact sales@venturebeat.com.