AI agents and secret leakage are sharpening CISO concerns

At a glance

What this is: This 1Password commentary says CISOs at major Vegas conferences are prioritising AI agents, nation-state threats, and secret leakage, with real enforcement seen as the gap rather than policy wording.

Why it matters: For IAM, PAM, NHI, and AI governance teams, the message is that leakage and misuse now depend on whether controls are actually enforced across private apps, agentic workflows, and business-user behaviour.

Context

AI agents and secret leakage are becoming CISO concerns because policy-only governance does not stop data from moving into private apps or uncontrolled workflows. In practice, the issue is not whether organisations have rules, but whether those rules are enforced where sensitive data is created, shared, and reused.

The article is a conference-grounded observation about what security leaders were talking about across Black Hat, BSides, and adjacent events. It places AI agents alongside nation-state threats and private-app leakage as the recurring stress points that are shaping current identity and security priorities.

Key questions

Q: What breaks when AI agents can retain sensitive data after the first access check?

A: The boundary between authorised access and uncontrolled reuse breaks down. Once an agent can hold sensitive content in memory or context, it may forward that content into other tools, reuse it in new tasks, or expose it through downstream connectors. That is why control must move upstream to classification and prevention before ingestion, not after the fact.

Q: Why do private apps create secret leakage risk for security teams?

A: Private apps create risk because they move sensitive material into places the security team may not inventory, monitor, or govern. Once data enters those tools, sharing, export, retention, and reuse become difficult to control. The result is a leakage channel that policy alone cannot close, especially when business users adopt tools faster than security can assess them.

Q: How should teams decide whether agent use is acceptable in the first place?

A: Teams should allow agent use only when the data scope, tool scope, and enforcement mechanism are all clear. If the organisation cannot block disallowed actions or observe sensitive handling, the use case is too risky to treat as governed. Approval without enforcement is a documentation exercise, not a security control.

Q: What is the difference between routing control and identity governance in AI systems?

A: Routing control decides where traffic goes, while identity governance decides who or what is allowed to use that path and for how long. A gateway can enforce both, but only if the upstream credentials, reviews, and exceptions are managed as part of the identity lifecycle rather than as incidental configuration.

Technical breakdown

Why AI agents change the enforcement problem

AI agents change the control model because they can act within business workflows, make tool calls, and touch data without fitting neatly into human approval cycles. Even when they are constrained, they can still expand the number of places where secrets, tokens, and sensitive content appear. The governance problem is not just access, but the speed and informality of agent-driven activity. In identity terms, this pushes security teams to think about who or what can create, copy, and reuse sensitive data at runtime, not just who is allowed to log in.

Practical implication: treat agent use as a governance and data-handling problem, not only an application feature.

Why private apps become a secret leakage channel

Private apps create leakage risk because business users often place sensitive material into tools that are outside formal enforcement or inventory. The article’s point is not that all such apps are forbidden, but that organisations cannot protect what they cannot see or control. Once data enters an unmanaged app, downstream retention, sharing, and export behaviour becomes hard to govern. That turns shadow adoption into an identity and data-control problem, because access, storage, and exfiltration boundaries blur at the point of use.

Practical implication: inventory where users actually place sensitive data and enforce controls at those touchpoints, not only at the perimeter.

Policies versus controls in agentic and NHI environments

Policies describe intent, but controls determine whether intent holds under pressure. That distinction matters more as AI agents, personal tools, and non-human workflows multiply, because the gap between stated approval and actual enforcement widens quickly. When security leaders say that policies are cheap, they are pointing to a common failure mode in identity programmes: governance language exists, but there is no blocking mechanism, no telemetry, or no revocation path when behaviour drifts. The article implicitly argues that this is where modern identity work breaks down.

Practical implication: verify that governance rules are technically enforceable across identities, apps, and secrets, not just documented.

NHI Mgmt Group analysis

Control enforcement, not policy intent, is now the differentiator. The article reinforces a pattern we see across IAM and NHI programmes: the organisations most exposed are not the ones without rules, but the ones whose rules cannot intervene when users or agents move data outside governed paths. That is a control-plane problem, not a communication problem. Security leaders should judge their programme by where enforcement actually occurs.

