TL;DR: AI will expand attack surfaces faster than defenders can rework controls, especially around machine identity, API keys, and agentic tooling, while attackers keep exploiting weak identity verification and access management, according to Expel's 2026 predictions. The governing problem is not AI itself, but the persistence of long-lived credentials and the visibility gap they create.
At a glance
What this is: Expel argues that AI agents and machine identities will expand attack surfaces in 2026 by multiplying long-lived credentials, integrations and access paths that defenders cannot easily govern.
Why it matters: IAM, PAM and NHI teams need to treat agent access, API-key identity and machine credential lifecycle as a single governance problem before the visibility gap turns into access sprawl.
Context
AI and machine identity risk are converging around the same control weakness: access that is granted faster than it can be inventoried, reviewed or revoked. In this article, the primary issue is not model capability alone but the security debt created when agents, MCP servers and workloads inherit long-lived credentials across too many tools.
That matters because traditional IAM assumptions break when a non-human actor can be created, delegated and expanded across environments faster than normal governance cycles can keep up. The result is a practical governance gap for security teams, especially where machine identities, API keys and third-party access are already difficult to map end to end.
Key questions
Q: How can teams govern machine identities and AI agents in access reviews?
A: Teams should assign ownership, define review cadence, and include machine identities and AI agents in the same certification logic as human access, but with role-appropriate approvers. If a non-human identity can act on sensitive data, it needs a lifecycle owner and a removal path just like any other privileged account.
Q: Why do long-lived secrets create more risk in agentic environments?
A: Long-lived secrets are dangerous because they can be copied, reused, and hidden inside code or orchestration layers for long periods. In agentic systems, that risk increases because the same credential may support many actions across multiple tools. Short-lived, attestable credentials narrow the blast radius and make abuse easier to contain.
Q: What do security teams get wrong about AI access risk?
A: Many teams focus on the model while ignoring the identity path that reaches it. If a service account or token can invoke AI infrastructure, then that credential becomes the real control point. The mistake is treating AI risk as a model problem instead of an access governance problem.
Q: When should organisations separate human and machine identity controls?
A: They should separate them as soon as service accounts, API keys, or cloud tokens carry meaningful access, because machine identities fail differently from user accounts. Human login controls do not prevent a leaked application key from being replayed, so the lifecycle and monitoring model has to change.
Technical breakdown
Why machine identities become a governance blind spot
Machine identities are service accounts, API keys, tokens and certificates that authenticate software, workloads and automations rather than people. They are harder to govern than human identities because they are created in pipelines, reused across systems and often lack the lifecycle checkpoints that human joiner-mover-leaver processes enforce. When AI tooling introduces more integrations, the number of identity bindings rises faster than visibility, which makes ownership, inventory and revocation the core control problems.
Practical implication: Treat machine identity inventory and ownership as a first-class control, not as an extension of human IAM.
How agentic tooling expands access without a matching control model
Agentic tooling changes the access pattern because the agent can request, combine and use tools inside a workflow that may not map cleanly to a human approver or a fixed role. Model Context Protocol servers and similar interoperability layers increase this effect by connecting agents to more data sources and actions. The control issue is not only whether the agent is authenticated, but whether its delegated access is bounded tightly enough to prevent accidental privilege expansion and unmanaged reuse.
Practical implication: Design agent access around explicit delegation boundaries, not around broad credentials inherited from the surrounding platform.
Why long-lived credentials remain the real exposure multiplier
Long-lived credentials are dangerous because they extend the time window in which compromise can be monetised and make detection harder when the credential belongs to a non-human actor that operates silently. If an API key or token persists across multiple tools, the attacker does not need novel exploitation. They only need one weak entry point, then the credential itself becomes the durable path to sensitive systems. That is why visibility and rotation must be joined to privilege scope, not treated as separate hygiene tasks.
Practical implication: Shorten credential lifetime and reduce privilege scope together, or the same credential will remain a reusable attack path.
