AI Agent Security Risk: Unmanaged Access & Deprovisioning Gaps

When someone leaves a company, there's a clear process to remove their access. What's interesting is that this often isn't the case for AI agents. Many AI agents, like those built for internal tools or quick projects, are never formally deprovisioned. This means they can continue to hold the credentials they were given when they were created. While onboarding an AI agent might involve some thought about its permissions, offboarding often gets overlooked. The problem is more significant than with traditional service accounts. Creating an AI agent can be as simple as one prompt, with no formal request or paper trail. This lack of friction removes a layer of accountability. Here's the thing: machine identities, including AI agents, already vastly outnumber human identities in most organizations. Industry research suggests this ratio can be between 45 to 1 and over 100 to 1 in cloud-native environments, and this gap is growing. What matters is what happens to these identities when no one is actively monitoring them. One analysis found that about 8 percent of machine identities have no listed owner in HR or IT systems. The bottom line is that unmanaged AI agents pose a security risk that many companies are not yet addressing.