Ghost agents expose a runtime governance gap in AI identity

At a glance

What this is: This is an analysis of ghost agents, AI agents that continue operating after their human creator leaves because their own credentials remain active, exposing a runtime governance gap in AI identity.

Why it matters: It matters because offboarding, access reviews, and lifecycle controls built for human accounts do not automatically stop autonomous actions taken by agents with separate credentials.

Context

Ghost agents are AI agents that continue to act after the employee who created them has left, because the agent authenticates with its own API key, service account, or OAuth token rather than the departed person's user account. The governance gap appears at offboarding time, when human identity controls end but the agent's runtime access does not.

For IAM and NHI programmes, this is not a tooling nuisance. It is a lifecycle mismatch between human offboarding processes and non-human credentials that can keep operating, spending, or modifying systems long after the owner is gone.

Key questions

Q: What breaks when an AI agent outlives the employee who created it?

A: The break point is accountability. The employee’s account can be deactivated while the agent’s own credentials remain valid, so the workflow keeps running with no current owner to approve, review, or stop it. That creates orphaned access, hidden runtime authority, and a gap between identity lifecycle controls and actual system behaviour.

Q: Why do offboarding and access review controls miss ghost agents?

A: They are built to govern people, not separate runtime identities. A manager can certify a user’s access and IT can disable the user account, yet an agent with its own API key or token remains outside that review scope. The control failure is that the review population excludes the actor that is still making decisions.

Q: How should organisations stop AI agents after the creator departs?

A: They should bind agent credential issuance to the creator’s active status and deny fresh credentials the moment that owner is offboarded. In practice, that means short-lived credentials, explicit ownership records, and a decommissioning path that reaches the agent itself rather than relying on the employee account alone.

Q: When should organisations separate AI agent governance from human IAM reviews?

A: Organisations should separate them as soon as AI agents begin acting inside production workflows. Human access reviews assume a person, a role, and a review cadence that fit a stable entitlement. AI agents require task-scoped boundaries, lifecycle ownership, and monitoring that can keep up with runtime behaviour.

Technical breakdown

Why offboarding stops the person but not the agent

Traditional offboarding revokes a human’s badge, email, SSO session, and directory account, but that does not reach a separate non-human identity. An AI agent often authenticates with its own API keys, service account password, or token stored in a config file or secrets manager. Those credentials are evaluated independently by downstream systems, so once issued they continue to authorize actions even after the creator leaves. The result is a split between ownership and runtime authority: the human is gone, but the agent still has standing access.

Practical implication: treat the agent credential as the actual object of offboarding, not the employee who created it.

Why access reviews miss ghost agents

Access reviews are usually built around named people, managers, and role attestations. Ghost agents fail that model because they are often invisible in the review population or appear only as unmanaged service accounts with no obvious business owner. That means the attestation process can approve the human user’s access while leaving the agent’s permissions untouched. In governance terms, the control is proving ownership, not runtime authority, so it cannot certify whether the agent should still exist or whether its permissions are still justified.

Practical implication: inventory agents as governed identities and review their permissions separately from human user access.

How runtime authentication creates the kill switch

The article’s proposed control is not credential rotation alone but runtime authentication tied to the owner’s employment status. Each time the agent attempts to act, the authentication layer checks whether the human owner is still active and issues a short-lived credential only if that condition is true. When the owner is deactivated, the agent stops receiving usable credentials and its next request fails. That shifts governance from periodic review to issuance-time enforcement, which is the only point where the control can reliably stop a ghost agent from continuing to operate.

Practical implication: bind agent credential issuance to a live ownership check and deny new credentials as soon as the owner is offboarded.

Threat narrative

Attacker objective: The objective is to exploit persistent agent credentials and autonomous runtime authority to perform actions without an accountable human owner.

1. Entry occurs when a human employee creates an AI agent with its own API key, service account password, or token that persists beyond their departure.
2. Credential access remains intact after offboarding because the agent authenticates independently, so deactivating the person does not revoke the agent's runtime access.
3. Escalation happens as the orphaned agent keeps spending, provisioning, or responding through valid systems permissions with no human review.
4. Impact appears as unauthorized purchases, unmonitored security exposure, broken audit trails, or public-facing mistakes that continue until discovery.

Breaches seen in the wild

• Coupang Signing Key Breach: Unrevoked signing key credentials expose 33.7 million records after employee offboarding failure at Coupang.
• AI agent retail card theft campaign 2026: AI agents breached 27+ retailers for about $25 each, used cloud keys and a Secrets Manager dump, and stole 600,000+ payment cards.

Read and download The State of NHI & AI Agent Breach Report 2026, covering 200+ breaches impacting Non-Human Identities including AI Agents.