Threat narrative
Attacker objective: The attacker seeks durable, low-friction access through machine identities and AI integrations so they can move across systems without repeatedly breaking new controls.
- Entry occurs when attackers target exposed AI workflows, third-party integrations or weakly governed machine credentials rather than the AI system itself.
- Credential access follows when long-lived API keys, tokens or service account secrets are harvested and reused across connected tools.
- Escalation happens when the compromised non-human identity already has broad access to sensitive systems, data or orchestration layers.
- Impact is achieved through persistent access to enterprise data, workflow abuse and downstream compromise of systems that trust the agent or machine identity.
Breaches seen in the wild
- CISA Private-CISA GitHub leak 2026: A CISA contractor's public GitHub repo exposed AWS GovCloud admin keys, Artifactory credentials and plaintext passwords for six months.
Read and download The State of NHI & AI Agent Breach Report 2026, covering 200+ breaches impacting Non-Human Identities including AI Agents.
NHI Mgmt Group analysis
Machine identity sprawl is becoming the practical attack surface of AI adoption. The article points to a familiar pattern: interoperability expands faster than governance, and the first thing to break is usually not the model but the identity layer behind it. In NHI terms, the challenge is ownership, inventory and lifecycle control for non-human access that keeps multiplying across tools and workflows. Practitioners should treat machine identity sprawl as an access-governance problem, not an AI novelty.
Agentic access changes the meaning of privilege management. A human role can usually be reviewed after the fact, but an agent can acquire and use access inside a narrow execution window that leaves little time for conventional review. That makes delegation design, not just entitlement review, the relevant control question. This is where NHI governance intersects with agentic AI security most clearly: access must be bounded before task execution, not discovered later. Practitioners should move policy enforcement closer to issuance time.
Long-lived secrets are the named failure mode this article keeps surfacing. The governance assumption that access will remain stable long enough to be reviewed is already broken for machine identities and AI tooling. Once a token, API key or service account persists across multiple systems, compromise becomes reusable rather than ephemeral. OWASP-NHI’s focus on long-lived secrets, insecure authentication and overprivileged NHI fits this pattern directly. Practitioners should reduce the reuse window, not just the rotation interval.
Security teams are entering a visibility-gap era for AI agents. The article’s prediction is not simply more automation. It is more access paths that do not map cleanly to existing IAM or SOC monitoring models. That creates a category-level governance issue for NIST CSF access control and monitoring outcomes, because traditional asset and identity inventories were not designed for dynamic agent proliferation. Practitioners should assume their current controls undercount non-human access until proven otherwise.
What this signals
Machine identity sprawl is likely to become the most operationally important side effect of 2026 AI adoption because every new agent, connector and workflow adds another credential path to govern. Security teams should assume that inventory quality, not model sophistication, will determine how much blast radius these systems create.
The practical question for IAM and PAM leaders is whether access controls are being enforced at issuance time or only discovered during review. Once machine credentials are embedded in agentic workflows, conventional certification cycles arrive too late to change the risk profile.
NHI governance now needs to extend beyond classic service accounts into AI-connected delegation patterns, because the same secret can bridge application access, automation and third-party integrations. That makes access lifecycle discipline, revocation speed and behavioral monitoring the controls most likely to matter in 2026.
For practitioners
- Map every non-human credential to an accountable owner Build a single inventory for API keys, service accounts, tokens and certificates used by AI tools, workloads and integrations, then require an accountable business or technical owner for each one.
- Bind agent access to narrow task-scoped delegation Replace broad inherited privileges with explicitly approved, task-scoped permissions for agent workflows, and review every tool connection against the minimum access needed for the task.
- Shorten the lifetime of reusable secrets Prioritise rotation and revocation for long-lived credentials that are shared across multiple systems, especially where the same token or key can reach production or customer data.
