Rethinking Identity Security for AI Agents

Identity Security Enters the Era of AI Agents

AI agents are quickly becoming first-class actors inside the enterprise. They do not just assist humans. They make decisions, connect systems, and operate autonomously across clouds, tools, and data sources. For identity and security leaders, that shift creates both urgency and opportunity.

This opening session of the Identity Security Unleashed for the AI Era series set the stage for what comes next. Akeyless CEO Oded Hareven explained why AI agents fundamentally change the identity security equation and why familiar approaches can no longer keep up with autonomous systems.

AI agents are aware of their identities and secrets and therefore are able to expose them. Researchers have poisoned ChatGPT connectors to retrieve API keys and secrets. Simply put, password rotation is not enough any longer. Identity from a machine perspective is just exploding. And so identity from a machine perspective is becoming a massive problem. So there’s no static tokens here at this, but we’re able to use that machine identity to connect to Achilles, and then we’re going to fetch a dynamic secret, aka an ephemeral identity, out of Achilles, specifically an OpenAI API key, a short lived one. These credentials only ever live in memory, and they’re provided that way to the MCP server itself, dead within less than an hour, or whatever you configure the TTL for. Like, Achilles is going to clean them up afterwards. And if I need to, maybe I have a misbehaving AI agent, I can revoke those credentials and immediately kick it out of my database. Then comes discovery. Our AI insights engine continuously maps secrets and identities across environments, uncovering issues like unused credentials or excessive privileges.

Why AI agents demand a new identity security model

How AI Agents Change the Identity Equation

AI agents introduce a scale and behavior that identity systems were never designed to manage. Oded Hareven warned that their growth in volume, complexity, and autonomy will outpace anything enterprises experienced with traditional machine identities. Each agent creates new connections across systems and environments, increasing the volume and frequency of identity decisions that security teams must manage.

What once involved predictable, human-driven access now happens continuously, without pause, and often without direct oversight.

Scale alone would be challenging enough, but AI agents introduce a more fundamental shift. Unlike traditional workloads, agents can reason about their environment, including their own access. Oded pointed to recent Black Hat research showing how attackers poisoned AI connectors to extract API keys and secrets through malicious prompts. “This is very different than what we’ve seen before,” he said. “It’s not just a leaked code repository. Agents and large language models themselves can be abused to expose credentials.”

That behavior breaks the assumptions behind familiar security controls.  Static credentials become liabilities when agents can see them, reuse them, or leak them across trust boundaries. As Oded put it plainly, “Password rotation is not enough anymore. Secretless methods are the future.”

This shift creates real risk, but it also creates a leadership moment. As AI reshapes how systems connect and act, identity teams are no longer just reacting to change. Oded put forward a clear challenge: “This is your moment to become enablers and accelerators of your business by leading secure adoption of AI agents across your organization.”

Key Takeaways

• AI agents will outnumber human identities and create exponentially more authentication events
• Autonomous agents can expose credentials in ways traditional workloads cannot
• Static secrets and long-lived access create unacceptable risk in AI-driven systems
• Just-in-time identity and zero standing privileges are foundational controls
• Identity and security teams have a chance to lead AI adoption instead of slowing it down

More Than an Introduction

Oded’s keynote sets the vision, but it’s only part of what you’ll see in Episode 1 of Identity Security Unleashed for the AI Era. The full episode also includes a strategic conversation with Admiral Mike Rogers, former Director of the NSA, on the top cybersecurity concerns surrounding AI agents, as well as a hands-on demonstration of how AI agents can authenticate securely without static credentials.

To see how these ideas translate into real-world strategy and execution, watch Episode 1 now.