Topic starter
24/06/2026 7:11 pm
TL;DR: Akeyless reports that two-thirds of organizations using AI agents suspect those agents have already accessed data beyond their intended scope, and it takes an average of 14 hours to detect a compromised agent. Static credentials and human-paced IAM controls are failing to keep up with runtime agent behaviour, making identity governance the real control gap.
Editorial analysis by NHI Mgmt Group, based on content published by Akeyless: “Two-Thirds of Enterprises Suspect AI Agents Have Already Accessed Unauthorized Data, Akeyless Finds”.
By the numbers:
- 67% suspect AI agents have already accessed data beyond their intended scope
- It takes an average of 14 hours to detect a compromised AI agent
Key questions
Q: What breaks when AI agents are given broad standing access?
A: Broad standing access breaks governance because the agent can move from one task to another without a fresh authorization check.
Q: Why do AI agents with valid access still create incident risk?
A: Because valid access does not guarantee controlled behaviour.
Q: How can organisations tell whether AI agent governance is actually working?
A: Look for evidence that agent access is ephemeral, traceable, and constrained at the action level.
Practitioner guidance
- Define runtime identity boundaries for AI agents Map every agent to the systems, data sets, and operations it may touch, then enforce those boundaries at execution time rather than only at onboarding.
- Eliminate persistent credentials where agents operate Replace static secrets and reusable API keys with ephemeral identities that expire with the task, especially where agents can reach production workflows.
- Instrument agent actions for continuous auditability Log every privileged agent action with identity, context, and target system so that scope drift and misuse can be detected before containment starts.
Bottom line: AI agents create a governance problem because authorised access can become uncontrolled during runtime, not just after compromise.
What's in the full report
Akeyless's full report covers the operational detail this post intentionally leaves for the source:
- Survey breakdown across 400 IT and security leaders in the United States and United Kingdom
- The full set of findings on credential revocation, detection delay, and containment timelines
- Details on how organisations are using persistent API keys and static secrets in production workflows
- The report's view of runtime identity security for AI agents, machines, and human access
👉 Read Akeyless's analysis of AI agent identity security gaps and access risk →
Explore further
View Full Forum → | NHI Foundation Course → | Our Services → | Read the full analysis →
25/06/2026 4:22 am
AI agent identity is now a runtime governance problem, not a provisioning problem. The study shows organisations already suspect agents of accessing data beyond intended scope, which means the central question is no longer whether to assign credentials, but how to constrain behaviour once credentials are active. Human-paced IAM assumes access can be reviewed after the fact, yet AI agents can complete meaningful actions before any review cycle begins. The implication is that identity control for agents must shift from assignment to continuous runtime governance.
A few things that frame the scale:
- Systems with least-privileged AI access had a 17% incident rate vs 76% for over-privileged systems. Organisations failing to scope AI access properly are 4.5x more likely to experience a security incident, according to the 2026 Infrastructure Identity Survey.
A question worth separating out:
A: Credential reduction should come first where agents rely on persistent secrets, because visibility alone does not stop overbroad access. Once the credential footprint is shorter-lived and narrower, monitoring becomes far more useful for spotting the actions that remain.
👉 Read our full editorial: AI agent identity security gaps are exposing enterprise access risk