Notifications
Clear all
Topic starter
06/06/2026 11:13 am
TL;DR: AI agents cannot use human MFA patterns because they lack phones, fingerprints, and interactive login sessions, according to WorkOS and supporting industry data. The real issue is not whether MFA can be adapted, but whether identity governance can shift fast enough to manage non-human actors with ephemeral, task-scoped access.
NHIMG editorial — based on content published by WorkOS: MFA for AI agents: Why traditional authentication falls short
By the numbers:
- Machine identities now outnumber human users by more than 80 to 1 in a typical enterprise.
- Gartner predicts that 33% of enterprise applications will include agentic AI by 2028, up from less than 1% in 2024.
- A recent scan of nearly 2,000 publicly accessible MCP servers found that every single verified server lacked authentication.
Questions worth separating out
Q: How should security teams authenticate AI agents without using human MFA flows?
A: Security teams should authenticate AI agents with workload identity, short-lived credentials, and scoped authorization rather than human prompts.
Q: Why do AI agents create more identity risk than human users in practice?
A: AI agents create more risk because they can act continuously, call multiple tools, and retain access across many steps without a natural pause for review.
Q: What do security teams get wrong about MFA for non-human identities?
A: The common mistake is treating MFA as a universal trust layer instead of a control designed for human login events.
Practitioner guidance
- Classify every agent as a first-class identity Assign each agent its own identity, permissions, audit trail, and retirement path.
- Replace long-lived secrets with short-lived task tokens Use workload identity federation where possible, then mint ephemeral credentials scoped to a single task or workflow.
- Build approval gates for high-impact agent actions Require explicit human approval before irreversible operations such as production changes, external communications, or financial transfers.
What's in the full article
WorkOS's full article covers the operational detail this post intentionally leaves for the source:
- How OAuth 2.1, PKCE, and MCP-based flows fit together for user-delegated agent access
- When to use workload identity attestation instead of static API keys or shared service accounts
- How scoped, ephemeral tokens can be structured for read, write, and approval-bound agent tasks
- Where human approval gates fit into sensitive workflows without breaking the automation model
👉 Read WorkOS's analysis of MFA for AI agents and identity control gaps →
AI agent MFA: what breaks when human auth meets machine actors?
Explore further
06/06/2026 11:54 am
Human MFA is not failing at the factor level, it is failing at the actor model level. MFA was designed for a person who can pause, approve, and resume work inside a bounded session. That assumption collapses when the actor is an AI agent that executes autonomously across multiple tools and timing windows. The implication is that identity programmes must stop treating agent access as an edge case and start treating it as a distinct class of governed runtime behaviour.
A few things that frame the scale:
- Machine identities now outnumber human users by more than 80 to 1 in a typical enterprise, according to the Ultimate Guide to NHIs.
- Only 20% of organisations have formal processes for offboarding and revoking API keys, which shows how often machine access outlives governance.
A question worth separating out:
Q: How can organisations govern sensitive agent actions without blocking automation?
A: Use a split model. Allow low-risk actions to proceed under tightly scoped, short-lived credentials, but route irreversible or high-impact actions through explicit human approval. That keeps automation usable while preserving accountability where the business impact is highest. The key is to separate routine execution from delegated authority, not to approve everything the same way.
👉 Read our full editorial: Mfa for ai agents exposes the limits of human identity models
