AI agents are the fastest-growing kind of non-human identity, and they bring every classic NHI problem plus several new ones. Our Top 10 NHI Issues covers the foundations. This companion list focuses on the identity issues specific to AI agents and agentic systems: common problems as organisations move agents from pilots to production, why each matters and what to do about it.
The Top 10 at a glance
- Agents running on human credentials
- Shared and static agent credentials
- Over-privileged agents
- No inventory, no owner
- Delegation without attribution
- Guardrails instead of access controls
- Uncontrolled tools and MCP servers
- Untrusted input meeting privileged action
- Unverified agent-to-agent trust
- No way to stop an agent
1. Agents running on human credentials
The issue: agents use a developer's personal access token, a user's session or an administrator's account.
Why it matters: every action looks like the human, access is far broader than the task needs, and the credential outlives the project.
What to do: give each agent its own identity; use delegated, scoped tokens when acting for a user. See the Agentic AI Identity Guide.
2. Shared and static agent credentials
The issue: many agents share one service account or API key stored in configuration files.
Why it matters: no attribution, no per-agent revocation, and one leak exposes everything (OWASP NHI2, NHI7, NHI9).
What to do: unique, short-lived, platform-issued credentials per agent. See the NHI Authentication Guide.
3. Over-privileged agents
The issue: agents granted admin or broad roles "so they work", during pilots that become production.
Why it matters: a manipulated or mistaken agent can do anything its credentials allow. In the PocketOS incident, an agent used an over-scoped token to delete a production volume and its backups.
What to do: least privilege and least agency; task-scoped, just-in-time access. See the AI Agent Authorisation Guide.
4. No inventory, no owner
The issue: agents built by teams, in low-code platforms, or by vendors, with no registry and no accountable owner.
Why it matters: nobody reviews their access, responds to alerts or retires them.
What to do: discovery, an agent registry and named owners. See the Shadow AI Discovery Guide.
5. Delegation without attribution
The issue: agents acting for users present tokens that show only the user, or only the agent.
Why it matters: systems cannot apply the right policy, logs cannot show who did what, and revocation is all-or-nothing.
What to do: delegated tokens that carry both identities, narrowing at each hop. See the Multi-Agent and A2A Security Guide.
6. Guardrails instead of access controls
The issue: relying on system prompts ("never delete production data") and output filters to prevent harmful actions.
Why it matters: instructions can be overridden by injected content or ignored under pressure; only enforcement stops an action.
What to do: enforce policy at tool gateways and resources; require platform-enforced approval for high-impact actions.
7. Uncontrolled tools and MCP servers
The issue: any MCP server, plugin or tool can be connected, often with long-lived tokens in configuration files.
Why it matters: malicious or compromised tools steal credentials or steer agents (OWASP ASI04).
What to do: allowlists, authorisation on remote servers, no static secrets in local config, change detection. See the MCP Security Guide.
8. Untrusted input meeting privileged action
The issue: the same agent reads external content (email, web, documents) and holds powerful credentials.
Why it matters: indirect prompt injection turns the content into commands executed with those credentials (OWASP ASI01, ASI02).
What to do: separate reading from acting, restrict egress, require approval when untrusted input precedes sensitive actions. See the Agentic AI Security Guide.
9. Unverified agent-to-agent trust
The issue: agents accept requests from other agents based on name or network location.
Why it matters: impostor or compromised agents can issue instructions others follow, causing cascading failures (OWASP ASI07, ASI08, ASI10).
What to do: mutual authentication, signed agent metadata and per-task authorisation between agents.
10. No way to stop an agent
The issue: no kill switch, no list of an agent's credentials and no attributable logs.
Why it matters: when something goes wrong, containment takes hours or days.
What to do: per-agent kill switch that halts execution and revokes all credentials, tested regularly. See the AI Agent Observability and Incident Response Guide.
Mapping to OWASP
| Issue | OWASP Agentic Top 10 (2026) | OWASP NHI Top 10 (2025) |
|---|---|---|
| 1. Human credentials | ASI03 | NHI10 |
| 2. Shared and static credentials | ASI03 | NHI2, NHI7, NHI9 |
| 3. Over-privilege | ASI02, ASI03 | NHI5 |
| 4. No inventory or owner | – | NHI1 |
| 5. Delegation without attribution | ASI03 | – |
| 6. Guardrails instead of controls | ASI01, ASI02 | – |
| 7. Uncontrolled tools and MCP | ASI04 | NHI3 |
| 8. Untrusted input and privileged action | ASI01, ASI05 | – |
| 9. Agent-to-agent trust | ASI07, ASI08, ASI10 | NHI4 |
| 10. No kill switch | ASI08, ASI10 | – |
Where to start
If you can only do three things this quarter: find your agents and give each an owner (issue 4), move them off human and shared credentials (issues 1 and 2), and remove admin rights while adding approval for high-impact actions (issues 3 and 6). Assess where you stand with the Agentic AI Identity Maturity Model.
Related NHI Mgmt Group resources: Top 10 NHI Issues · OWASP Agentic Top 10 Guide · Board and CISO Briefing · Agentic AI Security Policy Template
