Enterprises spent twenty years giving every employee a unique, audited identity. Most are handing their AI agents a shared key and hoping for the best.
Give five AI agents the same API key and you haven’t deployed five agents. You’ve deployed one very busy identity that you cannot see inside.
New research this week put a number on how common that is. A VentureBeat survey of 107 enterprises found that 69% run agents with credential sharing somewhere in their deployments, that 54% have already had an AI agent security incident or near-miss in the past twelve months, and that only 32% give each agent its own scoped identity. The most common security mistake in enterprise AI right now is also the most avoidable: letting agents share a login.
When one of those agents is compromised, the attacker inherits every permission the shared key can reach. Worse, the forensic trail goes cold at the credential, because nothing recorded which agent actually did what. You are left knowing you were breached, and unable to say by which of your own agents.
A New Class of Identity, Governed as an Afterthought
Enterprises have spent two decades hardening human identity. Multi-factor authentication, privileged access management, and audit logging in a SIEM all assume the thing logging in is a person who clicks, types, and occasionally makes a mistake. Agents break that assumption completely. They authenticate machine-to-machine, run continuously without a human in the loop, reach across APIs and data warehouses, and increasingly spawn other agents to get work done.
Machine identities already outnumber human ones by a wide margin in most organisations, and agents are the fastest-growing, least-governed slice of them. The controls you built for employees were never designed for software that logs in on its own and multiplies. The survey data shows how thin the governance is: fewer than a third of enterprises give each agent its own identity, and separate research this year found only around a quarter have a formal, organisation-wide strategy for agent identity at all, with ownership scattered across security, IT, and nascent AI teams so that nobody quite owns it.
Why Shared Credentials Are So Dangerous
The damage from a shared credential is not subtle, and it stacks up in four ways.
- The blast radius is your whole fleet. Compromise one agent on a shared key and the attacker immediately holds the accumulated permissions of every workflow that key touches.
- You lose all attribution. Five agents on one account leave no record of which one acted. Incident response stops being investigation and becomes guesswork.
- Permissions quietly drift upward. Agents accumulate access over time, and roughly a quarter of deployed agents can already create and task sub-agents, so the over-permissioning multiplies without anyone deciding it should.
- You often can’t stop it. Most organisations can see what their agents are doing, but a majority admit they cannot terminate a misbehaving agent mid-action or enforce a hard limit on what it is allowed to do.
The Data Says Scoped Identity Actually Works
Here is the most useful finding in the research, and the one worth taking to your next security review. Organisations that give every agent its own scoped identity were hit at around 41%, against roughly 64% for those sharing credentials somewhere in the fleet. That is not a cure, but it is a material reduction in exposure from a single, well-understood control.
The exposure also gets worse with scale, which is the opposite of what most people assume. Incident rates climb from roughly 49% at mid-sized firms to 63% at the largest, while isolation controls actually thin out as organisations grow. The biggest estates, with the most agents and the most to lose, are often the least contained. The security industry has clearly read the same data: vendors have committed more than $22 billion to this layer in the past year, led by Palo Alto Networks’ $21.1 billion acquisition of the identity firm CyberArk, and new identity startups are launching specifically for the agent era. When that much money moves that fast toward one problem, it is telling you where the gap is.
What Good Looks Like
The fix is not a new category of magic. It is the identity discipline you already apply to people, extended to a new kind of worker:
- One agent, one identity. Every agent gets its own scoped, least-privilege credential, issued and rotated automatically. No shared keys, and no handing an agent a human’s login.
- Bind identity to purpose. An agent should be able to prove who it is and what it is permitted to do, and be refused anything outside that scope.
- Make every action attributable. A per-agent audit trail so that after an incident you can say which agent did what, when, and why. As of the EU AI Act’s August 2026 obligations, that traceability is fast becoming a compliance requirement, not just good practice.
- Keep a kill switch. If you cannot stop a misbehaving agent mid-action, you have monitoring, not control.
- Govern the sub-agents too. If your agents can spawn other agents, those inherit identity and permissions. Scope the parent properly and you scope its children.
Q&A: Getting Agent Identity Under Control
Isn’t giving every agent its own identity a lot of overhead?
Less than the alternative. Sharing credentials is the shortcut that turns one compromised agent into a full-fleet breach with no audit trail. Scoped identity is already standard for human employees, and agents are simply a new class of identity that needs the same discipline. The tooling to automate it now exists; the habit of using it mostly doesn’t.
We already have IAM, MFA, and privileged access management. Doesn’t that cover agents?
Mostly, no. Those systems were built for humans logging in interactively. Agents authenticate machine-to-machine, run around the clock, and spawn other agents, which human-oriented identity tooling was never designed to handle. You need identity that treats agents as first-class, not a people system stretched to fit.
How exposed are we, honestly?
If you share credentials across agents anywhere, assume the blast radius of any single compromise is your entire fleet, and assume you cannot prove which agent did what afterwards. The survey puts incident rates above 60% for large enterprises that share credentials. This is not a tail risk you can defer.
We’re mid-market, not a bank. Does this really apply to us?
Yes. The research suggests mid-market exposure often comes from agents that teams stood up without security review, running with far broader permissions than they need. You don’t have to be a large target to carry a large blast radius.
What’s the first practical step?
Inventory your agents and the credentials they use, then find every place a single key or identity is shared across more than one agent. Start there. You can’t fix what you can’t see, and most organisations have never actually counted.
Working Through This With Vertex Agility
Agent identity is exactly the kind of problem that sits between AI and security, which is where our work lives. Most AI deployments are performance theatre. We integrate AI where it demonstrably pays back, and we build the governance in from the start rather than bolting it on after the first incident. For agentic systems that means per-agent identity, least-privilege scoping, purpose binding, and full audit trails designed into the architecture, not retrofitted once something has already gone wrong.
Our AI Consultancy practice designs the agentic systems and the governance frameworks that keep them accountable, while our Cybersecurity and cross-cutting work brings the identity, access, and OWASP-grade controls that make those agents safe to run against live systems. Who your agents are, and what they are allowed to do, is an architecture decision, and architecture is where we start. Getting it right before agents touch production is far cheaper than reconstructing what happened afterwards, assuming you even can.
Because we work across the major model and security vendors rather than for any one of them, the controls we put in place are the ones your estate actually needs.
If you want an honest read on how exposed your agent deployments are, and whether your governance is ready for agents acting on live systems, our free AI Readiness Mini-Audit covers the governance and risk ground this article is about. For a direct conversation about securing your agents, get in touch with us below.