The AI Agent Identity Problem No One Is Tracking

By Blumefield | October 28, 2026

The AI agent identity problem now has a name, and it has quietly become the defining enterprise risk of 2026. Somewhere inside most large companies right now, thousands of software agents are logging into systems, pulling data, moving money and triggering workflows, and almost none of them carry anything resembling a verified identity. This week IBM made the problem the centerpiece of its biggest software event of the year.

The scale of what is coming is hard to overstate. IBM, citing Gartner, says the average Fortune 500 company will run more than 150,000 AI agents by 2028. Yet only 13 percent of organizations believe they already have the governance in place to control them. Every one of those agents needs credentials to do its job, and every credential is a door. When no one can say who owns an agent, what it is allowed to touch or how to switch it off, the AI agent identity question stops being theoretical and starts looking like the next great breach vector.

For most of the past two years, the enterprise conversation about artificial intelligence has fixated on capability, on which model is smartest, cheapest or fastest. That conversation is now shifting toward control. The agents work. The problem is that they work without supervision, and the systems built to police human employees were never designed for a workforce that can spin up a thousand copies of itself in an afternoon.

Inside IBM's play to tame the agents

At its TechXchange conference in Atlanta, IBM unveiled a suite of tools built to give every autonomous agent a governed AI agent identity before it is ever allowed near a production system. The approach rests on three ideas that sound obvious until you realize almost no company does them: know which agents exist, give each one a verifiable identity tied to a human owner, and hand it only the narrow, temporary access it needs.

The backbone is HashiCorp Vault, the credential-management platform IBM acquired and has now extended to machines that think. The new Vault 2.2 gives agents their own secured accounts, rotates their credentials automatically and layers in post-quantum encryption. A companion product called Agent Identity acts as the authoritative record for each agent, tracking its owner, its lifecycle status and exactly what it is authorized to do. When an agent reaches for something it should not, the system can revoke access in real time and end the session outright.

IBM paired that with new muscle in its watsonx Orchestrate platform. A discovery feature hunts down agents built in rival environments including Amazon Bedrock, Microsoft Foundry and Google Gemini, a tacit admission that no single vendor owns this sprawl. A containment feature can drop any agent into an isolated sandbox behind a kill switch. "The winners in enterprise AI are changing how their business runs," said Dinesh Nirmal, senior vice president of IBM Software. Nvidia is in the mix too, wiring the identity controls into its secure agent runtime, with the chipmaker's John Fanelli noting that businesses need enforceable control over how agents operate and what they can access.

The numbers behind the alarm

The urgency behind the AI agent identity push is not manufactured. A 2026 survey of 508 IT and security leaders by identity firm C1 found that 95 percent of organizations already run AI agents that autonomously perform technology or security tasks. Nearly half, 47 percent, now manage more non-human identities than human ones. Only 22 percent say they have full visibility into those non-human identities, and 80 percent suffered at least one identity-related breach in the past year. Spending tells the same story, with 91 percent reporting fatter identity and access budgets.

Other research is bleaker on the hygiene front. A 2026 SANS Institute survey found that 92 percent of organizations are not rotating credentials on even a 90-day cycle, and that 74 percent are deploying AI systems that need standing permissions to operate on their own. No single safeguard, whether approval gates, sandboxing or audit trails, is used by more than four in ten companies. Okta, meanwhile, reports that 78 percent of security leaders now rank controlling non-human access as their top concern, a striking jump for a category that barely registered two years ago.

Put the figures together and a picture emerges of a technology racing ahead of its own guardrails. Companies have handed real decision-making power to software they cannot fully see, cannot reliably audit and, in many cases, cannot quickly shut down. The AI agent identity gap is simply the distance between how fast agents are being deployed and how slowly the controls around them are being built.

Why standing credentials are the real danger

To understand why AI agent identity has become the pressure point, it helps to see how agents actually fail. An autonomous agent is only as safe as the credentials it carries, and most carry too many, for too long. A single over-privileged service account, left active and unrotated, is an attacker's dream, because compromising one agent can mean inheriting its keys to dozens of systems. The industry has spent years trying to kill standing credentials for humans. Agents reintroduced the problem at machine scale.

This is why the shift toward short-lived, just-in-time credentials matters more than any single product launch. If an agent receives access that expires in minutes and is scoped to one task, a stolen token is worth far less. If every agent is tied to a named owner and a full audit trail, investigators can reconstruct what happened after an incident instead of guessing. And if a kill switch can sever an agent mid-action, a misaligned or hijacked bot can be contained before it finishes the job. These are not exotic ideas. They are the basic plumbing of trust, finally being retrofitted onto a workforce that arrived before anyone built it.

The threat is not hypothetical. Over the past year, security researchers have documented autonomous agents being weaponized into fast-moving attack frameworks, a trend tracked in Blumefield's earlier reporting on agentic AI attacks. An agent with a verified identity and tight permissions is a controllable asset. The same agent with borrowed credentials and no oversight is an insider threat that never sleeps.

What happens next

IBM is not alone in seeing the opportunity, and that is the point. The race to own AI agent identity is quickly becoming a platform war, with Okta, Microsoft, CyberArk and a wave of startups all planting flags in the same ground. For buyers, the fragmentation is a headache, but the direction of travel is unmistakable. Governance is no longer the boring compliance box checked after deployment. It is becoming the precondition for deploying agents at all.

For chief information security officers, the message from this week is blunt. The agents are already inside the building, and the window to impose order on them is closing fast. Boards that waved through aggressive AI rollouts last year are now asking who, exactly, is accountable when a bot goes wrong, and the honest answer at most companies is still nobody. Tools like the ones IBM showcased will not solve that overnight, but they mark the moment the industry stopped treating AI agent identity as an afterthought.

The broader lesson stretches well beyond security. The firms that figure out how to trust their agents will be the ones that can safely give them more to do, and in an economy increasingly run by software that acts on its own, that trust is fast becoming the real competitive advantage. The AI agent identity reckoning has arrived, and the sharpest companies are already asking a simple question of every bot on their network: who are you, and who let you in? Follow Blumefield for continuing coverage.