- Separate human workflows from machine execution paths Create distinct control paths for human sign-in, service-to-service authentication and agentic tool use so that a compromise in one path does not automatically inherit trust in the others.
- Tune detection around non-human access behaviour Add monitoring for abnormal agent actions, unusual token reuse and access from unexpected automation contexts, because machine identities rarely create the same behavioural signals as humans.
Key takeaways
- AI agents and machine identities are widening enterprise attack surfaces because they multiply delegated access paths faster than security teams can inventory and constrain them.
- Long-lived secrets remain the main governance weakness because they turn one compromise into durable, reusable access across connected systems.
- IAM teams need to shift from reviewing access after issuance to controlling delegation, ownership and revocation at the moment access is created.
Standards & Framework Alignment
This section maps relevant standards and security frameworks to the operational risks and controls described in this guidance.
OWASP Non-Human Identity Top 10, OWASP Agentic AI Top 10 and MITRE ATT&CK address the attack and risk surface, while NIST CSF 2.0 sets the governance and control requirements practitioners need to meet.
| Framework | Control / Reference | Relevance |
|---|---|---|
| OWASP Non-Human Identity Top 10 | NHI-07 — Long-Lived Secrets | The article repeatedly flags persistent API keys and tokens as the exposure multiplier. |
| NHI-05 — Overprivileged NHI | Agent and machine access is described as expanding faster than governance can constrain privileges. | |
| NHI-02 — Secret Leakage | The piece highlights exposed keys, tokens and plaintext passwords as the practical entry point. | |
| Recommendation — Reduce secret lifetime and revoke reusable credentials before they become persistent access paths. Re-scope machine identities to least privilege and remove broad inherited access from agent workflows. Scan for exposed machine secrets and revoke any credential that appears outside approved storage. | ||
| OWASP Agentic AI Top 10 | ASI03 — Identity & Privilege Abuse | Agentic tooling is central because delegation can expand privilege beyond intended bounds. |
| Recommendation — Constrain agent delegation so runtime privilege cannot exceed the approved task scope. | ||
| NIST CSF 2.0 | PR.AA-05 — Access Permissions, Entitlements and Authorizations | The article is fundamentally about controlling non-human access permissions and entitlements. |
| Recommendation — Inventory and govern non-human entitlements so machine access stays bounded and reviewable. | ||
| MITRE ATT&CK | TA0006;TA0008 — Credential Access; Lateral Movement | The attack pattern centers on stealing credentials and reusing them across connected systems. |
| Recommendation — Hunt for credential access and lateral movement paths that rely on reusable machine secrets. | ||
Key terms
- Machine Identity: The digital identity of a machine, device, or workload, such as a server, container, or VM, used to authenticate it within a network. Sometimes used interchangeably with NHI, though NHI is the broader category.
- Agentic Delegation: Agentic delegation is a multi-agent orchestration pattern where one agent passes a task to another agent based on internal criteria. The receiving agent becomes responsible for part of the work, usually through a tool-mediated handoff. It is used to split responsibilities while keeping the overall workflow controlled and inspectable.
- Long-Lived Secret: A long-lived secret is a credential, token, API key, or certificate that remains valid for an extended period without frequent renewal. In NHI environments, it creates durable exposure because one leaked secret can keep granting access long after the original use case has changed.
- Visibility gap: A visibility gap is the point where a security team can no longer reliably see who has access to what, or why that access exists. In identity and data governance, it is a control failure because remediation depends on accurate ownership and current entitlement state.
Deepen your knowledge
The NHI Foundation Level course, the industry's only accredited NHI security programme, covers NHI governance, machine identity security and secrets management. It helps identity and security practitioners build the controls needed for environments where non-human access keeps expanding.
Published by the NHIMG editorial team on August 20, 2026.
Updated on October 12, 2026.
NHI Mgmt Group, the independent authority on Non-Human Identity, IAM, and Agentic AI security. nhimg.org