AI agent security in SaaS is exposing identity and token gaps

At a glance

What this is: This is a SaaS security analysis about AI-driven vulnerability discovery and the identity, token, and agent exposure it reveals.

Why it matters: It matters because IAM, PAM, and NHI programmes now have to account for faster discovery, faster abuse, and more hidden integration paths across human and machine identities.

👉 Read Reco AI's analysis of AI-scale vulnerability discovery in SaaS security

Context

AI-scale vulnerability discovery is the ability to find exploitable weaknesses across SaaS identities, integrations, applications, and AI agents faster than manual review can keep up. In identity terms, that means exposure is no longer limited to misconfigured logins or stale accounts. It extends to tokens, delegated access, and machine pathways that security teams may not even know exist.

Reco AI's framing points to a familiar governance problem with a different speed profile. When discovery accelerates, the gap is not just technical debt but identity debt, especially where service access, app integrations, and AI agent permissions have been granted without tight lifecycle control.

Key questions

Q: How should security teams govern AI agents and SaaS integrations together?

A: Treat them as one identity problem, not two. AI agents often operate through the same OAuth grants, service accounts, and API keys that already govern SaaS access, so the control point is ownership, scope, and lifecycle. If the organisation cannot say who owns the credential and when it expires, it has not governed the integration properly.

Q: Why do SaaS integrations create identity risk for NHI programmes?

A: Because integrations turn short-lived functional access into durable trust relationships. Once a service account or token is embedded in a workflow, it can survive the original business need and keep reaching sensitive systems. That is why integration review belongs in identity governance, not only in application security.

Q: What do teams get wrong about AI-scale vulnerability discovery?

A: They often treat discovery as a detection problem instead of a governance problem. Finding exposures faster does not fix over-privilege, hidden delegation, or stale machine credentials. The security value comes from closing the identity paths the discovery process reveals, not from seeing the list sooner.

Q: How can organisations reduce the blast radius of exposed SaaS credentials?

A: Reduce how far any single credential can travel by tightening scope, shortening lifespan, and removing unnecessary downstream trust. The strongest control is to ensure each token or grant can only reach the minimum systems it genuinely needs, and nothing else.

Technical breakdown

AI-scale vulnerability discovery across SaaS identities

AI-assisted discovery works by correlating application behaviour, exposed endpoints, weak configuration patterns, and permission surfaces at a pace that outstrips traditional manual testing. In SaaS environments, the useful unit of analysis is not only the application but the identity relationships around it: who or what can authenticate, which token can invoke which API, and which integration can pivot into another system. That is why identity exposure and application exposure are now inseparable. The same workflow that helps defenders map a surface can also help attackers identify the shortest route to a credential or delegated access path.

Practical implication: inventory identities, tokens, and integrations together rather than treating application scanning as a separate workstream.

Why tokens and delegated access become the real attack surface

In SaaS, the highest-value weakness is often not a broken login page but a valid credential path that should have been short-lived, scoped, or revoked. API keys, OAuth grants, and service tokens create a durable bridge between systems, so once one identity is over-privileged, discovery tools can reveal a chain of reachable assets. That makes credential hygiene a control-plane issue, not a housekeeping task. If token scope and lifecycle are loose, the exposure persists even when the original flaw is patched, because access itself remains intact.

Practical implication: tie token scope, rotation, and offboarding to every SaaS integration review and access certification cycle.

AI agents add speed, not a new category of identity control

AI agents matter here because they can compress the time between discovery, selection, and execution of a test or exploit path. But that does not make them autonomous by default. In most SaaS security programmes, these systems still sit inside predefined workflows, which means they should be governed as high-speed NHIs unless the article explicitly shows independent runtime decision-making. The governance question is therefore whether the agent can expand reach through tool use, not whether it is branded as intelligent.

Practical implication: classify the actor correctly before designing controls, and do not over-apply autonomous governance to bounded AI automation.

Threat narrative

Attacker objective: The attacker wants to turn hidden SaaS identity and integration weaknesses into valid access that can be reused at scale.

1. Entry occurs through publicly reachable SaaS exposures, weak integration points, or over-permissive identity relationships that AI discovery can surface quickly.
2. Escalation follows when a valid token, delegated grant, or service credential provides broader reach than intended across identities, applications, or connected tools.
3. Impact occurs when the attacker reuses that access to move through integrated systems, exfiltrate data, or operate through trusted automation paths.

Breaches seen in the wild

• Moltbook AI agent keys breach — Moltbook breach exposed 1.5M AI agent keys.
• Salesloft OAuth token breach — hackers stole OAuth tokens to access Salesforce data via Salesloft.

Read our 52 NHI Breaches Analysis report for a comprehensive view of breaches impacting Non-Human Identities including AI Agents.

NHI Mgmt Group analysis

AI vulnerability discovery compresses the identity review window. SaaS security has always depended on finding exposures before an attacker does, but AI-assisted discovery changes the cadence of that race. The issue is not just faster scanning, it is faster identification of privilege paths, integration chains, and secret-bearing relationships. That makes the governance gap a lifecycle problem as much as a technical one. Practitioners should treat discovery speed as an identity risk multiplier, not a tooling feature.

