Most AI Agents Still Run on Shared Credentials, and Security Vendors Are Racing to Replace Them

Enterprises did not wait for a security model before putting AI agents into production. According to Gravitee's State of AI Agent Security 2026 report, 80.9% of technical teams have already moved past planning into active testing or production, yet only 14.4% report that every agent they have deployed carries full security and IT approval. The gap is not primarily a monitoring problem, though monitoring is thin too. It is an identity problem: most of the agents making decisions and touching production data are not, in any meaningful sense, distinguishable from one another or from the humans who built them.

The Identity Model Nobody Rebuilt

Gravitee's numbers on this point are specific. Only 21.9% of organisations treat their AI agents as independent, identity-bearing entities. Instead, 45.6% authenticate agent-to-agent calls with a shared API key, and a further 27.2% rely on custom, hardcoded authorisation logic built for a world where the caller was a person at a keyboard, not a system acting continuously at machine speed.

A shared key means a security team cannot answer a basic question after an incident: which agent did this? Every agent behind that key looks identical in the logs, assuming there is logging at all. Revoking access for one compromised or misbehaving agent means revoking it for every agent sharing the credential, which is precisely why so few teams actually do it.

“Security teams cannot protect what they cannot see. When agents interact with production data before they are even vetted, ‘Shadow AI’ becomes a back door into the enterprise.”

Jorge Ruiz, Director of Product Marketing, Gravitee

This is a different failure from the one this publication documented last month, where three separate surveys could not agree on how many AI agent security incidents had actually occurred. That disagreement was about counting. The identity gap is about attribution: once an incident happens, most organisations cannot say which agent caused it, because most agents were never given a self that could be named in the first place.

AI Is Now the One Doing the Attacking

The identity gap would be a tidiness problem if attackers were not already exploiting it. Check Point's 2026 AI Security Report describes AI as having crossed from development aid to live attack operator, doing the hands-on work inside intrusions rather than merely assisting the humans running them. As evidence, researchers point to VoidLink, an 88,000-line command-and-control framework an AI environment produced in under a week.

The report's growth curves point at the same target the identity data does. Malicious prompt-injection detections rose roughly fivefold between March and May 2026, and indirect prompt injection, the kind smuggled into content an agent later reads rather than typed directly at it, reached nearly 1% of all observed prompts by May. High-risk prompts doubled from 2% to 4% of enterprise AI traffic over the year, and organisations were found deploying an average of ten AI applications a month, many without formal authorisation.

Business Services recorded the highest exposure of any sector, at 5.91% of AI interactions carrying significant data-breach risk. None of this requires an attacker to compromise a well-defended endpoint. It only requires reaching an agent that shares a key with a dozen others and was never watched closely enough to notice the traffic pattern.

The Industry's Answer: Give Every Agent Its Own Identity

The most direct response so far comes from CrowdStrike's Agentic Identity Provider, introduced in September 2026. It replaces static API keys with the SPIFFE identity standard, giving every agent a verifiable identity tied to the human or workload that owns it, and moves authorisation from a one-time decision to a continuous, just-in-time check evaluated against real-time risk.

“Point-in-time authorisation becomes a legacy approach the second agents are given autonomy.”

Elia Zaitsev, CTO, CrowdStrike

Identity is the front door, not the whole house. Check Point's own guidance addresses what happens once an agent, however well identified, is compromised anyway: a layered defence across the model lifecycle covering model poisoning, adversarial inputs and training-data exfiltration, so that a breach of one layer does not automatically hand over the rest. Trend Micro's foundational guidance targets an earlier problem still, organisations that have not yet built any structured AI security programme at all, and walks through the controls needed to protect models, training data and inference pipelines from first principles.

Read together, the three responses describe a stack rather than a single fix: know who every agent is, defend the model and data behind it in layers, and have a programme in place before either of those becomes urgent. Enterprises that have already deployed agents into production, which per Gravitee's numbers is most of them, are building this stack under an incident clock rather than a planning one.

• Inventory which agents have a real identity today. Nothing else on this list is actionable until you know how many of your agents share a credential with another agent.
• Treat identity as a day-one requirement, not a retrofit. New agent deployments should carry a per-agent identity before they touch production data, not after an incident forces the question.
• Assume an attacker already knows which agents share keys. A single compromised credential now carries the blast radius of every agent authenticating behind it.
• Watch specifically for prompt injection, not just malware signatures. Check Point's fivefold rise happened inside traffic patterns most legacy security tooling was never built to parse.
• Layer model and data defences behind the identity layer. A verified agent identity does not by itself stop model poisoning or training-data exfiltration.
• Fund the identity layer ahead of the next point product. Nearly half of security teams already spend more time maintaining tools than defending; an identity gap does not close by adding another dashboard.

The number worth sitting with is not 88% or 65%, the incident figures that dominated last month's coverage. It is 21.9%, the share of enterprises that can currently tell one AI agent apart from another. Everything else, the injection rates, the unauthorised app sprawl, the identity providers rushing to market, follows from that single, quieter statistic.