AI agent adoption increases the number of identity-bound touchpoints that can leak secrets. Even tightly scoped agent use expands the set of runtime interactions where tokens, prompts, reports, and other sensitive material can be exposed. The important shift is that the leak path is no longer only human misuse; it is also agent-mediated reuse across tools and workflows. Practitioners should treat agent exposure as part of the same governance surface as service accounts and API credentials.

Shadow app use makes data protection an identity governance issue. The article’s private-app concern is really about unmanaged access contexts, not just unsanctioned software. When business users move sensitive information into tools the security team cannot observe, lifecycle controls, recertification, and DLP-style assumptions lose reach. That means identity governance has to follow the data path, not just the directory path.

Anti-fragility in identity programmes depends on enforceable boundaries. The summit language around resilience and anti-fragility is useful only if organisations can limit blast radius when behaviour changes. Without technically enforced controls, AI usage and private-app adoption simply produce more places for leakage to persist. The practitioner conclusion is straightforward: governance that cannot constrain runtime behaviour is not resilient enough for current identity risk.

Secret leakage is becoming a cross-domain identity problem. The article brings together AI agents, business users, and sensitive data handling because the same underlying weakness shows up in all three: uncontrolled reuse of secrets and information across systems. That makes NHI governance, data handling, and human access discipline converge in practice. Teams need one view of where sensitive material can move, regardless of whether the actor is a person or a machine.

What this signals

Runtime enforcement is becoming the real test of identity governance. As AI agents and private apps spread, the question is no longer whether security teams have policy coverage, but whether those policies can stop sensitive data from moving into ungoverned places. That pushes IAM, NHI, and data-protection teams toward controls that operate at the moment of use.

Secret leakage now spans human and machine behaviour in the same programme. Business users, AI agents, and other non-human workflows can all create the same outcome when controls are weak: sensitive material escapes into tools the organisation cannot reliably govern. The operational implication is that identity boundaries and data boundaries have to be designed together.

For practitioners

• Define enforceable guardrails for AI agent use Specify which data types, tools, and actions an agent may touch, and make those constraints technically enforceable rather than advisory.
• Inventory private-app data exposure paths Map where business users place sensitive information in unsanctioned or lightly governed applications, then identify the controls that can actually block or limit that flow.
• Replace policy-only approvals with runtime controls Verify that sensitive-data handling rules can be enforced at the point of use, including creation, sharing, export, and re-entry into other systems.
• Extend identity governance to agentic workflows Treat AI agents, service accounts, and other non-human actors as part of the same governance surface when they can touch secrets or regulated data.
• Test whether controls survive shadow adoption Challenge each control by asking what happens when users move the same work into private apps or unmanaged collaboration tools.

Key takeaways

• CISO concern is shifting from policy language to enforceable control, because AI agents and private apps can move sensitive data outside governed paths.
• The risk is not limited to human misuse, since agent-driven workflows can create new leakage points for secrets and other sensitive information.
• Security teams need runtime enforcement, inventory of shadow app exposure, and identity governance that covers both people and non-human actors.

Key terms

• Secrets Leakage: Secrets leakage is the exposure of credentials such as API keys, tokens, or certificates in places where they can be discovered and reused. The risk is not just disclosure, but unauthorized authentication that turns a coding or pipeline mistake into active access.
• Agentic workflow: An agentic workflow is a sequence of tasks executed by an AI agent with some level of tool access and decision authority. In security terms, the workflow matters because it can span multiple systems, identities, and permissions, which makes attribution and revocation harder than with ordinary automation.
• Shadow AI: AI agents, copilots, or connected tools operating without full visibility or governance from security teams. Shadow AI becomes an identity problem when those systems authenticate with unmanaged tokens, service accounts, or OAuth apps that can reach production resources.
• Runtime Enforcement: Runtime enforcement is the practice of blocking malicious behaviour while software is running, rather than only detecting it after the fact. It monitors process activity, network actions, and privilege changes so a live attack can be interrupted at the point of execution.

Deepen your knowledge

NHI governance, agentic AI identity, and machine identity lifecycle are core topics in our NHI Foundation Level course, the industry's only accredited NHI security programme. If you are building or maturing an IAM or identity security programme, it is worth exploring.