Notifications
Clear all
Topic starter
11/06/2026 11:27 pm
TL;DR: Gartner warns that sharing human passwords with AI agents is exceptionally high-risk because it destroys auditability, nonrepudiation, and practical incident investigation, while estimating that by 2028 90% of organisations allowing credential sharing will see a tripling of account takeovers and first-party fraud. Credential delegation, not password sharing, is now the governance boundary that matters.
NHIMG editorial — based on content published by AuthMind: AI agents, secure delegation, and the identity risk of credential sharing
By the numbers:
- By 2028, 90% of organizations who allow credential sharing will see a tripling of account takeovers and first-party fraud.
- 80% of organisations report their AI agents have already performed actions beyond their intended scope, including accessing unauthorised systems, inappropriately sharing sensitive data, and revealing access credentials.
- 96% of technology professionals identify AI agents as a growing security threat, and 66% believe this risk is immediate.
Questions worth separating out
Q: How should security teams delegate access to AI agents without sharing passwords?
A: Security teams should use task-scoped delegation that grants only the permissions needed for a specific workflow, with short duration and explicit revocation.
Q: Why do AI agents complicate identity audit and nonrepudiation controls?
A: AI agents complicate audit and nonrepudiation because activity often appears under the human’s credential rather than the agent’s actual execution context.
Q: What do organisations get wrong about AI agent access governance?
A: The most common mistake is treating credential sharing as a shortcut for delegation.
Practitioner guidance
- Prohibit shared human passwords for agent access Remove any workflow that lets an AI agent authenticate with a person’s primary credentials or session tokens.
- Implement task-scoped delegated access Issue access that is limited to the specific action or workflow the agent must perform, with short duration and explicit revocation logic.
- Correlate agent activity to human ownership Map every agentic identity or access path back to the accountable person, business function, or system owner.
What's in the full article
AuthMind's full article covers the operational detail this post intentionally leaves for the source:
- How the AuthMind platform maps agentic identities back to the human owner across hybrid environments
- The platform's real-time detection approach for suspicious activity, privilege escalation, and control bypass
- Operational examples of infrastructure risk discovery, including unknown agents, shadow assets, and unauthorized local accounts
- The containment and remediation workflow used when identity-based threats are detected in real time
👉 Read AuthMind's analysis of secure delegation and AI agent identity risk →
AI agent credential sharing: what IAM teams need to know?
Explore further
12/06/2026 8:07 am
AI agent password sharing is an identity governance failure, not a convenience trade-off. The practice removes the ability to attribute actions to the true actor and breaks the control assumptions behind audit trails, nonrepudiation, and access certification. Gartner’s warning is therefore not about etiquette, it is about a structural loss of governance evidence. Practitioners should treat shared credentials as a direct impairment of identity control integrity.
A few things that frame the scale:
- 80% of organisations report their AI agents have already performed actions beyond their intended scope, including accessing unauthorised systems, inappropriately sharing sensitive data, and revealing access credentials, according to AI Agents: The New Attack Surface report.
- 52% of companies can track and audit the data their AI agents access, while 48% still operate with a complete blind spot for compliance and breach investigation.
A question worth separating out:
Q: Who is accountable when an AI agent misuses delegated access?
A: Accountability should remain with the business owner and the control owner who approved the delegation, not with an opaque automation layer. If access was granted through a shared password, accountability becomes much harder to establish. If the delegation was scoped and logged, ownership remains clear and reviewable.
👉 Read our full editorial: AI agent credential sharing breaks identity security assumptions
