Passwords became a security problem because they could be separated from the people they were meant to authenticate. Once shared or stolen, the same secret could be reused until someone detected the misuse and revoked the credential. Enterprises have spent years moving away from that model toward access tied more closely to the identity and context of the person making the request.
AI agents are introducing the same weakness into automated workflows, but at machine speed and across multiple systems. A credential granted for one legitimate task can remain active after the work ends, the agent’s purpose changes, or the person who authorized it moves to another role.
Unlike a conventional application following predefined instructions, an agent may decide which tools to call and what steps to take. Lingering access can therefore be used in ways the person who authorized it never anticipated.
Consider an agent authorized to assemble a customer renewal proposal. It may need temporary access to a CRM platform, pricing files, email, and a contract system. If those connections rely on reusable tokens or a standing service account, the agent could retain access after the proposal is complete.
A malicious instruction embedded in a document, a compromised tool, or a later workflow could then cause the agent to retrieve or transmit information unrelated to the original assignment.
Reusable credentials are dangerous because they turn access into possession. Whoever or whatever holds the secret can use it until the credential expires, is rotated, or is revoked. That model is risky for human users. The consequences are greater when it is applied to agents that can call tools, interact with applications, and trigger workflows.
Teams often connect agents to existing credentials so the agents can perform business tasks. That shortcut makes the agent an independent holder of access rather than a temporary executor of a person’s instructions. It also combines two risks that enterprises have traditionally managed separately: the credential may be stolen, or the agent may use a valid credential to perform an unauthorized or unintended action.
Once that happens, the enterprise can lose the connection among the credential, the person who authorized its use, and the task for which it was granted. A conventional access log may show which token called an application programming interface and when. It may not show who instructed the agent, what objective the agent was pursuing, which intermediate decisions it made, or whether the resulting action remained within the original assignment.
Modern passwordless authentication offers a useful lesson for agent security. Instead of asking users to present a reusable secret, it relies on cryptographic proof tied to an authenticator and evaluates the identity, device, and context surrounding the request. This makes credentials harder to steal, share, or replay.
Agent access should follow the same principle without treating agents exactly like human users. Rather than storing a long-lived secret, an agent should request access for a defined purpose, with each request evaluated against the person’s authority, the agent’s assigned task, and the risk of the proposed action.
Any access granted should cover only the required systems, data, and actions, and it should end when the task is completed or the underlying authority changes. Agents may need to act quickly, but speed does not require permanent possession of sensit…