Token sprawl is now the SaaS control failure mode that matters most. When integrations proliferate, security teams often lose track of which service account, OAuth grant, or API key still has standing access. That standing access becomes the shortest route for both defenders and attackers. The implication is straightforward: if the organisation cannot map who issued the token, who owns it, and when it should expire, it cannot claim control over the SaaS trust boundary.

AI agents do not create a new exception to identity governance, they expose where governance was already thin. The same access, delegation, and offboarding weaknesses that hurt traditional SaaS environments become more damaging when an AI system can traverse them quickly. This is why the field needs to stop treating agentic security as a separate silo. The practitioner conclusion is to govern agent behaviour through the same identity lifecycle discipline used for NHIs, but with tighter runtime visibility.

Identity blast radius is the right named concept for this topic. AI-scale discovery does not just reveal vulnerabilities, it reveals how far one compromised identity can travel across applications, integrations, and data stores. That blast radius is determined by standing privilege, delegated trust, and hidden dependencies. The practical lesson for the industry is to measure exposure in reach, not just count findings.

From our research:

• 85% of organisations lack full visibility into third-party vendors connected via OAuth apps, according to The State of Non-Human Identity Security.
• Only 1.5 out of 10 organisations are highly confident in their ability to secure NHIs, compared to nearly 1 in 4 for securing human identities.
• That confidence gap points to a wider governance issue, which is why readers should also review Top 10 NHI Issues for the control patterns most often missed.

What this signals

Identity blast radius is becoming the most useful way to think about SaaS and agent security. As discovery accelerates, the question is no longer whether a weakness exists, but how far a single credential can reach before governance catches up. That is a programme design issue, not a point-in-time security finding.

With 85% of organisations lacking full visibility into third-party vendors connected via OAuth apps, the problem space already extends beyond direct access management into delegated trust and shadow integration risk. Teams that still review apps, tokens, and service accounts separately will keep missing the combined exposure picture.

For readers building out control maturity, the next step is to align discovery with lifecycle enforcement. The practical signal to watch is whether every non-human or agentic credential has an owner, a scope, and an offboarding path that can be verified, not assumed.

For practitioners

• Map SaaS identity pathways end to end Build a single inventory that ties users, service accounts, OAuth grants, API keys, and connected applications into one control view. Separate ownership from authentication source so you can see which identities still have reachable access.
• Review every standing integration grant Re-certify third-party and internal integrations on a fixed cadence and remove any grant that cannot be tied to an active business owner. Prioritise privileges that can reach production data, admin consoles, or automation workflows.
• Shorten the lifespan of machine credentials Replace long-lived secrets with scoped, time-bound credentials wherever the platform supports it. Where that is not possible, require compensating controls such as tighter network boundaries and explicit ownership of renewal.
• Test agent tool access as a security control Validate which tools an AI agent can invoke, what data it can see, and whether it can chain actions without human review. If the agent can widen its own reach, treat that as a governance defect rather than an efficiency gain.

Key takeaways

• AI-driven discovery makes hidden SaaS identity paths visible faster, but it does not reduce the underlying governance burden.
• The most consequential exposures sit in tokens, grants, and integration chains that outlive the business need that created them.
• Practitioners should govern AI agents, service accounts, and SaaS integrations through one identity lifecycle model with clear ownership and expiry.

Key terms

• Identity blast radius: The amount of damage a single identity can cause once it is compromised or over-privileged. In SaaS and AI-enabled environments, blast radius is shaped by token scope, delegated trust, and how many systems the identity can legitimately reach.
• Delegated access: Access granted indirectly through an integration, OAuth consent, service account, or similar trust relationship rather than a direct human login. It is often more persistent than teams realise, which makes ownership, expiry, and offboarding essential governance controls.
• AI-scale vulnerability discovery: The use of AI to identify weaknesses across applications, identities, integrations, and workflows at a speed that can exceed manual review. The security challenge is not discovery itself, but whether the organisation can close the identity paths it exposes.
• Standing machine access: Non-human or automated access that remains valid beyond the immediate task or session. This creates persistent reach across SaaS systems unless the organisation actively scopes, rotates, and removes it on a lifecycle basis.

What's in the full article

Reco AI's full article covers the operational detail this post intentionally leaves for the source:

• Specific examples of SaaS identities, integrations, and agent paths exposed by AI-scale discovery.
• Practical steps security teams can use to close the access paths once they are identified.
• How attackers can turn the same discovery capability against identity and token surfaces.
• The article's full framing for what this means for AI agent security in SaaS environments.

👉 Reco AI's full post covers the identity exposures, integration paths, and practical security steps in more detail.

Deepen your knowledge

NHI governance, agentic AI identity, and machine identity lifecycle are core topics in our NHI Foundation Level course, the industry's only accredited NHI security programme. If you are responsible for identity security strategy or NHI governance in your organisation, it is worth exploring.