Topic starter
10/06/2026 11:06 pm
TL;DR: AI agents are accelerating credential sprawl by creating, using, and replicating API keys, service accounts, and other non-human identities at machine scale, while traditional IAM and PAM controls still assume human-paced access and review, according to 1Password. The governance gap is structural because access review and session-based oversight do not fit identities that duplicate, persist, and act outside centralized visibility.
Editorial analysis by NHI Mgmt Group, based on content published by 1Password: “Credential management for AI agents”.
By the numbers:
- Over one-third of employees, 38%, have successfully accessed a prior employer’s account, data, or applications after leaving the company, according to 1Password.
- 1 in 4 employees has used AI applications that were not approved by their company, according to 1Password.
- In 2024, GitGuardian found 23,770,171 new hardcoded secrets added to public GitHub repositories, a 25% surge over the previous year, according to 1Password.
Key questions
Q: What breaks when AI-driven workflows use standing credentials instead of ephemeral access?
A: Standing credentials make AI workflows harder to contain because any compromise can persist until the secret is rotated or revoked.
Q: Why do overpermissive app secrets create a bigger risk when AI agents are involved?
A: Overpermissive app secrets create bigger risk because an agent can discover and use them at machine speed, then chain the resulting access into other systems.
Q: What are the signs that credential sprawl is getting out of control?
A: Look for departments using separate logins, repeated password reuse, shadow AI adoption, and accounts that cannot be tied back to provisioning records.
Practitioner guidance
- Map agent credential paths Inventory where AI tools, agent platforms, and developer workflows create or reuse API keys, service accounts, tokens, and embedded secrets.
- Separate human and machine governance Stop relying on human access review cadences to control AI agent access.
- Harden developer secret handling Extend secret discovery into code repositories, collaboration tools, and local developer environments where hardcoded or shared secrets commonly appear.
Bottom line: AI agents are widening credential sprawl because they create and reuse machine credentials at a scale that traditional IAM workflows do not model well.
Explore further
View Full Forum → | NHI Foundation Course → | Our Services → | Read the full analysis →
This topic was modified 1 day ago by NHI Mgmt Group
12/06/2026 4:55 am
Credential sprawl has become an AI control-plane problem, not just a secrets hygiene problem. AI agents do not simply inherit access, they multiply it by creating and reusing machine credentials across workflows. That changes the governance unit from the individual secret to the delegated access path, because the real risk is now uncontrolled identity propagation. Practitioners should stop treating secrets as isolated artefacts and start treating them as part of the execution model.
A few things that frame the scale:
- Only 5.7% of organisations have full visibility into their service accounts, according to the Ultimate Guide to NHIs.
A question worth separating out:
Q: How should teams govern AI agents that inherit human access rights?
A: Teams should treat inherited access as temporary and bounded to a specific task, owner, and expiry. The key is to govern the delegation chain, not just the agent itself, because the original human authority can persist far beyond the session that created it. If revocation cannot outrun execution, the governance model is already behind the risk.
👉 Read our full editorial: AI agent credential sprawl is outpacing enterprise IAM controls
This post was modified 1 day ago by NHI Mgmt Group