Your newest hire showed up this morning, deployed code to production, queried your CRM, and triggered three workflows before lunch. It doesn’t have a badge, a manager, or a name in your directory. It’s an AI agent, and right now your cybersecurity program has no idea it exists.

Two stories this week point at the same blind spot from opposite ends. Token Security made the case that every AI agent is an identity, and most organizations don’t govern it like one. Cloudflare, meanwhile, shipped Temporary Accounts on Workers so any agent can run wrangler deploy and stand up a live service in seconds. One side is warning about the problem. The other just made it trivial to create thousands more of it.

Agents Are Logging In Faster Than You Can Track

For years the hard part of standing up an automated service was the paperwork. A human had to request an account, get a credential issued, scope its permissions, and answer for it later. That friction was annoying. It was also a control.

Temporary Accounts erase the friction on purpose. An agent that needs to deploy something no longer slams into a wall built for humans; it requests an ephemeral account, gets short-lived credentials, ships the Worker, and moves on. That’s genuinely useful engineering. It also means non-human identities now get minted at machine speed, by software, without a person in the loop deciding whether they should exist.

Multiply that across every platform racing to make agents first-class. Each one issues tokens. Each token can read data, write code, or call an API on your behalf. The number of identities in your environment just stopped being a function of how many people you employ.

Most identity programs were never built for this. They count employees, contractors, and the occasional service account some engineer registered three years ago. The agents slipping in alongside real users don’t fit any of those buckets, and they multiply far faster than your offboarding process can keep up.

This Is A Cybersecurity Inventory Problem

Strip away the AI hype and this is an old cybersecurity discipline wearing a new outfit: you cannot protect what you have not inventoried. A non-human identity with a valid token is exactly as dangerous as a compromised employee account, and frequently more so, because nobody is watching it for unusual behavior.

Think about what these agents actually hold. Standing API keys. OAuth grants with broad scopes nobody pruned. Deploy permissions. Read access to customer records. When one of those credentials leaks, and credentials leak constantly, the attacker inherits an identity that your tooling never expected to see misused.

The Klue supply-chain mess earlier this week started with exactly one compromised integration credential and cascaded into Salesforce data theft across multiple firms. That was a machine identity, an integration token, doing precisely what it was allowed to do for an attacker instead of its owner. Now imagine the same failure mode, except the credential was issued automatically to an agent that no human ever reviewed.

An identity without a lifecycle is a backdoor waiting for someone to find it.

Onboard And Offboard The Machines

You already know how to manage identities. You’ve done it for people for decades. The work now is refusing to treat agents as a special exception that lives outside that system. Defense in depth doesn’t get a carve-out because the user is software.

Start with the immediate moves you can make this quarter:

• Inventory every non-human identity. Pull service accounts, API keys, OAuth grants, and agent tokens into one list. If you can’t name who or what owns each one, that’s your first finding.
• Give every agent an owner. A human being is accountable for each machine identity, full stop. No owner means the credential gets revoked, not grandfathered.
• Scope hard, prefer short-lived. Ephemeral credentials like Cloudflare’s Temporary Accounts are a feature here, not a threat, as long as you enforce least privilege and never let an agent hold a standing key it only needs for ten seconds.
• Log agent actions off-host. Tool calls, deploys, and data reads belong in telemetry you can alert on. An agent that suddenly queries ten thousand records at 3 a.m. should page someone.
• Put brute-force and rate controls on the auth endpoints agents use. Machine identities authenticate too, and those endpoints get hammered just like human logins.

The ongoing work is harder and more boring, which is why it matters. Build agent identities into your joiner-mover-leaver process. When a project ends, its agents get offboarded the same day you’d cut a departing employee’s access. Run a tabletop where a leaked agent token is the initial foothold, and see whether your incident response team can even tell which agent it was. Most can’t, today.

The agents aren’t the risk. Pretending they’re not identities is. Name them, own them, watch them, and revoke them, or accept that you’ve staffed your environment with thousands of anonymous logins you can’t fire.

Sources

• Every AI Agent Is an Identity. Most Organizations Don’t Treat Them That Way
• Temporary Cloudflare Accounts for AI agents
• Klue breach lead to Salesforce data theft, Huntress affected