NHI Mgmt Group analysis

Ghost agents expose a runtime governance gap, not just a lifecycle gap: the failure is that IAM can end a person's access while leaving the agent's access untouched. That separation matters because the control boundary sits at credential issuance and runtime enforcement, not at employee offboarding. The practitioner conclusion is that AI identity must be governed as its own runtime subject, not as a side effect of human JML.

Offboarding assumptions collapse when the actor can act after the owner leaves: the assumption that deactivating a human account also terminates downstream access was designed for human-authenticated workflows. It fails when the agent authenticates independently with its own secrets and can keep operating without the departed employee. The implication is that offboarding logic must be evaluated against non-human credentials, not only directory users.

Ghost agents create a new form of identity debt: orphaned runtime authority: credentials, permissions, and decision logic can remain live even when business ownership disappears. That is more dangerous than simple stale access because the system can continue to initiate actions, not just receive them. The practitioner conclusion is that AI agent governance needs a runtime kill path, inventory discipline, and ownership traceability as first-class controls.

Access reviews and credential rotation are necessary but insufficient for ghost agents: those controls can confirm that credentials exist and are periodically changed, yet still miss whether the identity behind them should be active at all. That is why this problem sits at the intersection of OWASP-NHI, identity lifecycle governance, and agentic AI identity. The practitioner conclusion is that review cadence cannot substitute for issuance-time authorization tied to active ownership.

Runtime governance is becoming the deciding control for AI identity: the more organisations deploy agents across procurement, infrastructure, and customer workflows, the more they need a mechanism that can stop action when accountability ends. This is where AI identity governance diverges from human IAM: the question is not just who has access, but whether the actor should be allowed to keep acting after its owner departs. The practitioner conclusion is to treat runtime authority as the control plane for AI agents.

From our research library:

• Only 20% have formal processes for offboarding and revoking API keys, and even fewer have procedures for rotating them, according to the Ultimate Guide to NHIs.
• 70% of organisations grant AI systems more access than they would give a human employee performing the exact same job, according to the 2026 Infrastructure Identity Survey.
• Read next: AI Agent Identity Security Buyer's Guide

What this signals

Orphaned runtime authority: ghost agents show that AI governance now depends on controls that can end action at the moment ownership ends. Access review and deprovisioning alone do not stop a non-human identity that authenticates independently, so IAM teams need issuance-time enforcement and live ownership checks.

The practical boundary is shifting from user deactivation to credential refusal. If the authentication layer cannot tell whether the owner still exists, the organisation has a governance gap that will keep producing purchases, infra changes, or customer-facing mistakes after the human has left.

For practitioners

• Map every AI agent to a named human owner Build a complete inventory of agents, the systems they can touch, and the employee accountable for each one. If an agent cannot be tied to a current owner, treat it as orphaned until proven otherwise.
• Tie credential issuance to active employment status Require the authentication layer to check whether the owner is still active before issuing any new agent credential. Use short-lived credentials so an offboarded owner cannot continue to refresh access.
• Add agent offboarding to JML workflows Extend joiner-mover-leaver procedures so they include non-human identities created by the employee, with explicit decommissioning steps for API keys, service accounts, and OAuth tokens.
• Review access for orphaned runtime paths Look for agents whose business function still runs but whose creator no longer exists in HR or IAM records. Prioritise agents with write access, purchasing authority, or infrastructure control.
• Separate human access reviews from agent governance Do not assume a manager attestation over the employee's access also covers the agent. Review non-human identities on their own schedule, with evidence that the permissions still map to an active use case.

Key takeaways

• Ghost agents are a governance failure mode where an AI system keeps acting after its human creator is offboarded.
• The source article shows that these orphaned agents can create financial, security, compliance, and reputation damage while remaining outside standard human IAM controls.
• The decisive control is to tie agent credential issuance to active ownership so the system stops when the owner leaves.

Key terms

• Shadow Agent: An AI agent deployed without formal registration, identity governance, or security oversight, the agentic equivalent of shadow IT. Shadow agents are more dangerous than typical shadow NHIs because they actively take actions using their credentials.
• Runtime Governance: Runtime governance is the set of controls that verify what a system or agent is actually doing after deployment. It combines monitoring, authorization checks, and access validation so teams can detect drift, misuse, or excessive privilege in motion rather than assuming build-time policy still holds.
• Orphaned Identity: An orphaned identity is a service account, token, or other machine credential that no longer has a clear owner, purpose, or retirement path. These identities create compliance and security risk because they are easy to forget, difficult to review, and often remain active long after they should have been removed.
• Ownership Assumption Collapse: The failure of a governance model that assumes disabling a human account also ends every downstream identity that person created. For AI agents, that assumption breaks because the agent may authenticate independently, leaving access and accountability separated after offboarding.

Deepen your knowledge

NHI governance, agentic AI identity, and machine identity lifecycle are core topics in our NHI Foundation Level course, the industry's only accredited NHI security programme. If you are building or maturing an IAM programme, it is worth exploring.